{ "Event": { "published": true, "date": "2021-05-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-17", "timestamp": 1621296182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e44714b8-1cac-473f-9fdb-935be6fadc60", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9746384b-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260610, "uuid": "bd0e763b-e2d2-4f42-a258-e3ec4cd36393", "comment": "Malware payload", "value": "901e8f99256749c56fb0179cdb61a431", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260610, "uuid": "a4836163-4642-4032-940e-548e2c8f1c30", "comment": "Malware payload", "value": "000d4b61b949ba53cfb6f7864b2cdacc202fdbe1f39a9fc8bd4046c3597713b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260610, "uuid": "51fdda41-ce72-40f5-9e27-9e3c6261e6d5", "comment": "Malware payload", "value": "b6cc9da709521ba88d4fe923337249ff81939ef7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260610, "uuid": "dfab3554-73b3-46a8-b181-551ed8d58fdb", "comment": "Malware payload", "value": "5447cd4ebb3f2b065451368ec313c023fe443caefe0c73183067b3ab112e03de4dd7906f1f809fff2308af5e64818fee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260610, "uuid": "90a3e045-2fd8-4acf-9472-5711c6b87dd8", "value": "C433F17147ACDAA62DB1D4BFC086FD04FFF1C865C4AA861685FCB0C8B6D02555E72E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260610, "uuid": "54938fad-e0d1-47b8-9e76-2d160f905ed3", "value": "1536:1jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67ns:RB9wzbqtWb08UscYJhnpjyq9qawns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260610, "uuid": "e1966000-6ea2-48b3-9fbf-55494425e00b", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260610, "uuid": "c9ab9a49-6975-4619-b46d-ca285df74652", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260610, "uuid": "d5ce5a10-7466-4a4d-b8e2-47d962742c04", "value": "diagram-191968604.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54babef5-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257062, "uuid": "e3130b4b-2d5a-45ac-9a90-5c27230bce53", "comment": "Malware payload", "value": "228bcc71c206bba23f9e9ea466b8f823", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257062, "uuid": "cf06b167-310e-44a1-9f52-cc33a60bbd12", "comment": "Malware payload", "value": "0034d1d2a36293abf0088a87002b2976e47339a46eaf328740723df7e9b59dc6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257062, "uuid": "8c273aa1-9eab-44fa-828f-a0f428be1601", "comment": "Malware payload", "value": "f2563aad03804bd375ada2deef4a981c37a8908a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257062, "uuid": "5797ad72-edfa-4a61-9864-532649101287", "comment": "Malware payload", "value": "596af8daf3e378406cf0b2486588656ea9d958299de2d9d0fcd55622b239cf409787e86e426e58a2290cc9600fd1f302", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257062, "uuid": "8e99932a-ec7c-403c-881f-bebd22be3d43", "value": "7C330186D265218DCE4FD29630F1FACCE5DE7E830DA9B4D0A63D2B0581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257062, "uuid": "ad00e2c0-417b-4ba0-8997-5937f64e1b73", "value": "1536:42fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3C:Jfqhp+g5ru2kmUEt88IxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257062, "uuid": "bd1ee20f-9ac2-4d1a-9d47-5a6f4247a292", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257062, "uuid": "e154a310-a5f4-450a-900a-7a82762c8e5d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257062, "uuid": "a06b8298-8da5-42f6-adf2-cefb2f82a483", "value": "catalog-1329649893.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a92aa97-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264347, "uuid": "e72de4db-b236-46d7-9214-8ece05bdccb7", "comment": "Malware payload", "value": "0029a8b20a923693038417cee2390c18", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264347, "uuid": "2968ba9f-dcbc-44a5-8e8d-52a16713eae6", "comment": "Malware payload", "value": "00520ad20d01401c425ad902392859041a8d38f2ef1b89484430f9e465691283", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264347, "uuid": "58d468c5-6015-4822-971d-ab810154cabc", "comment": "Malware payload", "value": "8806e74cb09ea9bfc471e82aa61f223403fc509e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264347, "uuid": "ca538f36-dfc3-49c1-9103-abcb082cdbd6", "comment": "Malware payload", "value": "7a886a9034168f8ba8b4debf0ac8cf66160b390becfe135f006c44d8b07a6f7ff74cd74ae53296ceaca3522fab9dbc59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264347, "uuid": "d9bb00f5-10d1-4a22-af2e-9dcb388df4ea", "value": "6C3302E48907F046A759B81DDC6FAD078F3DDE0E83BC7892026EC0839E61AB56549D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264347, "uuid": "ce2c1fbb-c13e-4073-a3e3-b11ba9d3edd2", "value": "1536:7XXtg3K7774iXfEz5lnm/hQMOEYus1GpFY:jXma7774mfCyWMB/4GpFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264347, "uuid": "48fd3af8-5a5e-40d1-93d7-f2ac69e63803", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264347, "uuid": "b2106efc-7190-4873-a144-b092a54cfe78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264347, "uuid": "89af5772-5a32-4c6e-8590-674693fcd87e", "value": "statistic-65969809.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c5a131-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216874, "uuid": "9bdf92e0-86a4-4cc3-8206-3c3986f903af", "comment": "Malware payload (Dridex)", "value": "587af9b87bf63be1ef817924119cd84e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216874, "uuid": "d5ab5325-0728-45ce-93cb-0b689fc7c819", "comment": "Malware payload (Dridex)", "value": "006ceeebdbb507e3efa86aa652aac27714123eda9752f160ddbc68376557bdfe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216874, "uuid": "ca8ee45f-122a-4a23-88b0-dfcf02317c5c", "comment": "Malware payload (Dridex)", "value": "569b3c9c2c902709c6c6e336bde34e78b02c2e47", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216874, "uuid": "a79da518-fc0a-405f-9c7f-46d82289af25", "comment": "Malware payload (Dridex)", "value": "daa673c4c1417a2f87ff655caca220e82e2471f8fc33b3dd5bf3e3d32ad331d1253067c08608b28b452cdfcd1452f07d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216874, "uuid": "6a385922-f051-4527-8dfa-f680c72b8387", "value": "FCF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216874, "uuid": "9dbef6d6-c9c9-4120-9b33-56baac75d868", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216874, "uuid": "e2bd4e9f-39d5-48eb-a388-760f5df7874b", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216874, "uuid": "6f3d7b27-5e7a-4d9d-aaa0-e57f4db73467", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216874, "uuid": "d9f4293d-5c0f-4dc1-9efa-28dee7a6033b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216874, "uuid": "75a6bf0e-5b86-4b23-a771-7a6cb1822849", "value": "587af9b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bea853-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257327, "uuid": "bdb86e54-193b-40b6-aacd-2d90944a6213", "comment": "Malware payload", "value": "f5214448aa8394deb5e1ab961e5577a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257327, "uuid": "5bb2d865-c69c-4d9f-bf92-4799b18b5e1a", "comment": "Malware payload", "value": "006eec659af83530d7918bf42914445d02ae2923d9149e9c8d2df50ede9a3b80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257327, "uuid": "f3898b09-d950-4c7b-9747-83c9e80818a1", "comment": "Malware payload", "value": "d8ff380daa37b9e76954ed8aebfba642c1db7519", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257327, "uuid": "87135c6f-fe14-447c-88f3-9d8333216964", "comment": "Malware payload", "value": "6df520f95cdcc46af0eafe3c3a84becb49ba5344d3e84d8f5cea75dbe9a05709051c01eafc9a09547f62bb51e3dd8d69", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257327, "uuid": "fe3e877f-6dc5-4f9c-96df-6f2019099402", "value": "6E330291D694028DCE4BD3EF20F6A9DCE55EBE13099AA8D09B7E0B0191534F1482F69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257327, "uuid": "dcaa3fb7-c37d-484f-b710-efde8191a9f4", "value": "1536:/2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIB7bh:Ofqhp+g5ru2kmUEt88B7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257327, "uuid": "abd785b7-ae42-44b2-b233-412ce6338c1f", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257327, "uuid": "b93c597e-caac-4b65-b2d0-0090eb9b7252", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257327, "uuid": "8f0b0b92-0a3f-45fc-a94d-12820643ff12", "value": "catalog-1497988730.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f90a52-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261915, "uuid": "c712b70b-1001-4c60-b9d6-2ab8ca61e2c6", "comment": "Malware payload", "value": "add9d328ab387a869c59176aa3a3913b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261915, "uuid": "18e9fa3c-292d-466e-a493-7d4ee77bcbe7", "comment": "Malware payload", "value": "0075043d243d675f70d2f61a89ab52ef17bbc62e94e6878c1f7d2091d332bc89", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261915, "uuid": "cc4d20a2-bc77-4eda-9d77-623cb169eb58", "comment": "Malware payload", "value": "daa56c39695b09e26ccb9839bb73e27a7db3c6b0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261915, "uuid": "c14d9904-b3b3-412d-9ab2-1e3a06b2bd2a", "comment": "Malware payload", "value": "4d9f0de31b10fd95eb618d6eb58137d4e3c8d5648d11622704eb1f000cdb860c07f227bb05c23f71cc0cf8ba1721a7d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261915, "uuid": "5ceb94d5-7b7f-4db0-8c0a-cc7b2c9be413", "value": "A733F2714BACD9F62CB2E4AFC88BF904FFB1D455C4D78A2649F871C8B6942459E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261915, "uuid": "97b96e74-63b3-4e84-9583-0a4c10928bf2", "value": "1536:fjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXf6:bB9wzbqtWb08UscYJhnpjyq9qBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261915, "uuid": "024c3a90-75bc-43c8-b803-3a141d04a8a9", "value": 52849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261915, "uuid": "ab883b72-1b4d-476f-8f18-dd70a84852e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261915, "uuid": "fe356f47-df9f-44e9-a78d-bea960a0c49e", "value": "diagram-87464789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aab2822-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264427, "uuid": "751b5816-2581-455f-a173-5685c9776ff3", "comment": "Malware payload", "value": "1717de073c6a003831b413b541856624", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264427, "uuid": "2438b0ce-c9bc-4027-a2b3-79608c027b44", "comment": "Malware payload", "value": "00a50d0af7cea0ec415f4c092fbdb4185a359153d07453cf00221a4599c48b6f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264427, "uuid": "0753b58e-5bab-4008-bd00-51db86ac347e", "comment": "Malware payload", "value": "fb01f370820c070c5afe7dc1e374bb81b80c366d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264427, "uuid": "759cc094-07a2-4141-b724-a412f6ece092", "comment": "Malware payload", "value": "ac859c343dffef6bcbcb100500b4821ffa7deca7b8c4523ccb6fdd4ef7baa33632e536b26fc14b64374adff119256a95", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264427, "uuid": "9640e8e8-77fa-41aa-9871-8a64149b641d", "value": "143302E49507E0479748BC2DEC9A9D438F3CE91E033E78D2122BC1975E61AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264427, "uuid": "34f40b90-5aec-4864-b07d-297aedb588e0", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZg:6Xma7774mfCyWMB/4GpWvZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264427, "uuid": "12e9a4b3-f759-419e-8638-2efc9bff13ae", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264427, "uuid": "59731249-8a80-40f1-b557-35bf24f8a3ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264427, "uuid": "dea5c174-c341-4340-b472-fafb99a79b99", "value": "statistic-714292469.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e45352-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258940, "uuid": "5fa105cf-990b-4d93-bdee-4c223a0c7d21", "comment": "Malware payload", "value": "071929601367a4189debf3c99a58f5f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258940, "uuid": "fc9244d1-0cb5-417d-b78d-c97f734c11ad", "comment": "Malware payload", "value": "00a7eb203be8e787bf603492d1a87c56aaa06ee127212587f9247bbe0c17b288", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258940, "uuid": "2da1b9f0-83f4-4b0c-8b4a-6b52851f8cd8", "comment": "Malware payload", "value": "6c12ca9e4f545d2afdb0443432a0200005f60117", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258940, "uuid": "c8ebc4d2-ec78-4412-adde-121148447c86", "comment": "Malware payload", "value": "422210721a86adb8f47eef2239c1b78d13d3880f3e2a2cc2eaf00d1a97f073ead12a5a488c6158c7ab0299f9cb384379", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258940, "uuid": "0d1112e3-f8c9-414f-99f2-8ecaead5ccc5", "value": "1C330186D264218DCE4FD29730F1FACCF5DE7A430DA9B4D0A67D2B4481931F0492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258940, "uuid": "eee3c002-c9ee-4d7a-b7a4-9e135d2913ff", "value": "1536:E2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ36:1fqhp+g5ru2kmUEt88Ix6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258940, "uuid": "2d5fbdb1-54ea-4249-95d3-c0e7dce62d54", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258940, "uuid": "e3261f9d-3b12-4ff6-af94-7215d74a0e95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258940, "uuid": "9cf9d93d-e2ee-4cfc-a0cc-f3e96d67841e", "value": "catalog-697302384.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f018ca-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261069, "uuid": "abb7cef7-90c8-4da2-935e-f7fdac686d87", "comment": "Malware payload", "value": "ae420e66e19f52ee8ec3baad3a49cf57", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261069, "uuid": "06b2e048-5eac-4a8f-b66c-9b7cd1a7cd65", "comment": "Malware payload", "value": "00aa506955faeda92a9da9c9e77faf4428803046401527b9ff898c4f99da4f42", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261069, "uuid": "69cceaee-3440-4a24-b021-558d90acc3a9", "comment": "Malware payload", "value": "b2edb9c361f9583a527d7cfbfb822ac325e04535", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261069, "uuid": "7d57f16b-7a6f-489b-a0b3-f79ee5b79a78", "comment": "Malware payload", "value": "e0007aea42beed45a3fc18f5b741c4fb1cb0dbf3be965239233e25a681d03ad5ec51c5982480e6837022e9e6efcb9d38", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261069, "uuid": "b33a55b4-bf31-4791-a8be-ee7349572027", "value": "5433F1714BACD9F628B2E4AFC88BF504FFB1C495C4D786264AF8B1C8B6941559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261069, "uuid": "75fc0146-1b0e-4cc5-b722-dd0452a64600", "value": "1536:sjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX7b:UB9wzbqtWb08UscYJhnpjyq9qBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261069, "uuid": "45503c2a-64f8-42dc-a5c4-f3a095dc732d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261069, "uuid": "38d67f3d-82b5-46b3-97dd-eb592800e2eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261069, "uuid": "94e39994-2fdd-4571-9297-216512fccff9", "value": "diagram-294401601.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e02eaae-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258286, "uuid": "b00e3048-d704-4636-9e7e-c581539e985e", "comment": "Malware payload", "value": "8897959b86ef3f0da9a5d18d5ba5f914", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258286, "uuid": "1d8f582b-e48e-4ac7-83c6-1dbc8eedf946", "comment": "Malware payload", "value": "00d379977f30f19dd60d4b38cab04b76df83667cffed05a943f5b54c886ff4f4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258286, "uuid": "335a45bc-3fde-4584-b7dc-8fb346d5481d", "comment": "Malware payload", "value": "f65f0886f9d79c3246207e3b8986ee23587b4175", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258286, "uuid": "d674b287-3cf6-454b-990d-984bab13e77e", "comment": "Malware payload", "value": "09ce0bfaaf8d2ab5c5816602fa7519c10cef582c830f5164b5cdfe30144a8831bde9446c2465f3b28385b219479ca682", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258286, "uuid": "40ee171b-beef-4ec0-afae-39134db5e0d9", "value": "3133F141E158119DCE4FE1DB30F2B9DCE58EBE43099A68C09ABE5B46C1931F5492F28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258286, "uuid": "7c983908-b01d-4462-8636-38f3e77c9084", "value": "1536:d2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIgqfwH:Yfqhp+g5ru2kmUEt88gCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258286, "uuid": "6f4725a2-7776-4b31-88b2-d6d381d38bf1", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258286, "uuid": "d31380a5-75ae-4cb0-aa1b-19c7d889ce25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258286, "uuid": "5815bc53-b2f9-4dec-8cab-3d23ab3a51d3", "value": "catalog-300815460.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659c9326-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257950, "uuid": "0ad44f6f-52c0-40ac-9400-bffc94790fb1", "comment": "Malware payload", "value": "fe57684ba7f645e16bb59cb423a5b63a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257950, "uuid": "888a99b7-494f-4ca2-b856-66266c8ce438", "comment": "Malware payload", "value": "00da00ebcaf092002aee522131c7107b20d2a807b6651929b1418d93e5f2a0a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257950, "uuid": "aa365248-5ba5-4a22-9101-6bd016da9f04", "comment": "Malware payload", "value": "a63668c8e2783e1d159a091c3129e52d8ffaed33", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257950, "uuid": "19511590-2d49-4cc4-bd61-8c013dd868ab", "comment": "Malware payload", "value": "ca03fa0b278d7aaa2199bdf16cb04078bcabefb22db53415a465109a60758f3bcf5ff51078a02971d127ff11a80d7b21", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257950, "uuid": "77835dc4-a60d-48d9-b1b6-9a02d105147b", "value": "2933F1469219128CCE4BE1EB30B7FAD8E6DD6A430EA9B0D09B7D2745C5A30F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257950, "uuid": "c93e2a4e-9c70-45a9-b3a1-93e164e90a4f", "value": "1536:M2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAupSl:9fqhp+g5ru2kmUEt88Aem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257950, "uuid": "ceb31ba3-cdbc-4d53-8892-d98bbca42668", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257950, "uuid": "dcc834d0-ad01-45b6-b15e-bfde7ce09237", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257950, "uuid": "a1905f45-dd09-41cc-937e-056d62c6b368", "value": "catalog-1989087639.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c611bb8-b742-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1621278040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621278040, "uuid": "bc8f3494-d509-47b7-9df5-fcfe0472bd6f", "comment": "Malware payload (NanoCore)", "value": "394ace161e0686f29cf0f646b4c2b55d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621278040, "uuid": "364ebf72-a7e9-472d-90a6-db6add7add80", "comment": "Malware payload (NanoCore)", "value": "00dbdb30bb96bc955320894322a70629181ee0900a040f8bd8ddc2ed38dce065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621278040, "uuid": "75a3cd85-f315-4919-9e7a-ea948be8dd5e", "comment": "Malware payload (NanoCore)", "value": "18727a8caeb7895ccd778e287abd28dae5afc92b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621278040, "uuid": "2c6dae63-04e6-42f6-bbfb-d615318a3093", "comment": "Malware payload (NanoCore)", "value": "f731f429d88cab2ec0e9d71272dc62869371f369f94b4072130f8d9096348335080132a584c709719e0bde12533a9376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621278040, "uuid": "2040b904-8a89-4fa0-a581-150fbfd49ba3", "value": "9784BFF62FDF5C0DC39E49F89A71A16882FCC1925DA7D3C394905EE5AB386E906034E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621278040, "uuid": "e03f727d-04f0-4750-96cc-8a775a08b1b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621278040, "uuid": "9e878cdf-8774-47e7-abb9-a581fca00a43", "value": "6144:zLV6Bta6dtJmakIM5fvKv90/zuSqdZk8KVl/ft6h6XtJo9kdf9K:zLV6BtpmkIpt60o9kd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621278040, "uuid": "42ced800-624b-4457-a0c6-781599366185", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621278040, "uuid": "feee94c7-f5b2-4b2a-99e5-c30f6fd53b60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621278040, "uuid": "a440fa4c-805b-4bee-b65a-6913eecef1bc", "value": "00DBDB30BB96BC955320894322A70629181EE0900A040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f826298-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257376, "uuid": "3350a1c9-1bbe-427f-bf62-0b1bd70dd19a", "comment": "Malware payload", "value": "1b8d024302e3c6e0299c6c50ddad9e84", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257376, "uuid": "dcc06f4f-06b7-469c-a593-389f1b5b1f0e", "comment": "Malware payload", "value": "0129ba24e300735f1e96f3a65219c8ccc032118ad566a1268f7e8d999ef1de88", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257376, "uuid": "d3210c79-7148-4444-a5dc-ec2010c5c3cc", "comment": "Malware payload", "value": "b7b4421934b618bd2757a82f4fce207a30a21fcc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257376, "uuid": "bce2d410-30ce-4f82-b0f0-6b9a3dc45d9a", "comment": "Malware payload", "value": "56cd176bb9a104252b0602c6f0af3eb77b430f46a0385fe4e61574c0beb65a00a46e748136661ab45bfc9c13ad02e2f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257376, "uuid": "d4418f43-8429-4024-8f56-512aa38212fe", "value": "9C33F141E655028DCE4EE1CB30F6F9DCF69E7A030EA974E09B7F2A44C1560F4492A68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257376, "uuid": "990b44fa-e18b-45ac-ae0b-93f4632556d8", "value": "1536:T2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jINN:yfqhp+g5ru2kmUEt88NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257376, "uuid": "de10909c-752e-4cbb-a1ba-8a8dc73fc919", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257376, "uuid": "7b039bf3-e51e-4975-8e6d-4b698d2b3ec1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257376, "uuid": "01a42cc3-b978-492b-bfcd-36396fdf3a01", "value": "catalog-1533904807.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d52213-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259299, "uuid": "07ab8a1f-6ef1-43cb-970c-9dfd0409372a", "comment": "Malware payload", "value": "8f03ccbf9199d13fe970c8f83ef5b669", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259299, "uuid": "834bc34d-c442-44b0-8001-d23fd13217e6", "comment": "Malware payload", "value": "01377378deec76dba269609f6e7c2e4aacd0b568ce6fe59a0a419533f298a708", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259299, "uuid": "79cd41e5-30c5-4332-8f53-8a6c95fcef6f", "comment": "Malware payload", "value": "6bc20e216e4e2cec0366e4d4643369b0650019d1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259299, "uuid": "f3e47afe-929d-499e-8a50-140d12d30d36", "comment": "Malware payload", "value": "063f3d60b68b984989b64e50228cb2280c51fe2f636c40d48af48aaa3350a8c87dbc83f3b2024c73965661e1753a883a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259299, "uuid": "29ee731a-8f62-49c9-889c-20f583c79440", "value": "4F330286D664214DCE4FD29630F2FACCE5DE7A430DA9A4D0A63D2B44C1931F0492BA5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259299, "uuid": "208a538d-5158-40e7-bb76-1c6884e8fc66", "value": "1536:l2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3P:Afqhp+g5ru2kmUEt88IxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259299, "uuid": "e2f9202f-20ab-4e84-9a65-e14d0eccc9b9", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259299, "uuid": "f04e95ef-ed81-49cc-8ef2-4f5cc6117215", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259299, "uuid": "9aacd585-4219-4e67-a71b-4b61611b3ac1", "value": "catalog-939356019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a740ca9a-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259348, "uuid": "26843099-8e1d-4e01-b521-3baddf903c90", "comment": "Malware payload", "value": "1653f7db299a035701a60895c1d8ee50", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259348, "uuid": "24945676-9abd-49d3-8921-2e9153fcf6e9", "comment": "Malware payload", "value": "014b9e988b1e8b79bb0fcd8e66573828061507899565fe0b22bbd3d2be1604a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259348, "uuid": "b4ddf882-6228-45ff-908a-de4e1ae94dc0", "comment": "Malware payload", "value": "1b44ec22b4b2f9f483abb7d8fbfd266185160b89", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259348, "uuid": "188e05aa-3452-4a11-be45-36080d8b4345", "comment": "Malware payload", "value": "25493a0432fe1a0e6f204cd6d76daa7ba4ef3f4cb4f69e841209d73421a04b2c490a9f875911c229fbd1c9c97fc8cc2d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259348, "uuid": "13351234-1b3a-47a2-b6ad-132b6dd890ef", "value": "ED33F141E655028DCE4EE1CB30F6F9DCE6DE7A030EA974E09A7F2B44D1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259348, "uuid": "36ec893f-98ca-42ec-a0ec-9b99fab94e21", "value": "1536:22fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIj2:bfqhp+g5ru2kmUEt88j2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259348, "uuid": "88505c6f-3abb-4510-94fd-fd92aa27f622", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259348, "uuid": "0d24a4e0-e4ca-4ba2-92de-036d7a13b658", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259348, "uuid": "b703bbab-63c2-42a2-98c4-f93094659276", "value": "catalog-978318897.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0a6def-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260516, "uuid": "6daa4acf-a0c0-4eee-9205-24e31b33357e", "comment": "Malware payload", "value": "4c6cee500a5002d3023f458706fe5af9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260516, "uuid": "78f4ca94-f0bf-424f-be00-94583f947c3a", "comment": "Malware payload", "value": "014eee06182406cfbde5b736f95d60f91b0f2cce5ec16498cbfb4fdf1e08516b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260516, "uuid": "2fa4ea8a-a67b-4cc5-8e8e-45f4372a7370", "comment": "Malware payload", "value": "dd3f9a250cc3399a5d55e3ea9a6a110f3d2f4373", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260516, "uuid": "b68fa266-e8e0-4759-bc65-39c125e7e612", "comment": "Malware payload", "value": "dff9449741a2c011472b5ed9a93c8423ba1b46a1876417fc0f8bfd88e7b5a85acb5c8a5126ac0ce508fd11d200983c83", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260516, "uuid": "950c2d26-c534-4284-98bb-fc902ddcfea3", "value": "3C3302314BECDAF629B6E0AFC8C6F604FBB1D455C8D3866249F8B1C8B6D01855E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260516, "uuid": "ebc124c5-c934-4d6c-a649-8094c56231c3", "value": "1536:VjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXAJ:xB9wzbqtWb08UscYJhnpjyq9qBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260516, "uuid": "a573f056-7ec1-4720-ae95-6f94f2b3bc4b", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260516, "uuid": "6abaf15e-ec55-47fd-8764-46da15cdd0f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260516, "uuid": "165ee4c7-2c9e-46d5-b859-ac877dc9efc7", "value": "diagram-183386911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80eb83dd-b708-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621253271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253271, "uuid": "01abb47b-86a6-4f3a-b9fc-0196812fabb8", "comment": "Malware payload (Dridex)", "value": "59e46492248465753485cc970e20ca9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253271, "uuid": "da6d3a61-471f-4100-b1c4-371a24c159d3", "comment": "Malware payload (Dridex)", "value": "0154275fdc9c0c94a527659153894f6b79a8d009b750d56dd2727fcf3dd79d97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253271, "uuid": "1487341a-0e30-4547-b4e0-01982cfa65b6", "comment": "Malware payload (Dridex)", "value": "ad710f99ab202858ee20bdfa7f363554583cdb77", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253271, "uuid": "bbb33119-0ce1-43e8-b708-396d9b83cff0", "comment": "Malware payload (Dridex)", "value": "b47775aea763ea7373f4c45cb16f564a171bfd70f3e33231c132ab33276040a08d55f935ac82be70566c8ff27ec62018", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253271, "uuid": "bb4a0a30-e9cd-4ddc-8d7b-7cd6538f79d8", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253271, "uuid": "0f41a2b3-18dc-4787-8006-a87cf44dacde", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253271, "uuid": "320207bb-5792-43ce-9d6f-5a6454a3e7e2", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621253271, "uuid": "b7788672-9402-430d-aaa7-aebe357a4ab5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621253271, "uuid": "3faca288-19f6-4e92-955d-356595369b03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253271, "uuid": "5a0ba1d5-db39-48e5-aee8-792dffc689a6", "value": "59e46492_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c39fce-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259928, "uuid": "9c9db21b-473c-4b05-a612-0302d673c505", "comment": "Malware payload", "value": "c4cb7b4381df6a4bde2f198f1185391c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259928, "uuid": "ce91805d-bf31-40b1-9d90-b97b9ae2a95e", "comment": "Malware payload", "value": "0173a1b672891c16c6f39a2c6e0c7ddc8f8aac3b07c776f24315b113bf23e0a7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259928, "uuid": "8967fa83-ed60-4ea2-95b2-3e8781454032", "comment": "Malware payload", "value": "0b474bf4b899e35157ec1fa8c4baf1383432c534", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259928, "uuid": "ce68df38-5540-43ef-8135-6278a2c2c106", "comment": "Malware payload", "value": "573c8ebb4172a121df3d91dd591ef56cef165fd76c756f66050ee67404fdc74513791e46fcb4c61f05127c0dc687a935", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259928, "uuid": "81f7d69f-466a-4688-9e5a-0691d32b586b", "value": "9833F17187BCD9F668B2E4BFD8C6F904FBB1D499C4D78A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259928, "uuid": "2bfd4876-f76f-425e-bf47-f7ad26bdb2b3", "value": "1536:4jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXbB:4B9wzbqtWb08UscYJhnpjyq9qBbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259928, "uuid": "5f54f620-3029-4a5a-8a9c-5ea3384e2dc7", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259928, "uuid": "810cf844-861a-4814-a649-37362cce7af4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259928, "uuid": "bddcd9d0-f885-4cfd-b4d7-d509e2d5e298", "value": "diagram-1459566215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc47080-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258772, "uuid": "648e6258-5ff5-4f4d-8a22-b838a6c6c5b6", "comment": "Malware payload", "value": "5dd8e709827748981bc150cc54ac27f7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258772, "uuid": "add430ff-3880-45fc-bcb5-a3199422c1a6", "comment": "Malware payload", "value": "0179216cb8e2e2e12b05c464df8fe0490bfb8154e86ada5cbe3e4f3fa5b238d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258772, "uuid": "40358fc2-415d-4333-b37f-13b56d221d7e", "comment": "Malware payload", "value": "cf15933dc62d29d1c56eaaaa171e9811ee91930b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258772, "uuid": "6ba1a46e-4d9b-4586-a7a3-951a8093d774", "comment": "Malware payload", "value": "223633c1e43139842fd4ee1413f6017637a269550eeaca58fb0af1fe9a3c277e8d94fceff414ce2937115cc4070e86e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258772, "uuid": "6027f2b0-2956-4de1-80d9-2a84ca03cba3", "value": "4833F1469218118CCE4BE1EB30F6FAD8E6DD6A430EA9B4D09B7D2745C1A30F1492F65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258772, "uuid": "20fd17f1-6a72-4503-85b0-ea93fa3981f0", "value": "1536:22fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuVSp:bfqhp+g5ru2kmUEt88Aew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258772, "uuid": "6369ee39-50a1-480b-8d3f-749f76013a4a", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258772, "uuid": "6b494084-a233-41aa-a21b-0667b3c5fff8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258772, "uuid": "474479e6-867c-4b74-b179-c86e34251006", "value": "catalog-548226356.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09091dba-b74c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621282276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282276, "uuid": "ec61a1e4-97ce-4944-9361-583be495432d", "comment": "Malware payload", "value": "f24e61041a7c5a36e523afad1242d744", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282276, "uuid": "04a0b55f-ac7b-4be8-a18e-0bd628e9054f", "comment": "Malware payload", "value": "017e09a2d7df80143e6b240e01b6f620aa08b3e1485b41e7cc016c02c86561a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282276, "uuid": "3315ba39-64f8-44b2-baa2-1dad662ee6a2", "comment": "Malware payload", "value": "f9eff99a9294947c59c7f23bb4f59c770a9dcaba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282276, "uuid": "ce856064-7414-4ba3-a9f2-710175cae9b5", "comment": "Malware payload", "value": "734e50d34b9839dbfeb224d56df3337a5fd1a296469be65ab04d48c1bb52ae12ab8d4f5fd640665dbd65a26daed6715e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621282276, "uuid": "f8adee51-baff-4518-8c75-8d80c8cfa9fa", "value": "A604123CD0354C98C2A6447ACC68C149AC653116EDF895ED269CB998EE627F30F6FB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621282276, "uuid": "4c88fdd6-8ebe-4ae3-a4e9-beea62efcae0", "value": "3072:pWD3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDG2oF:pYE5SDvbXAyHbVt15wTQDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621282276, "uuid": "10d6796e-cc24-43e8-a717-070ccec4f924", "value": 175043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621282276, "uuid": "1ccdeb87-f5aa-46f5-a0ae-e1f4a10814cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621282276, "uuid": "096b6555-9d47-4d18-b471-e8cb140ecaea", "value": "Compensation-638449167-05172021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d821bf1b-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260719, "uuid": "477cf70e-257a-46e9-abb7-51e00505110c", "comment": "Malware payload", "value": "32240a9c5d9b36c7cd8b559ebd9d5d59", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260719, "uuid": "7dbd9119-5cdd-4c0d-8776-7faf93eedfa6", "comment": "Malware payload", "value": "0184fb51fe9671c939fc595c9457834ba863dd37982a5fb953b22f33e828eb90", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260719, "uuid": "0985b5ad-7979-4276-a7ea-793399c59406", "comment": "Malware payload", "value": "5dc5d8f6fd22b5b5730bc09a414ecdfd642314f5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260719, "uuid": "82c9af49-b932-47d7-a97b-54da25c564d6", "comment": "Malware payload", "value": "1254b3403c8303ae1d0b79dba2ff3727c7a13aaef14e23ecff65c9b8e402d9cb3dfddcfc9ee22aabf8cd8a9c6e192a72", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260719, "uuid": "8f52e607-1fa9-4c7b-9db5-14153e33d4d1", "value": "1033F1714BECD9F638B2E4AFC88BF504FFB1C495C4D7862649F871C8B6942459A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260719, "uuid": "f284baa7-d41e-4a8d-8824-6b90d04b254d", "value": "1536:8jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX3/:EB9wzbqtWb08UscYJhnpjyq9qBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260719, "uuid": "4380ef15-a6eb-4172-9b3b-6c7891878822", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260719, "uuid": "78ffdd2b-972b-4200-836c-9fa03c9ecd3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260719, "uuid": "184c7d9a-2d38-4f5b-946c-a0e0dcc8514b", "value": "diagram-1985349820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553f647b-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261358, "uuid": "324fde20-f928-4679-a644-accd81933710", "comment": "Malware payload", "value": "c5ed16ac3ea4c9f318d65c5fb0b952c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261358, "uuid": "3a530131-590c-4ea7-9293-e497cb7ea3a9", "comment": "Malware payload", "value": "0186bff57aed875f7aa1badf54b5b401935ff9625170d2b8798b738bbcfd1f0c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261358, "uuid": "dd393903-ad8f-4160-924f-7b569a8e4c83", "comment": "Malware payload", "value": "b6b6380d22d0bae692422cc220b6ea0db9b92a0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261358, "uuid": "26f7ad18-c441-4a91-a214-971639a4218b", "comment": "Malware payload", "value": "bb991837eb0b66ff1faf6ca1b414fde294da749a79562e11c32237ca93cbe340e1a88c8a20d12eef206b263854052423", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261358, "uuid": "b5cab06a-b468-4f7b-8930-3f11137c763d", "value": "5833F1354BACC9F66DB6D0BFC8C6F604FBB19495C4D786224AF8B1C8B6D02945E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261358, "uuid": "2e18ad76-3605-4193-b108-d19b4eeb8161", "value": "1536:+jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXs4e:2B9wzbqtWb08UscYJhnpjyq9qBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261358, "uuid": "4ad27dd1-a751-4a5c-99ec-cdc05362d8d6", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261358, "uuid": "393ec71e-45a3-4bd6-8572-38cf9704fe8e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261358, "uuid": "3ac4a74d-8426-4a4a-917b-f9943ea39b61", "value": "diagram-491559836.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636e8a61-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261812, "uuid": "89bdc908-c63e-47b8-948e-93ab5ffae7e2", "comment": "Malware payload", "value": "6dc3406e03ca6d709de45dc134ca7a11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261812, "uuid": "16f98d32-398b-4820-8dd7-35fb3d9016ca", "comment": "Malware payload", "value": "01d8ed4aa03e195a02a9be2748c623d686201a4c620a92c02d469cefa0cd920a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261812, "uuid": "51e00279-4692-4b57-a071-c2fb106afb6f", "comment": "Malware payload", "value": "8a1d72f238594111045a5a8d4a9e3895cee98d71", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261812, "uuid": "18571bdb-b5c8-4363-b7b5-dfa047d11dae", "comment": "Malware payload", "value": "1c397634a7dc64b1ca0ad68c413011fc6b69bb68921d3081c08e9e59d90b932469e74b9d26ad4947ffd696bb9055d596", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261812, "uuid": "936a2e5e-d0fe-476a-9e2b-55e31f53e5a3", "value": "B333F17547DCCAA76C31E1BFC4C6F845BFF29421C897872245F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261812, "uuid": "b27acdcf-e4ee-4276-b846-84b891388361", "value": "1536:UjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w9:cB9wzbqtWb08UscYJhnpjyq9qEK0w9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261812, "uuid": "35075429-fc06-442d-a946-d1b7defef143", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261812, "uuid": "6a8b6c4e-4552-460e-8360-63ec8d9120f0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261812, "uuid": "3b59661c-7d99-4b20-88c4-0ad0147dde49", "value": "diagram-805288862.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a7adc2-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258970, "uuid": "cca54068-9238-47e8-9c5f-25cdfbf70d4f", "comment": "Malware payload", "value": "1b6ad23779a42ab93b9aad8a9b692f59", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258970, "uuid": "3fe7a6f1-e8f0-43bc-91c3-20f73b35605e", "comment": "Malware payload", "value": "01e969c5cbf0f55731836a27f565a1bd38cb95617a4cfa398489985bc918a135", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258970, "uuid": "ca29628a-f3fa-4819-a7b7-2f778f3503b2", "comment": "Malware payload", "value": "38086a973d9fa715907d10115efb99cb902a3436", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258970, "uuid": "71c3f10f-12d0-46cd-819b-c841da5ca292", "comment": "Malware payload", "value": "84909b9a635cc10e3d5edd1c442d3531df67e329ac8ff48c1e8f493407fca8b9c5bf25f57d26780d74d2ea6cc863186f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258970, "uuid": "54c914f7-0057-4fd8-960c-48662878d470", "value": "DC330186D264214DCF4FD2A630F1FACCF5DE7A430DA9A4D0AA7D2B0581931F0492AA5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258970, "uuid": "b641b4d7-0c16-4976-8fc7-b209d95fa89a", "value": "1536:v2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3w:efqhp+g5ru2kmUEt88Ixw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258970, "uuid": "2bb42722-9899-49f0-afb9-3afa29d03603", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258970, "uuid": "14ef9387-de20-4569-af89-e99877ffe746", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258970, "uuid": "66a6646c-8e84-4ea4-a250-e181920bd604", "value": "catalog-715878920.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241679a8-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263423, "uuid": "09a9ed28-5506-4350-8d1e-1279fef88787", "comment": "Malware payload", "value": "faaec16fe53d29a518b5db3316bc05a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263423, "uuid": "56e9ab3d-35e5-4816-8902-7d61d8a13fa6", "comment": "Malware payload", "value": "01f2fcd380970c42d7bb40c0247dc0df5a7d4bd76b75d3bdbf7714217545ceda", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263423, "uuid": "91a022a4-9fcf-46e5-a68a-de607c5d2ddb", "comment": "Malware payload", "value": "4e25e953cf97b1f8b582fd3622dc65934de82623", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263423, "uuid": "77252b7a-dcca-46fe-9af9-55aabf9baa87", "comment": "Malware payload", "value": "f981438e6b060e919b4e3b27e8aa28033b72ae637da7da53089d27d0f71fca7d71a86a45042208da87d29e4ef921820d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263423, "uuid": "6062cfaf-3882-44f1-b3db-ee9fb15e31f0", "value": "E23301A0A902D087A719BC2DDC7A6D038F3DE90A473D6C53113AD0874E629FC7649E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263423, "uuid": "e4c5f48a-63b6-45d6-bf8b-57571a0b49fc", "value": "1536:tXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qLxj:5Xma7774mfCyWMB/4Gp07wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263423, "uuid": "5a0ec83b-a6da-42cb-939d-48d60df5a37b", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263423, "uuid": "d17ef4e4-3a52-46aa-8e7e-74d333b92699", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263423, "uuid": "b6332704-6171-4596-83d8-5e4541da73ad", "value": "statistic-1882354537.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed37aa6c-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261613, "uuid": "81c484f1-54b3-434c-9e62-4a3d75ed0073", "comment": "Malware payload", "value": "c70869b7bd84814c2b689ebf4f159591", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261613, "uuid": "fc8997c4-01cc-4b8d-897f-34ba36653813", "comment": "Malware payload", "value": "0224dde3982126e493d9cf0d238542a701e168d3fd8864b6228783b9c164c623", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261613, "uuid": "418b9626-466e-46dd-ad76-09eda1051a1d", "comment": "Malware payload", "value": "2fb91c3c54a6c8522e2678568f2d20cc35b5ad29", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261613, "uuid": "858c2995-9d56-450e-9d0d-257feb9d76f6", "comment": "Malware payload", "value": "e805f55f47be21ca0b469531d5b483ad8b206fa741792c603dd24ef84c64c5d9e131c63566c108a9b92d91979f22f830", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261613, "uuid": "068cbe9f-4f6b-46ee-b279-bfa199abfa1c", "value": "4233F17547ECCAA76C72E0BFC4C6F845FFB29421C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261613, "uuid": "5b3de7fc-4b50-4bde-9341-1182c16139f1", "value": "1536:BjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wu:lB9wzbqtWb08UscYJhnpjyq9qEK0wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261613, "uuid": "fb9e2c31-dd89-46ab-8748-5a3f3410c79b", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261613, "uuid": "eb130d06-fe6a-4821-b7ed-5768644c47e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261613, "uuid": "acb6ffb3-079b-4d1d-b685-0b4292cc4555", "value": "diagram-665718608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8173cf4c-b6cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621228791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228791, "uuid": "c18bc6dc-6b21-449a-abd2-2ffbe0e517b5", "comment": "Malware payload (AgentTesla)", "value": "7fbe59c611346dc4bf5c185d82ca9184", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228791, "uuid": "fb9a165c-066d-4df4-aa12-b45989414e84", "comment": "Malware payload (AgentTesla)", "value": "023290e5b1583d7ec938c6f4372ef61f6d4a9b3e766af56023ef610bcfa5276f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228791, "uuid": "d82d165c-9b88-4325-a32c-5415036a26da", "comment": "Malware payload (AgentTesla)", "value": "c8ee9cd93194a152966170c01171a53e7f35d94e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228791, "uuid": "4b629228-e827-491a-a9f6-99ac5798384c", "comment": "Malware payload (AgentTesla)", "value": "5290b45dc2ac808fa39335b5b75c2eb4e102987f2599b65e1369ca4236de656a0ea8648a54e26559a3edadca9683a3df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228791, "uuid": "87693e38-1723-4bff-9597-4e9cffd33525", "value": "ED1527802626A19DD4713BBDA13134E403B8EE27F8E94DD7429C7B22FDFB9110FA5925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228791, "uuid": "f5aae443-0f5a-4645-90a6-aee7ffe4d7b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228791, "uuid": "9a15441b-51db-4318-b83a-d2c686998d3d", "value": "12288:IjKxeayECYOYhcbIkJjH/A0wCKarTcjgxdJ0v28w35/B2hOhea+:6IeagYhaIktr+cdCvrw3tB2Mhea+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621228791, "uuid": "8f23646a-7088-4198-984d-89eed5d42d6d", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621228791, "uuid": "a6372d68-1687-4808-8eb7-97b35e1c7da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228791, "uuid": "3983ce02-a917-4959-a4c4-cad86c683f75", "value": "sw_Inv-05838084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a04421-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259938, "uuid": "8f9f8f86-ab6b-4ea3-a7ca-f7fd29226180", "comment": "Malware payload", "value": "1a0d28f0c723652684f788d8977ea0b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259938, "uuid": "317354b0-7ec8-44d4-81b3-08e516c9ed0c", "comment": "Malware payload", "value": "02369d80626efdb72e07c4b316cf114beb3dd6b266c6a571b2f50a8386cddb7b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259938, "uuid": "a7af8589-75b3-4b87-bc04-3d88dd5f28a5", "comment": "Malware payload", "value": "d9f035bb20baa14b1dccc8f9eda4dcf84de1c56a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259938, "uuid": "3370e4b4-8352-4ca3-a289-200670b9314e", "comment": "Malware payload", "value": "d69f7a446014c2f8d76e00d1bcd9f53b5e6b0ad3704c4a01e369c374aef185aebee3d57917fffb91c6ce58187bfc0830", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259938, "uuid": "0fc2254b-a08a-49eb-a5f0-a342d079b91d", "value": "5133F1724BFCCAF669B2D0AFC8CBF504FEB2C455C4C78A614AF871C9B6901459A22E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259938, "uuid": "665f148a-2eab-48d7-b823-eeab524aba52", "value": "1536:8jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXXH:EB9wzbqtWb08UscYJhnpjyq9qBXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259938, "uuid": "07ec8124-6f27-418d-acf8-5ee05d61f0bb", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259938, "uuid": "1b05835b-42d3-4f81-921a-7e8c0315fc6c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259938, "uuid": "cc5906f2-ba25-4196-8b00-68e08836213c", "value": "diagram-1469608905.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f61f494-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261912, "uuid": "ea4486fc-708b-4216-99ab-21c85100dab4", "comment": "Malware payload", "value": "e227a67d58e8088a3c131bea5eac67ed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261912, "uuid": "7c77b924-7be4-46cb-989b-e3abc47e76f8", "comment": "Malware payload", "value": "0245d29094fbc9ace13650577a0630cd2ac06d80c994444a6b1167f2fdc0ad38", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261912, "uuid": "0098504e-e665-4ac1-a562-3523f0172dbf", "comment": "Malware payload", "value": "bbaa19a3739f25b0d35517b814aa71b60acafeac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261912, "uuid": "41b1a3ad-c039-49eb-a10e-be1fa0a35465", "comment": "Malware payload", "value": "90fc04d8d918bdf138ce3ccd436f40a7423e6b174e82316da858e9e3579581e6560b30e05f5af3b3438d0aab8cc07afe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261912, "uuid": "aa38702c-44b3-4259-9965-9e846c7c03e6", "value": "0433F13547FCDAA62DB1D0AFC4C6F504FFB1C4A5C8C7CA2649F971C8BA901455E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261912, "uuid": "a1fd3b93-a153-465b-8fae-9f52431572cf", "value": "1536:FjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXMY:BB9wzbqtWb08UscYJhnpjyq9qBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261912, "uuid": "e514f71b-1f51-4b0d-99b5-23c45f98a21a", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261912, "uuid": "b7bdd31d-c3a8-4600-aa20-0f3965dae6cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261912, "uuid": "4d481f4c-eebb-497c-8037-08664fcdeae4", "value": "diagram-874369140.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fbcd6f-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261784, "uuid": "4c3ec4fc-2b37-47f0-9a51-ba2201694277", "comment": "Malware payload", "value": "e19c00777bc421dc712e1d59b694ad8c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261784, "uuid": "5a5694a7-df41-43c7-8ec4-4ac7c53c9fb7", "comment": "Malware payload", "value": "024b7c56ef46256297644f6ffd0504703b349ec8b64a4659c46324538d05282b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261784, "uuid": "d908698e-d623-4957-aeea-d2399fa5d9f0", "comment": "Malware payload", "value": "4c1504d375a96ae641df4af4498ff4f9704d45bc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261784, "uuid": "ad24ae0a-d478-4840-8f55-25f9a456c31a", "comment": "Malware payload", "value": "0698b2d1cd723e09d30d90105535c77d55600a1f86b42271c663ef53374ecf3c6a4d1c3961f118e440a2622981243346", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261784, "uuid": "e09103d3-402f-4071-bc48-0301cae9a76b", "value": "5933F2354BECDAF629B6E0AFC8C6F604FBB1D495C4D3862649F8B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261784, "uuid": "6e6c1db7-8293-4542-bbba-73290b7d8d56", "value": "1536:LjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXRB:/B9wzbqtWb08UscYJhnpjyq9qBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261784, "uuid": "f03f3979-3d97-4c56-9810-a66f40ae8d51", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261784, "uuid": "d5446d2c-2b93-4083-a328-bdd02376586d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261784, "uuid": "c9813b51-4185-415b-afa5-dc0753dfa8e1", "value": "diagram-786942854.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b6b53b-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621258457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258457, "uuid": "ab7af905-615c-4af1-88d3-418dacca04d5", "comment": "Malware payload (AgentTesla)", "value": "1efc4f1ac123ef5e2d4bd3fb09c8fd18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258457, "uuid": "8241ab53-8f3d-4827-82ad-591342d0e883", "comment": "Malware payload (AgentTesla)", "value": "0257f081c0709f4a50d493855097f9fd1690cda8e296ef2cbce4ba0f2bd2125a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258457, "uuid": "946bec0b-49bb-47a9-8424-b3a9a7870328", "comment": "Malware payload (AgentTesla)", "value": "10d21fe8d4286be6e36b2afa46531d46ad7eeea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258457, "uuid": "c80c2ada-5dea-405c-9f5b-e92dd86899d3", "comment": "Malware payload (AgentTesla)", "value": "d618859c627c815b8d3fe4eff481b6b878ff46405fcbc20396b4a3d5dd1c14e61e5cb85e91eac5f432b58fbc7c209b88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258457, "uuid": "1da01e0c-10c7-4ce1-b9e0-11c0a0b2733a", "value": "2FF4E0A523F89B15E03843788874E5258FF07C07EB6AEB05BDED329A6FB2B414917705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258457, "uuid": "fca29456-1d94-4ae3-b48b-808d60c1c851", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258457, "uuid": "dbb97da9-87f8-46b0-8dca-9e15c36e708b", "value": "12288:nGp7BxgvgQS6F0MLFL/6EEpHbL0sMmaFKzFaJIS81M:mf6FDmxb1MmawzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258457, "uuid": "b00d18f6-6819-4606-99ac-c2f44fdaa5da", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258457, "uuid": "d2d6590b-b0f5-4ed9-be08-8bec15eebc57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258457, "uuid": "a6980a80-9e5b-4ddd-bca7-9f5a16d096c5", "value": "PAYMENT COPY.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8221d2a2-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264440, "uuid": "a3eca5fa-47d9-40c5-8edc-a3209f815f0e", "comment": "Malware payload", "value": "0d17cb329c31526241878e00957dcf90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264440, "uuid": "c956066e-8834-4e2a-ba6e-f5639a7581da", "comment": "Malware payload", "value": "025e0766fd11b0caa26b69ee76eb626a54860a11cea7be82fdaf2744a1e3230d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264440, "uuid": "33e84a04-44e1-4791-bbed-d1e2ba3fe5e5", "comment": "Malware payload", "value": "80ac12bc8b56744e0f162d3557c6fa465878898d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264440, "uuid": "8a4d746d-ce18-4999-8d21-74a04c2fcb19", "comment": "Malware payload", "value": "d17cfa2ca97612246aec7147d01e7019b5625aae18bef126994bfeff729aa29fb716600e1dcc12541b7315bbd5ab42ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264440, "uuid": "d87d1e9e-e483-43e8-bf05-0b6804747d3b", "value": "4733F2E0D901E087A754FC58DCAB9D038F39DD59073DB852027EC0C79E62AB5B646D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264440, "uuid": "9715da98-f71b-4851-8c5e-042fa592b88d", "value": "1536:SXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOjm:CXma7774mfCyWMB/4GpCOjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264440, "uuid": "97156bd3-b069-4016-a599-ad9b9764f1ae", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264440, "uuid": "506f3816-eb1f-4108-bbff-2a9619356555", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264440, "uuid": "18def27e-a2b9-4e45-b877-5631b166853d", "value": "statistic-724061205.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf744347-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264113, "uuid": "2b685c20-1008-4b0a-8b5e-957253433369", "comment": "Malware payload", "value": "095ed1f3c0aa3f68dfc2c5fd451b8b03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264113, "uuid": "4e4d3117-9fb2-408e-a6ac-b89fd26fa7f6", "comment": "Malware payload", "value": "02632de3baf99f2ce0225af76f5c19ebb196e6ef30c0b91a4d00de224dc152cb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264113, "uuid": "51b72c3e-d522-43c6-89d9-c97e5c8d048a", "comment": "Malware payload", "value": "ea04aeb371f3f68b0bb2fe94d3c1c87a9ec28da2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264113, "uuid": "a4a9df52-2acd-494d-a8bd-e081d5a06261", "comment": "Malware payload", "value": "c7e8a4741671cd3c98ca3c545ec944116b44ef7a66277de43ee68870dac9c13ce3384ea8765e566d30984e4e0c6092fc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264113, "uuid": "fea32419-bc4f-4f64-b9af-67b49c2b7b05", "value": "363302E49507E0479748B82DEC5B9D438F3DE92E033E78D2112BC1D75E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264113, "uuid": "40902597-db4a-4760-8197-22106d87e1f7", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZX:6Xma7774mfCyWMB/4GpWvZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264113, "uuid": "8c44af86-2cc7-4bd6-80db-4777506cbc53", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264113, "uuid": "2fa6e314-8077-441d-adbb-8d7108b893df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264113, "uuid": "b4449387-6e79-44e3-a298-c40d0912e31e", "value": "statistic-504698175.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb8ec7f-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264807, "uuid": "2866a23a-a0d3-462c-b96c-05385dfb9f46", "comment": "Malware payload", "value": "dd5c6050d62bc5e581faa7c82c280542", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264807, "uuid": "2b7c44d1-5d0e-4f2f-be5a-64e0bfcd307e", "comment": "Malware payload", "value": "027759fc0fb481d5e39e5346d8ba40c1528cdf16df1a1a108db2a2bd8406f405", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264807, "uuid": "8a0c1841-0214-4db1-8732-7bb3beb15889", "comment": "Malware payload", "value": "a127cfe3153dec632453b37a231d867a0e60a98c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264807, "uuid": "f1a19452-02de-4e6c-b252-ab82c14aeb7f", "comment": "Malware payload", "value": "e64e98a31ed25a31fcc22f70796991bf9f22af764f9f0bc228f55d7e3a1c6f48a9712a47b5be7d11aa8a0bfa54824f4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264807, "uuid": "7ca6f7a9-4b6b-4bd0-980b-c1b50838335c", "value": "5833F2E4A507E047E749B81CDCAA5D038F3DE91E433E78D2022BC1D74E61AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264807, "uuid": "8ece258b-1b78-4d6a-8a55-f0f2b370fff2", "value": "1536:riXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZSYh:WXma7774mfCyWMB/4GpWvZSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264807, "uuid": "ed89c012-7cdd-47f6-8caf-6cbad9e3b56e", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264807, "uuid": "00829ade-54fe-46ef-ae10-4cd85aa05640", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264807, "uuid": "bd1a026e-14bd-4c77-84b3-c370b835641e", "value": "statistic-970300261.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fe9eb3-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258762, "uuid": "c14c5782-37dd-4a4e-bc76-52fa964fd11c", "comment": "Malware payload", "value": "abc3b6d8573baf0141a412d3065d3142", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258762, "uuid": "657c7775-7387-48b1-a6d1-48587ca429c1", "comment": "Malware payload", "value": "02b71ac90f6da5f678055ad008810364c374ab3dbfa0635bead0710925db1c1a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258762, "uuid": "47ff4f4f-2333-438a-87f9-908c78eea9cd", "comment": "Malware payload", "value": "fa149afe91786ca3ee203385f38c019f2363fc2c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258762, "uuid": "e6efeed7-310e-480b-a545-8fc4dcb28ff8", "comment": "Malware payload", "value": "c68e3c7182c47474c7e670a2568c0dc3c81fe61b7d8ddc4013b81ee439ba79926e6c168bc28a5969724643c31d861a02", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258762, "uuid": "84e897a2-548c-467a-8c07-714f208f64d3", "value": "9133F1469218119CCE4BE1EB30B7FBD8E6DD6A430EA9B4D09B7D2745C1A30F1482F65B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258762, "uuid": "6cb1d31d-0fd9-4581-a62e-7b06d5dab584", "value": "1536:PL2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAugStm:ifqhp+g5ru2kmUEt88APR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258762, "uuid": "595a57e0-a292-4246-a7d4-bcee1cb019d5", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258762, "uuid": "3b691f0f-d42c-41ff-905b-be760a6fb25a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258762, "uuid": "e08445a2-1186-4295-983e-06fce4cb247a", "value": "catalog-543572152.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb11d8f-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216869, "uuid": "efa91bd4-78d7-4083-b8ce-5e5d6d2d7e65", "comment": "Malware payload (Dridex)", "value": "2406c11c5ebb87daef05f62c3aa3203c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216869, "uuid": "8289c098-327f-4726-b72a-a0620aa2bdf3", "comment": "Malware payload (Dridex)", "value": "02bba024fb6cb70d927517f4a1c75e0e5b6536cd40731176c658b12c37ff9084", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216869, "uuid": "c9049e52-eb83-44b2-927c-cdfdf533c881", "comment": "Malware payload (Dridex)", "value": "1c0c934d665643837869a517b4dfde7ada610969", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216869, "uuid": "9dd65424-0600-40be-813a-740e0e1c2a13", "comment": "Malware payload (Dridex)", "value": "4eee6498436283f6aca11b90ec2dbe42b8471349462df55a7492c3c0f04671c032f6e88eec2eba2bab4a70146d750bf8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216869, "uuid": "2d6e54fe-a3c1-496d-9bf3-c39847c73db1", "value": "DEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216869, "uuid": "7d015a60-a2c7-4f43-b883-6acaeaf721ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216869, "uuid": "10084a58-94de-47b2-bd44-bcfb1b7eef6e", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216869, "uuid": "a4872820-dc54-48ad-a2a7-2c3e94708408", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216869, "uuid": "f6effa2f-9583-40ae-9209-24a19d3ec6f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216869, "uuid": "c523bf41-1429-4eb9-ba1b-9c0d20c0074e", "value": "2406c11c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34c6593-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256792, "uuid": "c98b6e39-1bc6-43fa-bdc3-f8ed651ea0fb", "comment": "Malware payload", "value": "58dc35881210e47fdff94da020b3370f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256792, "uuid": "253c216c-a9e0-4ac3-bdbe-d9918be63df8", "comment": "Malware payload", "value": "02bf001a92bbb194d096a1fb0769fd224cccc3472d95b82c87ae7cae2b510be6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256792, "uuid": "dacc8c36-85d1-4d14-9a31-677cf015d3a7", "comment": "Malware payload", "value": "f3fc2bfb8b31a02111572c0c18c845f0791e61c2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256792, "uuid": "7f0153d2-eebe-4434-870f-f3787ac9b88b", "comment": "Malware payload", "value": "dc971e7df9f0981a3e2fc63cc8048d635e49c667e524e8916b50e2a9520b109510399df4f56c5ef61d921697d55356d3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256792, "uuid": "a45c6ebb-b245-4c32-b34a-6e797a18909a", "value": "E833F141E658028DCE4BE29B70F5F9DCE1EE7E530DAA74C0962E2B4191530F5483BA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256792, "uuid": "f935bb42-da51-45a8-99b7-e21474c1e1a9", "value": "1536:A2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxe:xfqhp+g5ru2kmUEt88xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256792, "uuid": "0ef034b5-4686-487a-a26d-b2e9c63300f0", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256792, "uuid": "6ea19152-8687-4b2f-8ae7-0990f694ee98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256792, "uuid": "5c5d5a32-a026-4872-930f-999b60935ce6", "value": "catalog-1101574172.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1639e5d3-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257817, "uuid": "d7a64d85-60dd-4a3a-866b-f13ec52a4d47", "comment": "Malware payload", "value": "f64651c5f49107237f20018bea73c69f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257817, "uuid": "51266c80-de81-4ca4-81d6-49cdae7443f1", "comment": "Malware payload", "value": "02cd7dec859552472cfedabe3c3cf9294f73c52d9d8f0c2433b8a7dc6cc01996", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257817, "uuid": "498ee2ee-1044-4842-9aa9-64e1cd49331e", "comment": "Malware payload", "value": "869a966aea22e33a4a49e527bed299ff185bd314", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257817, "uuid": "c6a310bc-4f07-4775-a913-6451c719d75e", "comment": "Malware payload", "value": "4ec8eeabb75283ce33db8d7ef2d621de1effea7bedfe7c8c985afec5f55bfd76308231212a3b93b9840081d315c05225", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257817, "uuid": "34f3c450-f6f7-4ef5-8b60-78d058606c51", "value": "7B33F184D164108DCF4FD2EB70F2FAECE5DEBF43099A68C09A6E2648D1920E54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257817, "uuid": "680ea56f-906b-42e8-9eef-3b12d6b7f675", "value": "1536:M2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbmQ:9fqhp+g5ru2kmUEt88mAbmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257817, "uuid": "abe24478-8f1b-4ef6-94f8-b901cb68edd7", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257817, "uuid": "3527dc2b-3547-4334-b594-098a6938dc64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257817, "uuid": "f762d48c-9a0f-4b03-87aa-7f1d93bcc130", "value": "catalog-189795843.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f6e6d7-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259210, "uuid": "f416c0cc-f938-4ae0-968f-7a44123ffb20", "comment": "Malware payload", "value": "844e9abd624747b1f0148bb9dd4643e1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259210, "uuid": "4abcc99b-1579-4d3a-ba12-76753835dfc0", "comment": "Malware payload", "value": "02d6dad98acf88a1a2148b79287abba898db5bb51c7ecb276f69e067cf909bec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259210, "uuid": "9b404cac-d792-4932-82e0-7c8fa13803ec", "comment": "Malware payload", "value": "c6a1ceed7507d5aa0c0e4f184a2e7ab9811e5104", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259210, "uuid": "4f4d9701-47de-4711-871b-8c42cbb7603f", "comment": "Malware payload", "value": "394f67aa94100fa021ddfed2d68932188858f26332917ad6101e07c041ea81bccc15d6453964a938392f6b4167f6898f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259210, "uuid": "381f25af-a4ad-4437-8eee-7ccd21178f4d", "value": "E4330186D264214DCF4FD29630F1FACCF5DE7A830EA9A4D0A62D2B0481931F4492E65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259210, "uuid": "b28a9dcd-232a-45f2-8a9f-9037f86c4cc0", "value": "1536:f2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3O:ufqhp+g5ru2kmUEt88IxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259210, "uuid": "8f3c4c12-d224-4824-8f23-f7e899a9a8e3", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259210, "uuid": "f94d60df-6e2d-4175-941e-d926f60b9ac6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259210, "uuid": "22907269-6925-4493-8ca5-8b14f5a222fe", "value": "catalog-859836907.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef153a6e-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261187, "uuid": "40b9a8b5-1df1-4d64-961d-e80b02d383d9", "comment": "Malware payload", "value": "c3ede9134e92d012a44cc32c8103338a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261187, "uuid": "c854104f-b9d0-4277-913f-dbdb5c746232", "comment": "Malware payload", "value": "0316f70044329d6a758293817f16e18b4b2b29a80f20cee80c135898e99b85aa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261187, "uuid": "9209142c-06f1-45e6-b9db-aef848c74dce", "comment": "Malware payload", "value": "bb59e854de9edbd325ed219ef43a833c8e3bd198", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261187, "uuid": "27e6826d-1180-4139-bc97-29b97aea6c4e", "comment": "Malware payload", "value": "87bfa94c099b3b46e386faf44fc630d5ba903f163a3f7e47a49451c942ed37e37060da6d489c8aba6a31d50fedcd6316", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261187, "uuid": "e4607e5d-b41d-44bb-ac51-ad30046cb172", "value": "2033F13547ECCAF629B5E0AFC8C6F604FFB1D455C4D3862649F8B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261187, "uuid": "f01b2fac-0cca-416c-b5f9-70be2098c12e", "value": "1536:2jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXGD:uB9wzbqtWb08UscYJhnpjyq9qBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261187, "uuid": "ce5cbb31-443c-434c-a884-a9e590e33b47", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261187, "uuid": "a1fb7072-0d81-4025-a192-22857ca23457", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261187, "uuid": "9a152e93-af22-4c9e-b008-5f3f527da35c", "value": "diagram-387572204.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accfefa9-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260217, "uuid": "53394af5-509f-42e3-a162-7f51ad552585", "comment": "Malware payload", "value": "0874f72b4c79d4960284a2e2b5c3af12", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260217, "uuid": "0c5bebb9-bf04-4f86-8e6a-11eefd4fd3cc", "comment": "Malware payload", "value": "03204f2492bcc9649c251bab66b5b8fc73fa48b3a07f61a33656d82aeee73d96", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260217, "uuid": "5f3d5c43-7ac3-4bae-91c1-c420949a5847", "comment": "Malware payload", "value": "4834d9f827821356062a86c680298db9173a924e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260217, "uuid": "ee87c06f-0c49-459c-9717-e6eac803da03", "comment": "Malware payload", "value": "118ca1132527f277f446a908101203408c75fb550ae8d592586c59dcdf61cc011f40c6ca4431b7e7d0f31b83ff4f5623", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260217, "uuid": "d22d81b6-cbe9-49a9-8d30-9edeb9d861a4", "value": "CB3302354BECDAF629B6E0AFC8C6F604FBB1D455C4D3862649F9B2C8B6D01855E22E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260217, "uuid": "4b894219-82c9-4ecc-8ab0-e56cd0a07f83", "value": "1536:CjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXns:yB9wzbqtWb08UscYJhnpjyq9qBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260217, "uuid": "eaf0371d-890a-4449-a528-08a22ce4da7e", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260217, "uuid": "c8e4e429-2981-4e13-8d20-2dcf2dfd1dab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260217, "uuid": "ca55cb44-ee5e-4126-9b94-6e3783fb3a16", "value": "diagram-1645804278.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4974d004-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257902, "uuid": "e9193f98-2f50-40e4-9556-84a4ccb5010d", "comment": "Malware payload", "value": "a5bcb9abba6779ec2edabfa9245d6595", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257902, "uuid": "a6a2914e-7d35-44de-8b53-0a99cbf08b69", "comment": "Malware payload", "value": "0336db0ba57bdeaaffbc8dfe725a5fd833b9dcfc31f323e56869434e8e8e24f5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257902, "uuid": "597058e5-9ea9-485d-995e-813eeeb4b705", "comment": "Malware payload", "value": "792d8637ec1c92cb6209013c12b39bbf7275e951", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257902, "uuid": "8edd1962-406b-44a6-a959-bb272078c974", "comment": "Malware payload", "value": "1ed68a87cfb1304ff2ce2eb57dd45378c04ace0de3a79f835c17bcb7f6e88fc2eaed5d3ce43424156f5aa4a609e238c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257902, "uuid": "17502fb2-5855-4ec6-a92b-6bed54157374", "value": "CA33F1469218118CCE4BE2EB30F6FBD8E6DDAA430EA9B4D09B7D2745C1630F1482F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257902, "uuid": "184f1f09-905f-4425-87df-58ead336ab5b", "value": "1536:j2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAukS1:ifqhp+g5ru2kmUEt88Ave", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257902, "uuid": "4769e90b-14b5-458c-840a-3aed825bf1ef", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257902, "uuid": "7c80f2f5-62f2-4ff8-841a-36a3b27fe75b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257902, "uuid": "bf42ddcc-8f28-4b1d-b530-12e5ad15cfe2", "value": "catalog-1954229478.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68995ea-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263320, "uuid": "e71ae310-725a-442d-a238-172900cc3f09", "comment": "Malware payload", "value": "eff36d5121d716b61f1de90e425c82ae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263320, "uuid": "895e60a2-f96f-40ed-8995-5d3465c12b30", "comment": "Malware payload", "value": "033841a3bf9d2e8a9da373a8ee33d005ffb61b9a90cd179234e80f3ba46d9303", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263320, "uuid": "38b3be5d-b4f5-495e-afa5-8dd1d62dad6d", "comment": "Malware payload", "value": "65f642cc0cd4de49186cf72b8f9d026af3c519e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263320, "uuid": "117fd4ef-0902-4f5d-81b0-436d1ccdfe5f", "comment": "Malware payload", "value": "549abdb3d28184b97563113e07a267f0e13bea16354dccd4bccb086372de9fda71739504390dd7988c9abb299a06cbb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263320, "uuid": "e4138c22-1c7d-4ea6-bc7b-6cd0f93a2303", "value": "D03302E4A507E047A349BC1CDC6E5D438F3DD95E433E7892012BC0D74E62AB6A241E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263320, "uuid": "fb0d3130-20f4-4884-98a0-768c28c3dc8d", "value": "1536:SXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZPKG:CXma7774mfCyWMB/4GpWvZPKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263320, "uuid": "d76d2408-1440-4f31-b08a-b5f7bb9b9580", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263320, "uuid": "9a3bb59a-8b27-4b3a-a7ba-13c618daec5c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263320, "uuid": "524b7c5f-53a8-4141-879f-8403cc2f29e3", "value": "statistic-1821679477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdc52ef-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257403, "uuid": "ce8dd641-62e4-4dcf-b4ef-bd83ce1491ad", "comment": "Malware payload", "value": "40ec5f08431387626bffbd1143a475c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257403, "uuid": "3bae4ef1-c4cc-40b8-8839-dd66b7920c7f", "comment": "Malware payload", "value": "0338473e678966ba9c99a075e0fee99bba976a24d9ed9ad72aa08a7a54636edb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257403, "uuid": "fa6754ea-4240-4047-aa44-7d2f28edd917", "comment": "Malware payload", "value": "1a7e679f06fc3a62f64a450c74b3baa25c14e285", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257403, "uuid": "2d127bf4-de34-41bc-8db4-2aaeb1b5228c", "comment": "Malware payload", "value": "aaa86fa29a96f57383393c927d8443e06dd983491477cd69b300b936694f57c9330a6001a4c0aca959e6d92411c27da8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257403, "uuid": "5b5fe572-31cd-47fb-9187-ddef1090f00b", "value": "D533F1469218118CCE4BE2EB30B6FAD8E6DD6A430EA9B4D09B7D2745C1A31F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257403, "uuid": "97629a4d-66d4-447c-984d-8b6f51886a00", "value": "1536:z2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAu4Sg:Sfqhp+g5ru2kmUEt88AzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257403, "uuid": "ce04f6b8-30d1-4014-a0a6-5ef90733ccbc", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257403, "uuid": "d180da9d-480f-4d1d-b420-abec3a911cff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257403, "uuid": "b9b04e99-3fa4-474c-a42c-ebe9785a2cec", "value": "catalog-1559335615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59010305-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263083, "uuid": "36e8d995-b2b6-4e10-a275-b159508eeba6", "comment": "Malware payload", "value": "69db00c515b3ff629aaf0ee520d40e22", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263083, "uuid": "d020d4dc-96ce-4f92-b231-1e40e9f47188", "comment": "Malware payload", "value": "0348251a3e1ebbdd62c2dcbbb6d621fe8b9d1396c7bf7e9d17b3011820c338b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263083, "uuid": "8c91bb2b-ddfe-4ae1-8709-b23a5d1f078f", "comment": "Malware payload", "value": "1ee826879eae4cd6b1e6a832dcc53991940bb1ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263083, "uuid": "f00a89a1-f5af-422b-83dc-9846d61cab40", "comment": "Malware payload", "value": "c7c14408b0ac0c996d672d21df787843d9fd4365dfd29ac4127df4c53b0dc6be1a725e63fdda4b05ffc8f7fee79e5d64", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263083, "uuid": "3f3eac01-364f-4351-938a-520e73c83f55", "value": "263302E49507E0479748BC2DECAB9D438F3DE91E033E78D2112BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263083, "uuid": "b164dfb8-485e-4e9d-b768-704cfb117284", "value": "1536:kXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZI:QXma7774mfCyWMB/4GpWvZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263083, "uuid": "e11278c6-834d-406e-9bdf-961a65c66384", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263083, "uuid": "07115df1-e26f-4211-9793-85c3750d0f99", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263083, "uuid": "d8027f14-ab96-4a7e-86c5-fbd46482852f", "value": "statistic-1618567714.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63508e4-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264071, "uuid": "758fabe6-3c90-49da-bd86-1e6116ec422f", "comment": "Malware payload", "value": "3ff5a52fde1d985a9840744be9b55fc0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264071, "uuid": "ce0bb538-c724-4ad8-8f1d-bbdc8d09375b", "comment": "Malware payload", "value": "034ef3f7825dc5c6bffdc15e5210d3f0c1792093586d95fc2c3f546f0bd45013", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264071, "uuid": "2ddc8eb6-71c4-45da-ad3a-4e738193666a", "comment": "Malware payload", "value": "5b92b0a1bf7c1d0f1323c27a9f6b34c8080914ad", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264071, "uuid": "f46bfcd0-e008-407b-b4b7-79506810b7c1", "comment": "Malware payload", "value": "e131b29427bd1ec8e9276bbe5be4af22a25f9f189bd61def0bbcdf4d301c7bb893bc80e18af61bcc2f70911d7f59574a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264071, "uuid": "e6bd3d1f-9b59-43dc-8b7a-852eab77431c", "value": "983302D0A901E08B9759B849DCBE5D135F7FDA1D037D7843017AC0871EB2AB5E349D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264071, "uuid": "17f2a16f-217f-453c-be5a-03c4c1e5ba23", "value": "1536:NXXtg3K7774iXfEz5lnm/hQMOEYus1GpE/tz+KJ:ZXma7774mfCyWMB/4GpAz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264071, "uuid": "45b59307-5907-43a7-aee1-56c1967ee064", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264071, "uuid": "9e898bf5-1b07-4284-ba1b-a49ce1a9a88f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264071, "uuid": "5b472c55-403a-4c32-ae72-a68ee734b3ad", "value": "statistic-463501721.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5288246e-b6ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621213250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213250, "uuid": "9910f2ee-6d55-4929-9e6f-7822c1b06025", "comment": "Malware payload (Dridex)", "value": "f9b285b64af4124343b6ad2cb9c88db2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213250, "uuid": "ac8b87b7-45f6-4d48-888d-d6f5f2707e26", "comment": "Malware payload (Dridex)", "value": "03565667934d646ed4ef38115f84175ffd5a1ce3a8186a774280a68a695b56f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213250, "uuid": "1dc19219-65cc-4725-b7f2-df626e09593f", "comment": "Malware payload (Dridex)", "value": "5f3e74b43686022dfc3a79afe2312dd20ac7a353", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213250, "uuid": "b018396a-225a-4792-b229-557b9067e15c", "comment": "Malware payload (Dridex)", "value": "b58c29c2328c539db8db1386fd70a352bc8bfee2e6e3f62f7f0203e4640461945d22e9d546c91b13019d08d41047496c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213250, "uuid": "0ef1fee3-921b-4efd-abee-f87a1f626534", "value": "9DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213250, "uuid": "d5250b46-6d9c-4de0-9624-032813fe8329", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213250, "uuid": "dd9ac7e0-a3d1-491d-bbee-0f0299dac558", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621213250, "uuid": "8d5d7462-1cca-4615-b0b2-8a0bd936e34d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621213250, "uuid": "83e6fe7d-2840-46c2-b682-ad7af0cfd898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213250, "uuid": "84d45d01-4d65-4e4c-8288-e72eb0e0b9e3", "value": "f9b285b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df5ee6a-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259950, "uuid": "2a3abfee-7d35-4c9a-a117-0602a65d20c9", "comment": "Malware payload", "value": "ab73b0e5ca7437d61cb970f491f54f7c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259950, "uuid": "4457727e-5e9d-4983-8277-1f23193cc162", "comment": "Malware payload", "value": "0361aa8265d5ae1282c03e6c14dec2e7abfec0082d59cc2445c8abedf4bef530", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259950, "uuid": "d487693f-cf65-4425-bd97-a97b59a25f28", "comment": "Malware payload", "value": "bbcad9537d9e5c131f1d2481cf8e3418f002552b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259950, "uuid": "fc83770e-a313-4728-99ed-34339006b009", "comment": "Malware payload", "value": "9335c12f45b0c1ad9ffb4efdd011c69ce312513c4b19cbd3976459fbe896fe60ae6c140ecf607f1c94527f8012ad1098", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259950, "uuid": "c2e3b602-679a-4a6e-9764-4f3ae4dc3a1e", "value": "4833F1354BECDAF629B6E0AFC8C6F604FBB19455C4D3872649F8B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259950, "uuid": "4ca74ff1-2094-4fbb-afae-2a47ab4ea7f4", "value": "1536:BjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX7I:lB9wzbqtWb08UscYJhnpjyq9qB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259950, "uuid": "513ec0b0-3d6d-4443-aa82-5b54505734e4", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259950, "uuid": "f97216dc-f85f-4056-b99c-3e5db4348d60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259950, "uuid": "bafe0422-90b2-48db-9143-9a07697373d4", "value": "diagram-1478042904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a403bd8f-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261061, "uuid": "60c1b40a-fd13-421b-a472-1f7ba9148d34", "comment": "Malware payload", "value": "5605b302d470e74f0f6626cb35dc3eea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261061, "uuid": "62e12907-f0b2-48f0-91d2-60fcf79e5083", "comment": "Malware payload", "value": "0367eed5553e5a417b4bade4ccf07c05fa25b25c4da6ba722f51de2800bc6325", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261061, "uuid": "d255517c-de96-4a3f-9fd8-322bc2d2f54f", "comment": "Malware payload", "value": "5c2abcf4348ffda8f1ed9790bf5dc3f99e091900", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261061, "uuid": "fd9ea169-a254-47cd-8e5b-4ab2d83b38e3", "comment": "Malware payload", "value": "e18ae3c0709224ff8577bb320acc414df4c2b2cfe74dc4846da8d954a90461daf5a35c366801490b2424fedae336f010", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261061, "uuid": "ac2419e3-f66d-4436-a506-8d686fa47697", "value": "E033F1714BECDAA62DB1D4BFD086F944FFF1C865C4AA861685F8B0C8B6D02554E72E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261061, "uuid": "10eb60af-6205-4ad0-91ed-3922d235f719", "value": "1536:2jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q671A:uB9wzbqtWb08UscYJhnpjyq9qaw1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261061, "uuid": "4b37831b-beea-4a02-9369-52ac81e73635", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261061, "uuid": "090dec02-b039-48f7-a571-85f34eb75266", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261061, "uuid": "c81a151f-cacf-4b80-8a9b-fffaba75ee20", "value": "diagram-287830537.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376d1a9a-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262597, "uuid": "19349ffb-e5b6-43f8-80e5-a39e4414a468", "comment": "Malware payload", "value": "148493e9f07abc769955a7e98dc3bf76", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262597, "uuid": "48526793-4fe3-45de-baf2-6b1c0183f1ad", "comment": "Malware payload", "value": "0384101ded226958557fb35bb1e6752b95898c59580d274d02c7731c1b14640c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262597, "uuid": "9e3c6faf-fb0c-4044-9de8-3b36f827b2a2", "comment": "Malware payload", "value": "af68f500d91572c47478af24e75f4d217583fd68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262597, "uuid": "97eb8b40-6440-498d-8109-2c3821e76749", "comment": "Malware payload", "value": "e17911067148a5782fe735ba5e66aefc55eb0a8872a33f043c37e676291ff0b28096b59a1a4f9a5ecbbd9bb7b30b740e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262597, "uuid": "052dad2c-4675-405b-8b2c-0b2f1fbf026c", "value": "F63301A0A906D087A759BC1DDC7A6D038F3DE90A473D6C53013ED0875EA29FC7649E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262597, "uuid": "e8788db9-0582-4c48-9a56-e21c4680d6d5", "value": "1536:bXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qzx5:DXma7774mfCyWMB/4Gp07E3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262597, "uuid": "31e0416e-6896-4c88-9531-804dbe1bfe59", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262597, "uuid": "a056ebff-ccc1-4f94-ac3d-8d78714c8fdf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262597, "uuid": "74718a70-7542-40b2-b155-ca0020506864", "value": "statistic-1277840904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b689ed-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261864, "uuid": "93b76ea0-8d05-4cb6-ad80-da8c0d4ca8e6", "comment": "Malware payload", "value": "66d879747f86047551f145d47f1ede5a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261864, "uuid": "1893da0c-b9f0-491e-8009-155735cc7f08", "comment": "Malware payload", "value": "038c5b2b308aa8e8abb5f1890ab260473b98db40cfc72ce27f270509c33be237", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261864, "uuid": "1029b816-b48d-4e50-933c-c15eb88c8172", "comment": "Malware payload", "value": "20ba9cecde95945c059e3ac14f43fd1ed2995366", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261864, "uuid": "ad686784-2137-4931-86c1-7ac5d059921a", "comment": "Malware payload", "value": "ba3ace824b1632fa5533ee6a799ad6a93063f545eca04a46c6bdfbc9cec66bc5dc53357035a88276868ece29969423f6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261864, "uuid": "c986f3d6-7c2b-4a8c-a863-4126034ca73c", "value": "FD33F2314BACDAF628B2E4AFC88BF504FFB1D455C4D7872649F8B1C8B6942555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261864, "uuid": "912974a3-e7bf-4b95-9fad-e8a8388dc046", "value": "1536:kjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX4G:MB9wzbqtWb08UscYJhnpjyq9qBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261864, "uuid": "82d7c557-1dc3-45d5-a0bf-553b4550f6f6", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261864, "uuid": "49b066e0-4293-4153-8e79-292968f66aac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261864, "uuid": "3a132d79-a487-4d5e-ba88-72ec338397ba", "value": "diagram-840990729.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a255ac-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258032, "uuid": "802cd493-ca00-48f5-8ec7-0a02f09bae67", "comment": "Malware payload", "value": "b98228146eefa094d47c8fdca9da688f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258032, "uuid": "3df138d6-5a78-434b-880d-7763e7157b39", "comment": "Malware payload", "value": "0396d255261f84e4e61c54230ea80579421cbadcb919a56ceafc0916d6e1d840", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258032, "uuid": "49eb26f4-30d9-4db3-912c-573e1e83550d", "comment": "Malware payload", "value": "40762199c88280173e9e1d9543981a34ab676a64", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258032, "uuid": "537b50aa-c801-445a-84d4-271a8b55950d", "comment": "Malware payload", "value": "4bba7f30227a2aa5b03036bd942274f8a913481c5d9a825beac7f8317304a585671c8d088f6111a499706702945e362f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258032, "uuid": "2af41709-e215-44a6-88a1-55c73d90c429", "value": "D733F1919558118DCF4FE2EB70F6FAECD58E7E130DA974C06F6E2B4981830B5092E54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258032, "uuid": "c6a498ac-8f0d-45e5-b763-3644ab24658a", "value": "1536:N2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jID15:ofqhp+g5ru2kmUEt88Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258032, "uuid": "3946d9b1-ac82-4a19-989b-595250a5a572", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258032, "uuid": "8eb41a91-e112-4afc-b7da-1ef01cd65bcb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258032, "uuid": "5af4ae89-cae2-41e6-b545-0e8be6a86508", "value": "catalog-2052763609.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae58354a-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258072, "uuid": "349e54a4-a373-45c1-8c8c-5476d857f1f6", "comment": "Malware payload", "value": "efd7e64628bf5ad0fcc5ba4a957f6575", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258072, "uuid": "b97cfb7f-d2fc-454e-8a0c-7bc40f059f0d", "comment": "Malware payload", "value": "0397d529f6a6aecbecc1e68030003fb39b0a0094bd588e5e462a6bf72f541e16", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258072, "uuid": "37812ad0-1c10-43ed-86a2-077b30e97b7b", "comment": "Malware payload", "value": "847a9943eec359941b8a9c85728d05d7e0aca1dd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258072, "uuid": "aa563c12-d180-4876-aa59-9dcc83dd4c09", "comment": "Malware payload", "value": "88655b482239eacdd9a85d511db1e59116f351c93d4a5ef14c437b235ff07faa6ff7e1843f710352c5a5959619d151a7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258072, "uuid": "86c6ce42-2f49-4095-8928-133225d63191", "value": "C333F1519628128ECE4BE2EB30F6F6ECE5DE7F030E6DB8D0576D2745C0930F4442A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258072, "uuid": "f7d40f6b-413d-4a3c-a339-1f7645d620e9", "value": "1536:I2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI9K:5fqhp+g5ru2kmUEt889K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258072, "uuid": "2ecce255-d3bf-4d9f-ab67-f191441c3198", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258072, "uuid": "d25b4373-4012-453a-b368-576fa207209e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258072, "uuid": "3bd20126-9dde-4e44-9909-95fd7a7219fb", "value": "catalog-2077934709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5b4819-b72d-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1621269375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621269375, "uuid": "db334b76-5bd4-4dba-b549-919654a7d6a3", "comment": "Malware payload (CryptBot)", "value": "37af093677d53ea9a210a36b3b766731", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621269375, "uuid": "0325f028-4b47-4bed-80f2-a81f30e2b5ea", "comment": "Malware payload (CryptBot)", "value": "039e69327e8da04224180c5d43571608eb86108b76aad6c2980e076958119700", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621269375, "uuid": "4c1792a8-7b69-4906-b186-bc8beb513f15", "comment": "Malware payload (CryptBot)", "value": "2000ad695b87dfc18a5210dbbd50d60423be83b6", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621269375, "uuid": "a83150d7-9134-4aa5-99a5-02babf09efed", "comment": "Malware payload (CryptBot)", "value": "411a5ba276785bdcafa4906734461049266ace440c7f60948565fc71d136d78fdadb41f5664c0261bafd755bee252e18", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621269375, "uuid": "a66acf69-637f-43e3-a70a-ecbf8655ca57", "value": "27F4F130AB90F23DF5B302F85DA9A37DA5A87E605B7410CF51D516ED5734AE8AC30B82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621269375, "uuid": "6b86c701-7917-4690-81e1-54bc3ec23e08", "value": "80c6cfcae6030c9599aead95aafa650e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621269375, "uuid": "d89957c0-11da-4d5b-bc94-2766f3605715", "value": "12288:PPVWKVLaMwi3BYEmV5Elrlzw9jsu+KwzAVmjnC26zJjpXbNRz:Ps4LaMdMWw9jH+OmjCzJjpXbLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621269375, "uuid": "2a0e035b-6ba6-4448-b467-93cb4258a7ea", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621269375, "uuid": "544a0005-ec7d-4563-bc3b-390533d297d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621269375, "uuid": "e099e60e-dae4-4df8-90bd-a80afa5bf171", "value": "37af093677d53ea9a210a36b3b766731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef63660-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260167, "uuid": "2b3d9566-06fb-4eda-97ed-317124e68718", "comment": "Malware payload", "value": "6d908419841aa8ef60fa6acf2ec98192", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260167, "uuid": "bcb6fa9a-ae16-45ad-aa64-05eed0432e97", "comment": "Malware payload", "value": "03a5d43cf534c391e4dda6ee4ce297573cf7c1a407a4311cb680a25b113a5a6a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260167, "uuid": "50d083ca-4f0e-405a-8afb-3c50621aa674", "comment": "Malware payload", "value": "c970a265cf25aba0f6505cc4e9958bf96398fca4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260167, "uuid": "84a05c95-f6d0-4b89-af36-57b47223e2b5", "comment": "Malware payload", "value": "29774f38d7f45d4d9d99bebce638e665c131d54026c4044d36158afce303a4b6e9f0ef02068e67755596aac484256ef4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260167, "uuid": "1d2b4317-e694-4d07-8fdc-73af00050886", "value": "C433F1354BECDAF629B6E0AFC8C6F604FBB1D455C4D3862649F8B2C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260167, "uuid": "03a866bc-35cf-4b39-9e4d-b72717620e69", "value": "1536:cjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXT2:kB9wzbqtWb08UscYJhnpjyq9qBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260167, "uuid": "a95f0ff7-b98c-495c-83f4-bdd8ba6ee624", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260167, "uuid": "a28cf4fa-47fb-4fe4-840e-5c91f4a4137d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260167, "uuid": "370b1462-e12c-46ae-8d73-1bd4a861be9b", "value": "diagram-160825858.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776ed184-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258839, "uuid": "0abca772-44da-4223-b875-68a83e156569", "comment": "Malware payload", "value": "0cddde12d0a726934d5554b2fc9f9651", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258839, "uuid": "583af6ae-af21-4cb0-be3a-b1b02ad19106", "comment": "Malware payload", "value": "03a759f8baa22045e9874a0863e2a5cedccd52f6e452088c42cb3bfd95f98fad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258839, "uuid": "bd066895-919b-4e1b-a20f-3bb684a7a928", "comment": "Malware payload", "value": "843e8190668d166d15dde3a9bc5889a95e80247b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258839, "uuid": "27f15fe4-d5bf-4c40-81f0-96c66ac09822", "comment": "Malware payload", "value": "9e5f67da05b331625c5f29802256206e858f16f0f6900210e980c395d5ccd5fe670e1cd178e8a3022002a94064d0e457", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258839, "uuid": "a18ce18a-287f-411d-b1f2-2e9a91630e98", "value": "10330286D264214DCF4FD29630F1FACCE5DE7E430DA9A4D0A63D2B45C1931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258839, "uuid": "290879ef-67fa-4020-a04e-d6f1c9b5893e", "value": "1536:j2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3s:ifqhp+g5ru2kmUEt88Ixs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258839, "uuid": "60facdda-f318-4527-a769-88385036f91a", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258839, "uuid": "ce7928a7-ac53-4f07-8694-aaf5f69c1b37", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258839, "uuid": "9be09b17-633a-4e82-bb0a-e743fdadb5c9", "value": "catalog-610461083.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bb8573-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257626, "uuid": "8e15505a-0113-4ac5-b9e9-eb66a7002a1b", "comment": "Malware payload", "value": "6240c5e4fc2b2e4d4a24998fbb6cb4e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257626, "uuid": "30431bcf-12e9-4271-8b6b-79fbfe57386c", "comment": "Malware payload", "value": "03ba307c58bb6c9e762d90b6945c02cb97d9134b1047d0aa077cd3ec2662a959", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257626, "uuid": "a951b212-104c-4119-8530-cf45187ef8a4", "comment": "Malware payload", "value": "53be8d2c23ce98cfec53087f0b2e30fdc4d8e8f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257626, "uuid": "c1d98976-ac13-435b-9a62-9bf18296d6db", "comment": "Malware payload", "value": "a74b5d9aff0707ccd860b9bdac9dd76eb529b74e8691267181bc18c5d882ff7b2f774c3d54c972304db0da64ad59b806", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257626, "uuid": "174ce33d-65e8-4f87-9736-64a3f03ffa1f", "value": "6F33F2469218128CCE4BE2EB30F6FAD8E6DD6A430EA9B0D09B7D2745C5630F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257626, "uuid": "37f307ff-d848-4b75-bc26-1688e993f99e", "value": "1536:e2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAu6Sj:jfqhp+g5ru2kmUEt88ANQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257626, "uuid": "a9a7d562-cb4e-4203-b269-65769c44e441", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257626, "uuid": "06d4a755-eef4-4597-bebf-d91010a07a53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257626, "uuid": "712ab900-7351-4141-a65b-17f2f3337b6a", "value": "catalog-1740652154.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1563ac-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262819, "uuid": "672f3348-e1ec-4151-a803-6f7cc4f72b56", "comment": "Malware payload", "value": "2d146563bff3cb26856e7938f1cfd82f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262819, "uuid": "72a34f7c-6bfb-474c-ba8d-4309db9ebd1f", "comment": "Malware payload", "value": "03d23b8bd03bb642bb54a4268fdeea3ef3cece44393b7be0fc79a515a78c4f08", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262819, "uuid": "1ba10fd1-b7bf-4932-b37d-2ad52f36dcf7", "comment": "Malware payload", "value": "0318a80c7713df22e3526517b91c497bf4c57eea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262819, "uuid": "5fa6f6ce-8126-411e-b669-4a7552766780", "comment": "Malware payload", "value": "7460b9da3aff4b050ed5db8cfa8eef5b3781564a3764959b275d7ea92d668d1c16030039a6ddadb8cd5bc0ae083fd512", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262819, "uuid": "c0dd2936-4338-4fa3-93a9-7d425bf262b8", "value": "E63302E49507E0479748BC2DEC5B9D038F3CE91E033E78D2126BC0975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262819, "uuid": "9c2ed353-f73d-4669-b4a1-fa437879daef", "value": "1536:pXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZQ:9Xma7774mfCyWMB/4GpWvZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262819, "uuid": "5cac1f5f-2af9-46b4-9e94-120418c49d99", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262819, "uuid": "85e4df7e-4c95-4e3c-a0a0-87f7cb2ab8f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262819, "uuid": "8e138901-7a90-4770-8133-27155c443962", "value": "statistic-1436283850.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180ac7cc-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259538, "uuid": "431ed772-1ea3-41d0-8f15-d5b648533249", "comment": "Malware payload", "value": "2283251c760cf00d227b1c0dad7e828c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259538, "uuid": "6e41e61c-ba85-4346-a743-481865dbd399", "comment": "Malware payload", "value": "03e8ccd6f443465e8391d02360d9d3d04433f20349a598e10cd9e5bc967bf456", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259538, "uuid": "0bbb938e-2c5f-4b53-b632-9262478eebcf", "comment": "Malware payload", "value": "7c331ef95e870a52baf7da0340e364ecbe271865", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259538, "uuid": "ac6db991-2dd2-433f-bfea-219c84699169", "comment": "Malware payload", "value": "75aa72fc9cb4e2e12256d9a1a04303e27e574402f1eb3dd57bd287166152ac01c3ab3b3bf2a309f919fa9053b896058c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259538, "uuid": "11584dbd-6394-4c8b-98d3-adb263aca879", "value": "0933F1711BACDAE66DB1D47FC486FA04FFF1C8A5D49A861285F8B0C8B6D12518E72E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259538, "uuid": "99f69e6f-69a7-45ce-aa3b-356b1f6b5d34", "value": "1536:qjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67t0H:6B9wzbqtWb08UscYJhnpjyq9qaw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259538, "uuid": "ab62c3fa-e8de-4476-a494-f0c7574939bc", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259538, "uuid": "67490228-7eea-4dff-8f31-06754481a17e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259538, "uuid": "670aea3e-3905-4b87-bb0d-9d868658019d", "value": "diagram-1124974652.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afe65b9-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257100, "uuid": "98a1a300-f579-454f-9011-f0695d71448a", "comment": "Malware payload", "value": "68338c804d8168c8e58df57ebafe4ffa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257100, "uuid": "a9b50372-8666-4e15-90e0-b492ba1db08d", "comment": "Malware payload", "value": "03e9fa06c5d7202dd724f9b4af2d30682bb0776d760a689225df6a5748bcff0e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257100, "uuid": "ed487787-e921-46c0-a76e-049669b6a738", "comment": "Malware payload", "value": "8dd06a7609b7def4e80bf30bd62d6e528d1b9579", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257100, "uuid": "e41aa8df-1d3c-4c39-b71e-b76627da37f4", "comment": "Malware payload", "value": "d4550d8a2f9f1c04b5f602a610c119b838f4752e56b444ebb3614b4b56fab88f25ed8016cfa70ac0e5c783f4889237bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257100, "uuid": "1f00cf9c-ac8b-413c-96c9-d0dc7c4d63c6", "value": "6233F196E658018DCF8EE2AB30F1E9D8E6CE7E53099974D0ABAE5B4091530F0582E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257100, "uuid": "201c764b-243b-493f-88a2-9589a4dbe383", "value": "1536:F2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jILf:gfqhp+g5ru2kmUEt88Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257100, "uuid": "68b947dd-4004-4198-8a8e-5e3dcf181ef6", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257100, "uuid": "1be0d03a-b630-4c7c-9f55-b3487da15aac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257100, "uuid": "1e5836ac-97fa-45e0-a705-1838e77988f8", "value": "catalog-1359240625.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc726e1e-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263679, "uuid": "c7e3dd47-6ecc-4423-bba0-c0249ecdd0e8", "comment": "Malware payload", "value": "c3e587f46fbaf9c9c45e7919e51dc6bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263679, "uuid": "94717903-e941-4940-a74d-45fcc305d04e", "comment": "Malware payload", "value": "03f0d588483e862b57739e5a0c7a087ff3c4ea466e12a6da2442f19bc82a2ec1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263679, "uuid": "1bdd5c06-5711-4a03-a51b-39f4d8ae77d5", "comment": "Malware payload", "value": "8fa9bf12f39d4701341d3e5dc8a0e120d0115f22", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263679, "uuid": "5e15df22-cad8-47ae-a313-21c51af8de0e", "comment": "Malware payload", "value": "3ffdb5add6e7e928d0ec613fbb5fa3c989005d934d466bf4a08b1c647dd5d895842970730851069633e3b8678a354569", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263679, "uuid": "0af586ac-22ab-48d3-babe-9790c0101435", "value": "A333F1E09902E08E9755BC58DCAB9D478F3AC91E027D3883017BD0475EA1AB5E749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263679, "uuid": "1ade9e69-b6d7-4c15-9979-5fe093d7d3fb", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1Gpp4l:cXma7774mfCyWMB/4Gpp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263679, "uuid": "174cb454-ed12-484e-a186-628842b7b4e4", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263679, "uuid": "ba91fe2b-5a70-4f2a-a2fe-416bf5248b16", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263679, "uuid": "987065d1-1d2b-4e14-9757-5a07e4039ff8", "value": "statistic-210277875.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c48499-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261170, "uuid": "38c06172-cdee-4481-950e-faace004909d", "comment": "Malware payload", "value": "8929d0c178011b101d22c0d4b9317269", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261170, "uuid": "9030f395-49a5-40fe-ad9f-feffa1d71965", "comment": "Malware payload", "value": "03f894e85c252231de73f3eb26f6ea954404d5bb7970088ecd21e969ba12c6ad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261170, "uuid": "1cf218e9-0d5f-4e99-9157-bc364983cb82", "comment": "Malware payload", "value": "d9278bc6f179f1e5703325a36c312b4a6d56f4b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261170, "uuid": "facbe2a3-689b-4d55-b3a8-319eadf36179", "comment": "Malware payload", "value": "99f7535945a019774ffe24fe65d1043d506e87e7b12aed00dd5c01b03503ff0cb27ed701be02f2a1029051484adb6ef9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261170, "uuid": "82fc8f96-9f19-49ab-9f40-4f8c12da8a20", "value": "EF33F17187ACD9E668B2E4BFD8C6F904FFB1D459C4D78A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261170, "uuid": "c2433391-28a5-4e30-a282-c50bb8da59cc", "value": "1536:PjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXUW:rB9wzbqtWb08UscYJhnpjyq9qBUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261170, "uuid": "f2323d93-b2bc-467b-af99-5d60a9b8c89a", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261170, "uuid": "c198f1c3-beb2-4874-9d4f-89d99c7c1f54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261170, "uuid": "fc057425-6a52-4d71-94c4-7c2510e9d53a", "value": "diagram-36362329.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9b23f1-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257077, "uuid": "039cbb28-261f-4f84-aba3-f0bdfa5e1606", "comment": "Malware payload", "value": "eb8f41c2d24d6d30f98536ff13ea4915", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257077, "uuid": "0e81b4d5-99df-47ee-b406-e6f9a6a67c31", "comment": "Malware payload", "value": "0404da60f684f7a45d8607137d57fa1cde3a67b8e628cd7913a54b0160c522da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257077, "uuid": "0e36130f-07c7-4c60-9150-cab007b3c950", "comment": "Malware payload", "value": "0bc658629116cd95e6f1b6660230e1c001399b12", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257077, "uuid": "57967129-61d8-4863-9b2c-8c95635d3a29", "comment": "Malware payload", "value": "2292573b8168675d9f73e74c7707e07c0f4b9614bf5a6863b051176ca76907d7d4b621297655e2c3fc15cade759ee239", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257077, "uuid": "3ced5a9d-a81f-4869-9f19-26809004a4d0", "value": "2F33F184D164108DCF4FD2EB70F2FAECE59EBF43099A68C09B6E2644E2520E54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257077, "uuid": "f987fe74-816f-498c-8603-b6ef82c2a0c5", "value": "1536:p2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbGT:0fqhp+g5ru2kmUEt88mAbGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257077, "uuid": "8563368a-5f9b-4956-9ec6-033e41c27861", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257077, "uuid": "732a1839-1c44-4c5d-9d56-4ffc3052a876", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257077, "uuid": "dd022b31-83e9-4f72-a8ac-f42ef0c3ebf1", "value": "catalog-1342035997.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cae5e81-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263975, "uuid": "3f087847-c62b-4d91-8408-142f4661a3b7", "comment": "Malware payload", "value": "056c3035decd9229d339b808aba5c0eb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263975, "uuid": "8720b14b-142c-472c-afa2-4bb2c9249401", "comment": "Malware payload", "value": "041994b979d84f3289b9870016ea7211cc1fe069744d175239e14b61e4d49439", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263975, "uuid": "e570cdfb-9d09-4d68-acd8-64b4d9f76c1e", "comment": "Malware payload", "value": "bf9aa2218965ac17eed425a206c96677dc45a7dd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263975, "uuid": "dae3780c-6e85-4138-a157-3501f0e93717", "comment": "Malware payload", "value": "6c5f00d4e122c84acb455c7af69e090953979b364f3ac84f8bb861ee409fc4abc84b215f13bddf56261afb607c33c842", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263975, "uuid": "61fa322a-39a7-4eaf-a398-19d322a99d40", "value": "9133F2E4A507E047A749B81CEC6A5D038F3DED1E433E78D2022BC1D75E61AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263975, "uuid": "99a8ea77-3798-46c4-b5b8-89b2d81f7fef", "value": "1536:vXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZYeU:PXma7774mfCyWMB/4GpWvZYeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263975, "uuid": "0a0cc8f3-dfa6-4c7e-bb03-941ae8a033fe", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263975, "uuid": "5086b96c-3819-46b9-8e5b-5eac955760e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263975, "uuid": "faf7cb27-dc6d-4d77-8771-baef9153936b", "value": "statistic-395947148.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8df36e-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256644, "uuid": "6a28fd6b-861b-446b-8bb5-5f5561516df2", "comment": "Malware payload", "value": "2f290158b7f93f373a26a1f398bc68aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256644, "uuid": "217dc75f-4004-4502-9dc9-46cf277fe56d", "comment": "Malware payload", "value": "04509c68d5369053508b1743fb1daad31719591d74527936ec8ca3b194b9e17f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256644, "uuid": "f0f924ab-cfa0-4d76-ad62-c766260f2d30", "comment": "Malware payload", "value": "4ca01b584c71f1f36068ecf4ea5f19265b006268", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256644, "uuid": "32eb5350-8890-47cf-8cfa-b49f087dab4a", "comment": "Malware payload", "value": "f8119b920f4ae58b5300fa866e6207c50efa3e288967aa944a2236edfffe4bf18db7f0bbcd2905885a34c9343e0a1c8d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256644, "uuid": "ed26d7f3-020d-4dba-bfc4-d0c34e02514d", "value": "0633F141A658028DCE4BE29B70F5F9DCE1EE7E530DAA78D0972D2B0191531F1482FA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256644, "uuid": "7d862631-0ccc-4beb-b8cf-603bdf4e0759", "value": "1536:z2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxc:Sfqhp+g5ru2kmUEt88xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256644, "uuid": "741978ce-5305-4ff4-a4d8-7c760e6aafd7", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256644, "uuid": "8a51e1aa-9a8c-47e5-803c-4b3d9568bc10", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256644, "uuid": "cb190b2b-5ce1-4767-974c-f7100974180d", "value": "catalog-100208465.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc126ab-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260356, "uuid": "b877fefa-bddc-4574-b829-1f714eefbcf4", "comment": "Malware payload", "value": "8f668b3e866e973fd2f36e2c950874e9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260356, "uuid": "7ce280c8-8cdf-4bc1-b74d-89afed029e85", "comment": "Malware payload", "value": "0450cfa203cee42f91bab25c7a6f1d0abed0531bdcc8736f35827bd6ef8f81fb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260356, "uuid": "16ea1347-d9f5-4cde-bc72-1ca17b4bdf8a", "comment": "Malware payload", "value": "313336fab0630e8c89c5654598fff33bfd0cac70", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260356, "uuid": "76472d37-c45b-4cbd-966b-ed5b8cdcebe1", "comment": "Malware payload", "value": "e6a6af660c6f9872704c5cd8ef76734d6ba68b97a280ba88dce3d5c0586c1ea090c0ced8af374c0545121d1d97a6ab29", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260356, "uuid": "e68e9c52-876d-4e48-b6ed-e8b0aeeeedb3", "value": "6A33F17147DCCAA76C72E1BFC4C6F845BFF28861C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260356, "uuid": "bb18c7ef-43d8-470f-9d96-988d736b91f7", "value": "1536:mjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w8:+B9wzbqtWb08UscYJhnpjyq9qEK0w8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260356, "uuid": "be6b2217-c565-4f1f-93bc-bc91398cd43a", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260356, "uuid": "1d4b6fd2-8de0-45ed-aa23-90e91a0a200d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260356, "uuid": "845d5335-30bc-43cc-b748-977b550e5430", "value": "diagram-1719350424.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ddb288-b6f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621244582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244582, "uuid": "7530bfb2-fe1c-4134-b5d4-a3c2c746bdd4", "comment": "Malware payload", "value": "68a915542ff891066e68d061999e35d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244582, "uuid": "008b0c0b-14a3-41c9-8859-9827289d019f", "comment": "Malware payload", "value": "0457a7590c68be5dec1b3258738a416c3a5c3c0aeb16dc57896db8c8eee84309", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244582, "uuid": "b2b54a08-596c-40d7-9b60-f59aeacb31e2", "comment": "Malware payload", "value": "be2b8944f88d1d6566aa98ef9d6d23d7e46857c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244582, "uuid": "ab28f334-4941-48b1-b930-52c9401b988a", "comment": "Malware payload", "value": "59cd8fbe4fa2db6218659dbd174f7f9830f225ca3dd77d31180bc70de4241768324afa3c250e25aee06aec26625401b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621244582, "uuid": "e8ade4e5-b5a0-4a87-a50a-1fd581b9c11a", "value": "10F02B8364D491BA4A42114A9674D44DEFF9579FA1C0860DFDCC41611F17FCA9EA3294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621244582, "uuid": "4449308e-3a3d-4105-9568-d00b9d49b418", "value": "12:TMHdIrMx+uzd/OdLnx04JodSh8Uu+g/umdbboB:2dmMRdOdLnx0uzgB/umRoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621244582, "uuid": "4439077f-b73b-40dc-b157-3df6e106a005", "value": 599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621244582, "uuid": "1098a227-580e-4e75-a30d-6b9dc4c34c58", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621244582, "uuid": "7abc4b1a-154e-4b3d-863b-b0a669a15725", "value": "dhl-tracking.jnlp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2743c8-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1621263568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263568, "uuid": "9264504a-fd5c-4d43-acd5-07ca75ad085b", "comment": "Malware payload (SilentBuilder)", "value": "3e2d0f103c151ee256a2b6c99ee4c6b6", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263568, "uuid": "df0fe574-4bbf-4e7d-a752-f3528d358b2c", "comment": "Malware payload (SilentBuilder)", "value": "045d9b5378521f3a19148aac9862e013f4398b47101be63960b591526eb4f7f7", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263568, "uuid": "d23a1607-030d-482a-adca-234d408e07e5", "comment": "Malware payload (SilentBuilder)", "value": "b3c874d0a590b3accb7039e8548c82b67f851b10", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263568, "uuid": "d2e9a158-df09-4527-9ba1-b4604b5ea94f", "comment": "Malware payload (SilentBuilder)", "value": "a808fd84b4439d3305bb59471cff60b0b3cca31717eb51b82946d6d221d10c21890bf9da512c31836c6e3a4c1c71d8e4", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263568, "uuid": "bc3d2498-2a1b-4471-9252-750c4a781a48", "value": "D5846385751688BAE7164F33B0EE8DE85BB3ED50860F8A873E4AF30C9F74340A953556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263568, "uuid": "ce8631db-8258-4b3a-afc8-a42eb110fa38", "value": "6144:IcPiNQApW/89bK103eGvgZqr3h8GB3cAt6Uqa5DPdG9uS9QLn4z8yKd:6t6Uqa5DPdG9uS9QLn4z8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263568, "uuid": "32f438f4-e50f-4b3c-8d59-67694ee1127f", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263568, "uuid": "bd3fd340-a38f-491c-8fee-603b07d7e1be", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263568, "uuid": "fa16190a-a74e-41fa-a491-90652c9fe586", "value": "statistic-94636249.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71766d68-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257540, "uuid": "fc546a68-415f-43d1-a84e-91417fc66f6c", "comment": "Malware payload", "value": "0ae9e967b6046bf2cf0862c9b2e2d37a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257540, "uuid": "d1455865-f917-448e-b0f1-e21ec76ee9ad", "comment": "Malware payload", "value": "0484e0d7d4705783b4392c683ee04e68896a6738b6e64f11fa10c1d5da2ce349", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257540, "uuid": "68031319-2b69-4e3d-afcc-a1585e2d19e9", "comment": "Malware payload", "value": "f40d718845da1fc764ee2c9c95771db0e1f31d72", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257540, "uuid": "b56b91f0-b963-495f-988d-c783badc46bb", "comment": "Malware payload", "value": "8f66cfe9197fb1e9ce4a9f4049ff54bffd1a4d0a06dd45c7f9bc6cf19bf50d2765f810233ffdce6d408f87232d36398b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257540, "uuid": "158623fe-9e2b-4f45-9633-3ae74b74e567", "value": "1633F141EA58028DCE4BE69B70F5F9DCE1EE7E530D9A78C0962D2B4191530F1482BA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257540, "uuid": "60401551-98ff-48db-94ff-5a75d34a5611", "value": "1536:E2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxi:1fqhp+g5ru2kmUEt88xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257540, "uuid": "6f722c42-e4c2-4891-b1af-9984c5565ddd", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257540, "uuid": "a126347f-caf4-414e-9c3c-8674ed022480", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257540, "uuid": "28d6526a-dcd2-4dd4-84d2-44714d3bec7d", "value": "catalog-1667244215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f33e104-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260543, "uuid": "7fe25ae3-7c74-4081-9c1c-e84cd6fec3c5", "comment": "Malware payload", "value": "515b4c1c2e4f8c376f5c230cc7055942", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260543, "uuid": "10827746-21e2-4913-b9f7-838a6f89e969", "comment": "Malware payload", "value": "0487b602ad4ff45ee278d8b854e70c2577211d41653c84f4448cffc6c85bdef4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260543, "uuid": "4c7e556f-1d44-4722-8d0c-98c27f33cd50", "comment": "Malware payload", "value": "5ab5a0e1d78f24fee61f862412a35799ee70e40b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260543, "uuid": "633dbe15-31c0-494c-bd2d-cedb29e5d63b", "comment": "Malware payload", "value": "80495eae3606538084645d241cba0c5c2d4e2b968f08fafa093d51a7420b5772a2de2b3f754ce71c1320b73b53f98f9b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260543, "uuid": "5380c591-b533-4b67-9f1e-4e9faa6d445f", "value": "1333F17547ECCAA76C32E1BFC4C6F845BFF29421C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260543, "uuid": "94777e68-ae67-439b-bd97-bfb44b0d55df", "value": "1536:XjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w6:zB9wzbqtWb08UscYJhnpjyq9qEK0w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260543, "uuid": "8df24c4a-6de2-4050-bf54-1319ca747709", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260543, "uuid": "c2d34b11-250d-415f-8bf3-2f9bae18ebca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260543, "uuid": "6a9830a1-8e45-415d-a0fb-d27cac51875e", "value": "diagram-1864765949.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f7db8b-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257286, "uuid": "7af0396d-1c4b-49ef-92db-047b9b092e7e", "comment": "Malware payload", "value": "be88b7a041bae1174253ca34c1f88ba1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257286, "uuid": "eab4546e-1737-4933-b60f-026a3694acfe", "comment": "Malware payload", "value": "048dbb83a118606960bd51c493b844eca86db1571cf872b41d8e0e0948e4cd6c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257286, "uuid": "4f7df772-4052-459f-96a9-45c75b7207ec", "comment": "Malware payload", "value": "7432261ddef83d3c95b28e98a92542b1fafe0b3d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257286, "uuid": "933d344f-79b6-44af-bc97-836fe236c2d7", "comment": "Malware payload", "value": "0aa4e55d97dbdc53a5ac3ca7782e9b0a8f1bba7e27502df6b8323b2cd7723ef18fa98b923162800e4113800518ebb6ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257286, "uuid": "cf3ca9e3-0859-4462-af92-1d38c0d41db5", "value": "A733F191925512CDCF8ED2EE30F2FADCE29EAE130D9DA4D09B6E674081531F5482B58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257286, "uuid": "db83b8d5-43d6-4695-aa87-e7e82b1786ab", "value": "1536:t2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIjShU:Ifqhp+g5ru2kmUEt88jShU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257286, "uuid": "8d691d85-514c-4a60-bba9-3ca001445404", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257286, "uuid": "a6c6b10c-4492-4f0c-9ad2-cac306eaeb6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257286, "uuid": "e412f9b9-2cd3-414b-bdda-40c976dc19ac", "value": "catalog-1468334466.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e717e6a2-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257308, "uuid": "faf4a976-1318-41c3-9734-4e213714dfff", "comment": "Malware payload", "value": "e7634b3cae0314291c4567763adde807", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257308, "uuid": "2409ac08-4d48-4262-a2a8-a7ab89ba5890", "comment": "Malware payload", "value": "04966b405d189aca3a744fb410cf597301d05f4080d2e18fdb48cf04d63ab8b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257308, "uuid": "7030bd44-3a7e-4c21-8b6c-fbf9ecdc0a04", "comment": "Malware payload", "value": "f45ea631f5acd84a7ab6fdf64135df23f52eb72b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257308, "uuid": "cd1d82c9-f0f3-45ae-aa48-7ea0d248be7c", "comment": "Malware payload", "value": "fdc115d2be745d90ffdb21c8871a3a41eb5dd5ef5a7f08e8b1e59faa7cd1c732356eb83af935e5cea4c4c0f6db08f414", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257308, "uuid": "c2815bcf-26a7-4f69-bab9-195ae0f4341a", "value": "B333F251D644018DCE4BD3EB30B6F9DCE69EAE034A9D78D09A7D1B0490938F0892F18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257308, "uuid": "bc3ab434-77ce-46c8-b77b-7a07a01e2b77", "value": "1536:C2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jId4Ry:Hfqhp+g5ru2kmUEt88Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257308, "uuid": "158ec2db-5b2a-4b54-bf54-1492ebf7ad8d", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257308, "uuid": "95978c11-60ee-4227-b2c6-c7fb6546dd80", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257308, "uuid": "ac4cf747-fbe9-42df-9f58-6348f9d6261d", "value": "catalog-1484155936.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f784e9-b728-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621267190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621267190, "uuid": "5260b962-9f1d-4446-90f9-7cf349e0e7d4", "comment": "Malware payload (Dridex)", "value": "d849f43a0c22961b890b6843d7bac8f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621267190, "uuid": "b2cb7922-a916-43a6-974a-7c94c626108f", "comment": "Malware payload (Dridex)", "value": "04a4eed28f144b5784f9207707ae04ac59761958ad57263c7ea2692750e5d89e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621267190, "uuid": "94fc5397-a6f4-41a8-9718-75e9efb8218b", "comment": "Malware payload (Dridex)", "value": "36a56ae181cd7706cff33495dea060a9eed582e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621267190, "uuid": "58766e47-2882-45de-8c2b-21adb8effa3e", "comment": "Malware payload (Dridex)", "value": "c955ca359a6fac3f2e1c85475dd8d78f5703127affacfad3fd25274fd8be8fce4c0efbb1bdd263fc3ca2c3e3c85de7f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621267190, "uuid": "736566ce-97a4-4e28-81a4-738c62d204ba", "value": "7604D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621267190, "uuid": "0467dee9-4182-410e-afdb-f23c8644af6d", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621267190, "uuid": "66453f25-95fb-4db8-a2b7-f5e1cda0c5c8", "value": "3072:XqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:hVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621267190, "uuid": "ec6a56c3-7b40-4751-b1bc-f2e6e65e1f76", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621267190, "uuid": "d1c27ca2-19fa-46a2-8460-5e47fa13d5d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621267190, "uuid": "2170de8d-c2bb-4eb7-b131-bd8a689046e2", "value": "vx6dGnJxS.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ec9c5d-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261297, "uuid": "cd56ac32-0a28-4dc4-b462-44bff873de44", "comment": "Malware payload", "value": "d5c5bfc97104445f92996f0d71aa3a01", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261297, "uuid": "057f4340-9629-444e-802f-ec12abcb0224", "comment": "Malware payload", "value": "04b7a688c84502bbcc59f4b6944b13ed76fc1aab8878b7ede4b294e4febc7c65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261297, "uuid": "e220960e-9d9d-4a8b-be5e-91e8304c394a", "comment": "Malware payload", "value": "6399fba75b5c817db8b26c262ac7de1f6e5dab1f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261297, "uuid": "e500cdb7-508f-4ebd-8a72-f2307b6fc862", "comment": "Malware payload", "value": "9eedae1f6c7a59ca71cca5ae41f07de93315616e3bedd6b8382aac259df31b07dc685e89fbeae1114208818e03060308", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261297, "uuid": "f52bbb86-b41f-4195-921d-57d245fcaa60", "value": "AC33F17147DCCAA76C72E0BFC4C6F845BFF29821C997872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261297, "uuid": "5665ed84-15c1-481a-96bc-bb74defc9e14", "value": "1536:KjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wc:aB9wzbqtWb08UscYJhnpjyq9qEK0wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261297, "uuid": "8d025d15-d805-4ea7-9a9c-9eb6058a0b89", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261297, "uuid": "00a3182c-2781-42f6-9700-fa8ad3e23ee6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261297, "uuid": "1021a10f-ee25-49e7-a17d-c8b85c8f307c", "value": "diagram-449563875.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53193144-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260066, "uuid": "4be80064-feab-4d0b-bbd2-e03721ab4209", "comment": "Malware payload", "value": "7021d18a9c577dbc2684ee4036858809", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260066, "uuid": "0fb51556-fe7b-4e59-aa19-e149495c3505", "comment": "Malware payload", "value": "04df516684f4d25b99fbce4d19bc7dc9ec112e0b89f7403ad30dfff967c93b55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260066, "uuid": "de336f16-3bca-462d-88ba-3a5b19759e89", "comment": "Malware payload", "value": "dc3c410b371f2dab9b7fdc50435c0004d6b2614d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260066, "uuid": "2024aa8e-12db-46e5-a706-84d332152c17", "comment": "Malware payload", "value": "173d8f5e383986bd29eb1bfce0a81d440ed8155a60a06ac070a68bafcdba18460041d1d5d49a9d1e5d4d42b6c33ad0cd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260066, "uuid": "9315b6f3-aff7-4172-bf34-a9ddeaa71e63", "value": "6C33F1354BACD5F62976D0BFC8C6F604FBB194A5C4D7862249F8B1C8B6D02855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260066, "uuid": "06fd169b-7ba0-4a71-97c7-ab61f68bee76", "value": "1536:kjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXj4E:MB9wzbqtWb08UscYJhnpjyq9qBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260066, "uuid": "fd8781a5-cdd6-410a-9d5f-25c8795efe8b", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260066, "uuid": "d98280a6-34eb-4dcc-9edb-c16ee71424fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260066, "uuid": "c91c2e3f-0edc-4f41-ae2f-3d4b92ebe9d1", "value": "diagram-1552750379.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae36df49-b6ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621249482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249482, "uuid": "3a8817e5-a6e1-4770-bccf-7af2c66de57a", "comment": "Malware payload (Dridex)", "value": "f6d454efe3072585b637f3443f626588", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249482, "uuid": "e80189d6-49d3-4be9-bf28-cbb2a07cd24f", "comment": "Malware payload (Dridex)", "value": "050540091140093cb1a63c3b4dcc0cd25caf29f7e5922e9fc04a15158fb26c92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249482, "uuid": "0e441425-971e-41c3-b911-955c3d0d3134", "comment": "Malware payload (Dridex)", "value": "30f1330b3deddbb220f1a5e1e6ae68640c2950ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249482, "uuid": "5da66851-2ab1-49ca-b2cb-e96ab4a8956a", "comment": "Malware payload (Dridex)", "value": "d3a9fbcf9b22ae5f696f7055db108ed61a64c08a8941453450d379c9de5e7f8c9c119aacf8fa3be0e981bedf71b293e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249482, "uuid": "5351df0f-bc23-46e6-9ac3-5b5241ac9aef", "value": "F915DF303293C139D1725836CE46EAFD1611BC05DF2E198736E23F8FBA355A19E36255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249482, "uuid": "6d726cf4-ad14-44d9-bbf0-885871e88e33", "value": "da12150bad5f9068dde2dc0c7e127fab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249482, "uuid": "de503b17-beee-4fb8-8fe6-9e7aa5765b7d", "value": "12288:YTjo1UKnOwSOMjRZbubLKleVahHjlTBwHX5sdNl7tzbrQ/kYljKWsLhZCfyXTq2:+sOdO2RZKqmahBFhlFbBfWs1ZgyXTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621249482, "uuid": "d20b380e-b604-4f29-8892-397584eca024", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621249482, "uuid": "ebe3dd20-96ac-4cad-b7c2-368708387585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249482, "uuid": "90beb1ab-eaae-4f69-94db-5b08ddf31cd1", "value": "f6d454ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece0d19b-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621265049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265049, "uuid": "f7e80280-bb81-4dcd-b980-2068d706eec9", "comment": "Malware payload", "value": "781b514fef085551149cf01fa62aaf9e", "object_relation": "md5", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265049, "uuid": "3389fc5a-2897-44ee-8999-ea59e83ac0a5", "comment": "Malware payload", "value": "0519eb840fcd64b9ddabd6bb2a910d40fb333f49addb5e1b7f6cca91cf6f1d6d", "object_relation": "sha256", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265049, "uuid": "7ac59082-6749-4437-a612-278e36b13f08", "comment": "Malware payload", "value": "2e291aa719e6ff430f907340d9d78769e1a51400", "object_relation": "sha1", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265049, "uuid": "9f7ce2c8-1704-4558-bf3a-8d68c6b95c8a", "comment": "Malware payload", "value": "20a68206a3193b000d355ac5f9c78fa7312787cfc80458372a673fe8a8cfca2ce8e0cda21ac512adf28d7e4c9e6d1e03", "object_relation": "sha3-384", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265049, "uuid": "d4905980-2e99-4cc1-820b-b94ee22843c8", "value": "C9B523107881C8B3C9520A351AE0D671A6BD3B244B25BFFB53D8877A4FB52E39538772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265049, "uuid": "c61f00f6-bb61-4263-821f-982853159366", "value": "a071255499b70aeaca56c4604b5e4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265049, "uuid": "8158849d-91a2-48cc-861e-c00856a2c84d", "value": "49152:oI3/pzAlEStLpQIGyPlPanvF28Lu377T3ga7XVGHDfWI6zSrkr5kiSvX4:oI3s63yPQvF28yHsa7XAjfWpSYrC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621265049, "uuid": "f0a5ba1f-9840-4e57-be30-09e615de236c", "value": 2316336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621265049, "uuid": "562080ba-0b66-4f38-b898-dc2be0e3934e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265049, "uuid": "554cb2c5-1cb4-4c70-a1d1-dff6285d6627", "value": "0519eb840fcd64b9ddabd6bb2a910d40fb333f49addb5e1b7f6cca91cf6f1d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04d88f0-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261162, "uuid": "7e1ee651-ac28-4a97-a940-9ac4cd38c073", "comment": "Malware payload", "value": "ec7b2a5b3af1f8631ebe70bbcaeb956b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261162, "uuid": "9613fc77-ca41-40e3-876b-1049d022de55", "comment": "Malware payload", "value": "0522be4ec0bf88a2c595f1768fcfe94ef54c070b95e5760ddcccea1ae8f35016", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261162, "uuid": "c0877a27-dc57-4192-88b4-140ea7b7e5cb", "comment": "Malware payload", "value": "2211eb6d711cae65c5a21f206049624f1a8f2572", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261162, "uuid": "713d0e14-5bf2-42ab-822b-9607154049e2", "comment": "Malware payload", "value": "7432e12830a3f30db1f3a784f40dfc37053f1a6bf49700791bc88405f3512b1f3246cff3cb24cffe6bcc9a2444ec41cf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261162, "uuid": "4bbf02c4-715f-4b20-b88c-c9612bd50e81", "value": "E033F17147DCCAA76C72E1BFC4C6F845BFF28821C897872249F9B1C8B5A12564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261162, "uuid": "ad4dbf2b-5a0e-46bc-93ed-08b2cb8f544d", "value": "1536:SjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wv:iB9wzbqtWb08UscYJhnpjyq9qEK0wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261162, "uuid": "b1818e7c-5a2c-41d0-9c01-dda24a7b4c82", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261162, "uuid": "02bc9b1f-2889-4e38-a75e-c68aa54077bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261162, "uuid": "23f89952-fd22-48d0-9ba8-4f148d0262e6", "value": "diagram-354604775.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad0d95e-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263032, "uuid": "547bed13-a3bd-480c-abc6-64f07a392b49", "comment": "Malware payload", "value": "6b7829a934deefa796ce4f3d2c4ca16a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263032, "uuid": "0cfc2d6c-ff41-4912-bb51-755bdc45aa2a", "comment": "Malware payload", "value": "052c3e198048a47ba22d1449539b0e0ba6b8d634f3292f78d29c1ed77c6a16fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263032, "uuid": "c5618d28-f832-403b-b98d-efeab7d08e32", "comment": "Malware payload", "value": "44b012633853308d0e70a84e8601ec2d50f94312", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263032, "uuid": "1d406244-b82f-4ac7-ac9b-703f5b6d11c0", "comment": "Malware payload", "value": "e86e21dbf4cc0ca1ad33a5939a50dfe7e18dfd439fdba303d13d3e62639a2b30d0af1af96d641bfa3f61d3de4f746e94", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263032, "uuid": "461a32cc-5c10-4dcf-9913-3730b9a216ef", "value": "C333F1E0E402F0479349B84CECAF9D428B7DDA5E433DA893453EC0875E72AB5A749D28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263032, "uuid": "a8937ace-bc17-4329-b3f7-099eaddeede3", "value": "1536:LXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIE9T:TXma7774mfCyWMB/4GpV5dE9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263032, "uuid": "bd1ca2b5-2837-410c-9dad-c3dd53c70208", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263032, "uuid": "e3dd77cc-6a1f-4241-95e4-c2c00dfff37f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263032, "uuid": "80256264-5bbb-4695-b436-fee5806a9f56", "value": "statistic-157452946.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057fbea2-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258218, "uuid": "518807dd-e79b-4720-a854-539047d93511", "comment": "Malware payload", "value": "23d52ce968858ac6697e9bd6a3cf9a8f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258218, "uuid": "113995fb-4718-4c19-8801-b7312b08b06d", "comment": "Malware payload", "value": "0545c2a1347eb5645b2376e4c869efb9b75b62b3c230dd0d25a7a200d3ed5dec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258218, "uuid": "139072fc-4189-4028-bb2f-0befa15ce049", "comment": "Malware payload", "value": "8e595ff4c4acd07325af73bb323028535a07a973", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258218, "uuid": "0c9b90fd-ffee-4190-b9e0-9cc74dcbd5d7", "comment": "Malware payload", "value": "cde84f97d0fc3aad362050b323daa7237461ab4d6570d29d39cc8ba1228dc4fac2653d57b48fa87fb7201e40b2ae2c90", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258218, "uuid": "7317e1cc-6b69-4373-a6dd-3ff32169f889", "value": "4533F2469214118CCE4BE2EB30F6FAD8E6DD6A430EA9B0D09B7D2745C1A31F1492F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258218, "uuid": "d9984f50-8214-4e12-8f84-05c5a633fd5e", "value": "1536:D2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuSSa:Cfqhp+g5ru2kmUEt88Ap/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258218, "uuid": "39a3135a-2071-42e1-8392-73edde57e968", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258218, "uuid": "a729f9e2-ffe9-48e3-b7b7-a608d63554e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258218, "uuid": "f6185ab4-3cc4-46d0-b67f-7ebbe7a9dfe7", "value": "catalog-252567754.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5cc061-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261157, "uuid": "1d7e204f-4214-477e-b4d5-5e303ea28ac3", "comment": "Malware payload", "value": "0b4f69b0c9b452f138a05abf41503ce1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261157, "uuid": "008fd035-821a-4204-9813-1079227aa127", "comment": "Malware payload", "value": "05531d600acb8ef300907cb2f001342db400224034653b5e4da3922b2294a743", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261157, "uuid": "5fd699f6-f5e7-4fd8-b1da-6dc00c781759", "comment": "Malware payload", "value": "5afe1ade90dd6375af62a2aba3e080bcddb16430", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261157, "uuid": "73f2b99a-09ac-4e16-a43a-840de22e99a5", "comment": "Malware payload", "value": "06131e1adb5f311fb28a4036e9e22b7e0b1a0d0c303375b428d88e3c7f70057cf749e4c81e1c7c7faed0c96d59e90923", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261157, "uuid": "b3ba50af-bcc6-41f4-b101-ec377f734009", "value": "7C33F1754BDCCAA76C72E0BFC4C6F845BFF29421C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261157, "uuid": "23e98d66-5c8c-4a4f-8e29-000721b5e6e8", "value": "1536:djfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wA:5B9wzbqtWb08UscYJhnpjyq9qEK0wA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261157, "uuid": "a3188466-74dc-4a7f-b291-392452cd68b8", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261157, "uuid": "1e645b24-d29d-4afd-a72b-b5e50c5e4a27", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261157, "uuid": "f778784f-0109-4378-a1f5-9014f7138148", "value": "diagram-352621131.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8f2d85-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256891, "uuid": "c3bed704-03f0-4051-9dd4-7eaf5f0f221d", "comment": "Malware payload", "value": "c89bea13de81352b45a0398cedbb2fa3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256891, "uuid": "69d7c85f-d680-47cc-afba-f9ca109370e3", "comment": "Malware payload", "value": "0573a3f3abbe74517dacb82f2097ded976423eac608d934a7f95132d5f1b65b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256891, "uuid": "efb44bf6-d9ae-4e6c-a8ef-07f93a83a45d", "comment": "Malware payload", "value": "dab9d1f10a9ffd02419ccb44750934d8bfba647f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256891, "uuid": "2ae21f08-34ce-4ca6-b9db-cef00c1679a4", "comment": "Malware payload", "value": "17c1192dc6912b4579c4b5ad5801e433e17011e9e8eb9352a53b9e1e8c5e792295e096694b50c1a5d572f587a6df603b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256891, "uuid": "88338321-852b-405f-aad4-485927826b88", "value": "F533F1A6E544018DCF4FD2DB20F6F9DCE59E7E530A68A4D09A7E2B4581930F1183E29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256891, "uuid": "87dd77d5-8e2d-49eb-959f-40be9ad2e379", "value": "1536:U2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIqdXfYy:lfqhp+g5ru2kmUEt88qdX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256891, "uuid": "d79b670c-d833-44a0-9b44-37c90e65e481", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256891, "uuid": "d8dc7acf-ac9c-407c-b464-d0b394b9efb4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256891, "uuid": "952c9d36-82d4-4b6d-8045-ece3aec2d96d", "value": "catalog-1172372194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30c5284-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262455, "uuid": "7546af59-b788-43c2-9202-093b8801af68", "comment": "Malware payload", "value": "b9dfbe41c678c8ad87772052bdd5deff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262455, "uuid": "047abf12-e6cf-42f1-8264-7f3b182612b7", "comment": "Malware payload", "value": "057a5b86758a720eb8b8e802dbf1ac46cf3df4ec19e7b5f67f8882a831b54092", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262455, "uuid": "2fb1a1e9-fe64-46fa-9505-264374537261", "comment": "Malware payload", "value": "b02b8f415703b48d117d39dbf8d4492d075fa6cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262455, "uuid": "0c827961-a412-4944-8517-325b5175e8ea", "comment": "Malware payload", "value": "f1fd88dab58ddea4b249871c1b13197462c76be1cc5ab9cbd5b4074d9f3a7b39eacaeae493c433474098e56dbae59590", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262455, "uuid": "dcd73582-3352-4a1c-b17b-8841f5d204ab", "value": "E133F2E0D801E086A755FC5CDCAB9D038F39DD59073DB852027EC0C79E72AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262455, "uuid": "d41a09b9-daa0-4a02-bab2-9260698193e4", "value": "1536:cXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOeA:YXma7774mfCyWMB/4GpCOeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262455, "uuid": "d44a1ab4-b437-4899-8bce-f92348ac36d0", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262455, "uuid": "d9a2ae0f-2770-4cce-b609-a7ba499f3e08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262455, "uuid": "90beb46f-e120-4ec2-a1bd-091c0e4821f0", "value": "statistic-118241370.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68205d4c-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259672, "uuid": "1c04ad95-b7a8-42ea-aab0-e7dd8b771b2d", "comment": "Malware payload", "value": "70222e09d2af39111c0b92e0ff5649e1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259672, "uuid": "523bdf54-8dfb-49c4-ae56-7f53754067ea", "comment": "Malware payload", "value": "0593b2109856d7346391d7edadb10a8d2568cdb20a20c036043388d4a35e8b9f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259672, "uuid": "c3df80ee-54f4-45f3-931a-4d6d7c3d896a", "comment": "Malware payload", "value": "f3aa2def45d77822483830ffaa8e14e3a9e1c166", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259672, "uuid": "e18656eb-09ad-4ebd-852d-8316de4a5aef", "comment": "Malware payload", "value": "aec4d592793815b5103eb34af9cac1e20a53c9804e914d37209eefbd6a9d205ec95dcce69d90f00f9355aaf0fceafc76", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259672, "uuid": "146cb48c-0e03-4f46-871b-bd993aff1dce", "value": "6E33F1314BFCD9A62CB2E4AFC8CBF504FAB1C095C4DB86664AF871C8B6942455E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259672, "uuid": "b85d7662-4dc6-4ce7-8a5c-b3c6885e2d22", "value": "1536:YjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXCZ:YB9wzbqtWb08UscYJhnpjyq9qBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259672, "uuid": "eb0b5758-c570-40c1-ab74-5f8688ff366a", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259672, "uuid": "4a878d98-bffa-4f38-9fbc-fb99655f227b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259672, "uuid": "f118c92c-8867-43f2-bdca-686f073c8f71", "value": "diagram-1234515355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b697be70-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263240, "uuid": "0f4ec72f-1650-473f-b370-e7c3525b958f", "comment": "Malware payload", "value": "19270a04e5ed5c7f6de0e6e2592ddf8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263240, "uuid": "264cec29-0f64-4442-86b7-f695931e5f80", "comment": "Malware payload", "value": "059f9257e711facc8799cfdad12fa92f3a66518fc19a31e35e2af9cd17959dfa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263240, "uuid": "08fb1677-094f-4dfd-9c43-b37705064835", "comment": "Malware payload", "value": "46ce0b2eb85fb411e8b6242d3999b6306aea19d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263240, "uuid": "c09fb703-4aff-4938-a7c6-5f1f0cf611ab", "comment": "Malware payload", "value": "d358b9d7b5626238d126614bd67d0ea4e503c71f0cf0679b6a5b6c9cbde325d0ff8a8239b60e35be943d49eb0d8e533b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263240, "uuid": "00042a6c-bf25-4b17-9a3e-134706ff8c29", "value": "B333F1E0D801E086A755F85CDCAB9D038F3DDD5A073DB852027EC0C69E72AB5B24AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263240, "uuid": "2e7f14e9-91e7-49d2-8ace-77314619a0d9", "value": "1536:oXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOco:8Xma7774mfCyWMB/4GpCOco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263240, "uuid": "740ef8aa-a0b3-43ec-8b2d-5b82b1738575", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263240, "uuid": "42f06c1b-6922-45e4-be1a-e2735ca496c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263240, "uuid": "aeb8f5df-eb28-4f0c-bbf3-01a903b93a24", "value": "statistic-1760149634.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de0c2cc-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264782, "uuid": "01f2ff41-cf01-437c-b244-d088a5babb1f", "comment": "Malware payload", "value": "0ec2955c63a8d2a2cd057a3b693560be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264782, "uuid": "fbd6d80a-aebf-452b-9208-c0967be1e305", "comment": "Malware payload", "value": "05a37049cb9d867c438ec29adcca1fbb7c79f14feca9483a5867d9555638aa61", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264782, "uuid": "1b508d16-3ccd-45c3-9b53-bfd5ac294ea5", "comment": "Malware payload", "value": "fa448d49898511e140efd45016d051f09445f0da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264782, "uuid": "3cbba9e9-cf28-4f6d-9c34-bf1a9c16f06f", "comment": "Malware payload", "value": "24fa517eff1f3c208f9a03e2f359972b35b45a0472badb43d0876783ea357492af7c8af682b70ea35e82e9a0bc080094", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264782, "uuid": "542d4426-3ab3-4bcb-8e1d-f6b46b04fe29", "value": "FB33F2E4A507E047A749B81CEC6A5D038F3DED1E423E78D2022BC1D75E61AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264782, "uuid": "10638e2e-aee0-4d2e-adca-c387e5315cb7", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZS0:cXma7774mfCyWMB/4GpWvZS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264782, "uuid": "91bf3059-17f9-43b3-b252-579947b00371", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264782, "uuid": "56bb17f1-9878-4510-bcca-df960a8a2a3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264782, "uuid": "c2d94975-875f-42ac-9b9a-6629c0124e57", "value": "statistic-958360449.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699b9fb9-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262681, "uuid": "b6892b19-85d5-4cca-af23-bd996a0581b3", "comment": "Malware payload", "value": "d1ef6a3e265c51604e2e95b376b4148c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262681, "uuid": "394886e6-492b-4a0c-a49d-e6d26fcf842a", "comment": "Malware payload", "value": "05b7656df0d643a0e003e28f72a3b9899af6de5b0fe8d3e072bed97ea6ade824", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262681, "uuid": "df4e2160-9832-453e-9d2b-38c74b7d14d9", "comment": "Malware payload", "value": "a3d766bf6d7652ed0f9e251e608f5ac8decb4f51", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262681, "uuid": "9fa210af-be78-4e7f-a8e2-e4616a781c25", "comment": "Malware payload", "value": "47aa3b44665ab58ca5f1ad21c3025a34ab6bc7b7e8611e121dfe966af5c5102b34bf21ef4240624c718448b6c21b2b59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262681, "uuid": "9e3cdc14-d443-4051-8108-b1c80e1e42da", "value": "893302E49906F08B9B49FC18ECBE5A535F3DD90D037D78D2113AC0C79E91AB4A609E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262681, "uuid": "a88491a6-4f66-4053-b31a-05f139f59589", "value": "1536:KXXtg3K7774iXfEz5lnm/hQMOEYus1Gpyubh:KXma7774mfCyWMB/4Gp9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262681, "uuid": "b07b4e46-38a3-4ad5-9cf4-1301cb5685b2", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262681, "uuid": "96ba2981-4278-4a05-896d-41329a84edfe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262681, "uuid": "514466fa-b32c-4f86-852e-51892fc70b91", "value": "statistic-1333418828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9754672-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257231, "uuid": "b2b6847a-1f10-4804-b31a-129143e53560", "comment": "Malware payload", "value": "cb8b8a054b8a61171b88a11b1019a0bf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257231, "uuid": "d2304d85-a3b9-4306-8151-41b05f5d3993", "comment": "Malware payload", "value": "05cd540f886c614349609fce332e1066149484cbca3a91a1fd8322e405e16799", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257231, "uuid": "82b38ea0-1ede-489f-a759-8d445c63b5f3", "comment": "Malware payload", "value": "9cea3b8d310015748e8ab377f780dcf97e3e8d3d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257231, "uuid": "8b565dec-b004-4a4b-b00f-7f5bc9f0d041", "comment": "Malware payload", "value": "e0680eaacdb5026f69c299a9b0c98763c9c9a9930dce20358cba3ec9e961bcdd78c0a6abb62ce040d69aa99cb385a12f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257231, "uuid": "7768366a-88d6-4ebd-bdfd-631188c32293", "value": "9633F184D164118DCF4FD2EB30F6FAECE19E7F43099AA8C09B6E2644D2520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257231, "uuid": "88756269-7aed-4727-bb82-b44de11f1a3b", "value": "1536:K2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbKY:vfqhp+g5ru2kmUEt88mAbKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257231, "uuid": "f7bcc8bf-dc27-4f3c-bbd3-cea9a9e8a62d", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257231, "uuid": "b4288c3a-aedb-437e-b048-2bc41703dae5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257231, "uuid": "dd443807-3120-4528-b94a-94596a0c79ca", "value": "catalog-1438533593.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8529f3-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262422, "uuid": "8ffc234d-c3e5-4b4a-9437-00add9ec1ec3", "comment": "Malware payload", "value": "077c30e60cc0ad68b504a7fb5c4ceec1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262422, "uuid": "0da860c6-5004-465e-af85-ac424b82977f", "comment": "Malware payload", "value": "05d2b6ec7422b87ce5e9df7a2be7e10b3b673c79cf591d3afb1578d6d292577c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262422, "uuid": "0d0de497-dbce-44ae-80d3-2025cb195202", "comment": "Malware payload", "value": "d0a40ac4b9a33937e584a0d021085611ad6f9a25", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262422, "uuid": "062a71a8-aa5f-4c5b-afe4-74c1b6b1c446", "comment": "Malware payload", "value": "ac53a8c49f209d711fead46b574ba4c0896f6348888949a060f1291b826690514ffbf6fc83c2713530397b82022d1866", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262422, "uuid": "87b264cc-1107-4f64-989b-a34dcedc0e09", "value": "3B3302E49507E0479748B82DEC9E9D434F3DE91E033E7892111BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262422, "uuid": "fcbcbbe2-20ed-410a-9eee-bce87a1dcd20", "value": "1536:FXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ2:BXma7774mfCyWMB/4GpWvZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262422, "uuid": "0e9978af-3310-4da9-98bf-05689cd0c340", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262422, "uuid": "8b9afff3-3534-4635-b62f-b0121ff6a19b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262422, "uuid": "23ed11b8-d0e1-4a12-b05d-e0346f344783", "value": "statistic-1166249096.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9292d132-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256737, "uuid": "6c2f2418-6eb2-43e6-8905-4b6636a179e8", "comment": "Malware payload", "value": "a7079e2525d6602597b6c9f115868d4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256737, "uuid": "cb01958c-2b24-4915-988a-e9a0787ed704", "comment": "Malware payload", "value": "05d361a82ab5ba0425ad49638d395d99330f8ad43adb3beca1114b7b5c24b37b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256737, "uuid": "21e6f805-94e6-4147-91d0-692a98abcec7", "comment": "Malware payload", "value": "5bd8eb41db2813dcfd79d291f98345e254c86026", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256737, "uuid": "7e38e5fc-16e1-4574-a7cd-433a3ee47e17", "comment": "Malware payload", "value": "044a20e84d9406c84817c76b5bc4ffeb64c8e6674fdde1ea4ecbd12163650b66dfdf8112cbdbc43bbf50219cb6f3993d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256737, "uuid": "6eaff5d0-6578-4fed-810c-d5bde03483db", "value": "16330186D264214DCF4FD29630F1FACCE5DE7A430DA9B4D0A66E2B4481931F04D2A69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256737, "uuid": "06afeacc-4491-43dc-9d13-48b77fb2b538", "value": "1536:52fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3/:kfqhp+g5ru2kmUEt88Ix/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256737, "uuid": "3725f160-66fb-489c-bed6-11e09810a611", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256737, "uuid": "7183813f-d873-458b-93c9-9f7ab9431c8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256737, "uuid": "4da31dbf-18bf-4cb1-bca2-ba6f22898655", "value": "catalog-1063599171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e8ecf4-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258703, "uuid": "e188c7cf-2fc6-4f91-ae9e-a7a54a29c2bc", "comment": "Malware payload", "value": "1a3f14fdc41c527f22d0c9972b345f23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258703, "uuid": "6e667845-c345-421b-b1f2-70ea9ba71184", "comment": "Malware payload", "value": "05f2323b21dd78caed9c7efb96d058005c39a1f6e4f6649ce19cb7faddcddebc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258703, "uuid": "5b6250d1-f648-4510-ab01-038c0a20b6cf", "comment": "Malware payload", "value": "6fe5173804285496570f707c16b0357a92bc3395", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258703, "uuid": "7be4b355-b9ff-445a-97a5-983546db10ea", "comment": "Malware payload", "value": "ae6e22445dd95d54f59d12a4501c619493746d0d50d660699d0440f8c2221341a6f18e0c10f2cca696c83fc4f335efc6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258703, "uuid": "edec16ce-6266-4f1e-bac4-967574a40fe5", "value": "AB33F184D164108DCF4FD2EB30F6FAECE1DE7F43099AA8C09A6E2644D2920F54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258703, "uuid": "460d9192-79c6-4a35-9ff2-8d1ec951650a", "value": "1536:C2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbDr:Hfqhp+g5ru2kmUEt88mAbDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258703, "uuid": "1c9c1971-5ff0-4490-b17a-94e9fc3ee091", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258703, "uuid": "5476802f-e13e-4dac-b61b-fbaa654a323f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258703, "uuid": "4889391f-3e7a-416a-a398-d4a2911a3dd0", "value": "catalog-499402495.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade73db9-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216839, "uuid": "2e52689b-432a-4e0e-898f-5630b8d267f1", "comment": "Malware payload (Dridex)", "value": "8ccc30a4ee4bbcc587c715e06307d6a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216839, "uuid": "0501531a-293c-4b5c-86dd-ce41218911d9", "comment": "Malware payload (Dridex)", "value": "05f4af27d96ac417fd405015cd942b9d9499669bdc0a052fbeb33fa6337ade41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216839, "uuid": "5d46faaf-9b74-49aa-8d71-339e6ddfc140", "comment": "Malware payload (Dridex)", "value": "dc7b16b71d69fbdb6c8af0a63d934b6dd8399c33", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216839, "uuid": "8439069e-1ca3-42a3-9c94-03e8759f42ed", "comment": "Malware payload (Dridex)", "value": "b1fe8b50c0560afc9217314f8dab285b8fd065a46095c2f374108ff1021c54a73ad5dd8d32625f3958fc49798d0c89e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216839, "uuid": "7fe25226-f0a8-45b6-b8cc-1e7205417402", "value": "E4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216839, "uuid": "11d35be8-ffd8-4e02-8777-ac05eb2f8490", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216839, "uuid": "b7ecbdd7-6291-4ece-ad20-d47cfb76a3cd", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216839, "uuid": "b7e05b2a-afcf-4618-99b7-ebd417e14ee9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216839, "uuid": "7416f7a1-2808-40ed-83ad-f52ee340ddad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216839, "uuid": "f291faac-9a51-42c3-9f6c-a978d882ffde", "value": "8ccc30a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5cfa3d-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621264405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264405, "uuid": "c6e027d5-62bb-4060-b800-84009cf34dcd", "comment": "Malware payload (Quakbot)", "value": "ef0fe24689f9c9d9c6a7c67a421bdb0b", "object_relation": "md5", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264405, "uuid": "640f7cc8-78bb-4934-b17b-5970dd1769a0", "comment": "Malware payload (Quakbot)", "value": "05f60f54a02b2488e748472c4fa3c8ddca168cddd5264e7ff30885899679c363", "object_relation": "sha256", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264405, "uuid": "33544773-650f-49cd-9093-6bed6d1262cf", "comment": "Malware payload (Quakbot)", "value": "143e369d7bdf146a230fbe749387dede0d6beb09", "object_relation": "sha1", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264405, "uuid": "99bd49ba-6442-4c9e-8fad-8eebc11b63bf", "comment": "Malware payload (Quakbot)", "value": "2e5c9e0285d4fd6495faa0dfa4541f31f40f1f0544bb9acff6d436d59dd2dfc1ff3341c9352fdb66c7d7d35cc1a887c1", "object_relation": "sha3-384", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264405, "uuid": "20e3885b-87ec-4f0c-9067-699e989f5422", "value": "72E4C027F690CC37D1732A7D8E4B42A4A8297FC0FD2469562BE81E4C5F393C63626197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264405, "uuid": "40ae5335-421f-47ec-a6ea-084e4d41f263", "value": "af342d645db2fe01e0cef0eeb0587f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264405, "uuid": "ca1c9081-1b73-4256-9c37-3f1c3cad86cf", "value": "12288:Rkw+sg2La14HUGxAdepWD6ClKRfeEJuBnitAL6wxloYm8I/BP9mmB+:e4PC4H3xZCk1eEJuBPOu+99z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264405, "uuid": "ed8f337e-60c5-4845-a2e8-d1e5d3fd07b4", "value": 691664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264405, "uuid": "cdb49fec-46cd-4b33-8f7a-9327e3d81b9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264405, "uuid": "4fb1ef6d-9997-43f8-8d9a-c582eaf9a842", "value": "05f60f54a02b2488e748472c4fa3c8ddca168cddd5264e7ff30885899679c363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e290821-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261454, "uuid": "101139f5-d67c-4d94-bce3-0337ad2aae56", "comment": "Malware payload", "value": "eee641d262c0cc6aea38040c02150691", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261454, "uuid": "93314167-ae06-4f5c-9fbb-ad3da89bd9ba", "comment": "Malware payload", "value": "05f61853e6e0d23701cec7e159c709bb65cf088db9340ff3ba40d9645683edb2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261454, "uuid": "1cf1fe16-64af-47f8-b179-772089582034", "comment": "Malware payload", "value": "1dede518dc9a79109b836a7a733113baf863029a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261454, "uuid": "599be1e0-97c5-4776-b80a-ed8ea2e130e2", "comment": "Malware payload", "value": "6a797f4eda8e3d8af2f130149d9e9d54293d790f496b3a1dfeba3b0b8e12ed3e6840bd77be2a871d9ee4a035659a639c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261454, "uuid": "1d8a56a7-bc2a-40eb-97c2-3c8b5804e7e4", "value": "8633F13147D8DAE66E76E06FD4C6F844FFB28465C4CBCA254DF9B2C9B1902519E32E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261454, "uuid": "0b941ecc-f310-4809-b661-e2ba5ef5b5f0", "value": "1536:qjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdbpY8Sid:6B9wzbqtWb08UscYJhnpjyq9q5bid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261454, "uuid": "3fa93074-a148-4e9b-91e0-5cacdf6d38e6", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261454, "uuid": "234b6d96-f40c-4915-b789-02fd04e84907", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261454, "uuid": "09810f94-5de0-4cae-a951-66044f361002", "value": "diagram-555297874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6534bf-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258711, "uuid": "05524061-a30d-46eb-b47e-f6f36149b04b", "comment": "Malware payload", "value": "2e8f832928349082646fc0768c1d91f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258711, "uuid": "bf49e8d8-27a4-4a8c-bcf9-e19008ac313c", "comment": "Malware payload", "value": "05f8f33bcdfd54908a120cc52e0608110d0a7f764eac497dd2afab24f7f26b03", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258711, "uuid": "84b65147-3ff4-4ea8-8746-144d3c69e1c1", "comment": "Malware payload", "value": "9e4254ef3f44db1d39977fbb2b1a9beabadf5593", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258711, "uuid": "13693afd-c2c2-46ee-a951-e6a79f8667fe", "comment": "Malware payload", "value": "93ba52594d85590996520730554ebd73be8e13c993528c9f305024033b2c365c715aa86507c36699898a5d56b70f7615", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258711, "uuid": "763dd9c7-6328-409f-9fab-a7851aba5aa1", "value": "8733F155E655104DCF8BD2DF20F6E9DCE2CEBA530EAAB8C0A67E2745D1520F0481F68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258711, "uuid": "6589e509-c611-40d6-8c3f-280002a7980a", "value": "1536:o2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIThl:Zfqhp+g5ru2kmUEt88Thl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258711, "uuid": "82ec1865-46fb-4bea-89cc-fc02ec46c605", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258711, "uuid": "3df308e1-8348-4f1f-84a2-e1e82b46306f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258711, "uuid": "0e44a008-5076-4f83-b642-345d1059ea01", "value": "catalog-505003813.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6454eeae-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258807, "uuid": "0082b3dd-8857-436a-a260-e75f6bb245ce", "comment": "Malware payload", "value": "2f4aa1d9b673f518b9ded5010d492e4e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258807, "uuid": "2cd5b08d-2716-4c49-8de4-480719534f5e", "comment": "Malware payload", "value": "061c65e79a50a92f215ff6bbea760b9100c3332ab34683a3f63a236eba46036b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258807, "uuid": "0b6169b1-daa8-45ee-9bb6-509427784627", "comment": "Malware payload", "value": "f99b879811e041bc45bc8f2811e05c84a8464638", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258807, "uuid": "51d7c9c5-7f69-4013-8271-81c74915ff8e", "comment": "Malware payload", "value": "3c2d1a923c9ea389590783b13095549fcd5f653b6d16f46313e8e9a2c98e9c4f01aa6abcf008d9c5c96b640af579bd42", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258807, "uuid": "d52119d4-ca2e-4f08-b0d3-91cd4b5504fe", "value": "3633F1929554118DCF4FE2EB60F5FAECD68E7E130DA978C0AF6E2B4581830B1092F54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258807, "uuid": "a19e7757-8d58-43ee-85c7-cb3c46e0b77a", "value": "1536:+C2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI61UB:Gfqhp+g5ru2kmUEt886u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258807, "uuid": "f6e6e1db-5da2-4897-b234-fb0d9121a334", "value": 52723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258807, "uuid": "03a79398-7f35-4695-967b-420ed6087024", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258807, "uuid": "aea0a872-fa1f-4ad5-8f92-8d8f96007093", "value": "catalog-5815283.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ef9cec-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262507, "uuid": "bfb6d4c0-81af-42a3-a04f-8e244f0b8d5f", "comment": "Malware payload", "value": "d7971dbd0b8d4ef37f92ea64240d7f40", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262507, "uuid": "6c46ae0f-9a54-4d7d-ac0d-e9714e818dd2", "comment": "Malware payload", "value": "0620f47dc07486f57632210a7293a98a006544727371617eb797cc0e5da6d548", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262507, "uuid": "5219c109-b570-476a-84d2-68a4e72b062e", "comment": "Malware payload", "value": "c7029deb9cb3a06550bca6b55986f11dbc139a75", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262507, "uuid": "f5ca0ad7-5759-4f5e-9e42-d9f01826c6ec", "comment": "Malware payload", "value": "1621ef2c6531695edf39a4c498a19eda7259376eeb67aaeb44ddcef434e9e360cedc8560f135e6d01090f1ecfa6931b4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262507, "uuid": "00b664b6-d188-444a-a4fb-c93e289544f6", "value": "B933F1E09902F08E9759BC59DCAB5D078F39C91E037D3883017BD0475EA1A75A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262507, "uuid": "f350fc1b-eba7-4162-9557-72aa647dc124", "value": "1536:/XXtg3K7774iXfEz5lnm/hQMOEYus1GppPT:/Xma7774mfCyWMB/4GppL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262507, "uuid": "848582e6-d0fa-4b40-9d71-df81236445fe", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262507, "uuid": "2270d04d-b196-49d6-b584-e930b293aa12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262507, "uuid": "b56f6be6-02e3-4604-9364-42b11e1e48a7", "value": "statistic-1214782395.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924628ca-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262320, "uuid": "d68f9260-e299-4c79-ae1f-40b6aec7a189", "comment": "Malware payload", "value": "e545227fbd36fd8c604160d8b0562292", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262320, "uuid": "41af12f5-fe68-45a0-90f0-2bb1b657e03e", "comment": "Malware payload", "value": "062f6b7d6997d58a8b27cfd6d02d72b0dd83d94c5fc4bf9fcb72642def48fcad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262320, "uuid": "0950e328-79c1-4824-b5f3-9acccc1187fe", "comment": "Malware payload", "value": "31e5909e4c947646d5d8b2afb06a9ba653259e38", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262320, "uuid": "6c962a6a-3aad-4c0f-97d2-011a8dd6e684", "comment": "Malware payload", "value": "a5debfa532f3390f18f29411a063270853dc23d950613cabeb9edc46658942c2fe8918eb5b887b90e72f6a17c8067b9c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262320, "uuid": "b03334af-81a8-43a4-8be3-79be6f643139", "value": "5533F1E09902E08E9755BC5CDCAB9D478F3AC91E037D3883017BD0475EA1AB5A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262320, "uuid": "047e874b-671f-4cc7-9103-ac8c7db97ca8", "value": "1536:gXXtg3K7774iXfEz5lnm/hQMOEYus1Gpphq:EXma7774mfCyWMB/4Gppo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262320, "uuid": "3d778351-506b-4268-9617-72d09d686777", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262320, "uuid": "4c1b9bdb-e526-48fd-b8a9-b2d9e6e42915", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262320, "uuid": "07de36ee-a1e9-405e-a4c7-f11ed255f4cd", "value": "statistic-1050532883.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52429e44-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261353, "uuid": "bd3ab8d1-3424-45c2-b7a3-40c498ad5b89", "comment": "Malware payload", "value": "513d154804a02410c99d907615d0b05c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261353, "uuid": "fe23f7dc-c78c-4bde-b9bc-fb99c29c5c9f", "comment": "Malware payload", "value": "0647a593f011ed9245acbbc50979995c513c45d800e4bb89f15a4cccd3145684", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261353, "uuid": "758d96a7-96a4-4150-b37e-06e9acedda2d", "comment": "Malware payload", "value": "da13c380ec34ee1b5beecf30522ebe622078c305", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261353, "uuid": "b1adc0e1-261d-4088-973e-2c7dd8b465e5", "comment": "Malware payload", "value": "03168a53588cffc24f78bd37839694472f039cc035afdff10b25c66cd696f44420cfd1862ff570c5278df7752df66e5a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261353, "uuid": "fdfb66b8-5422-4194-b582-211cd181dedb", "value": "9633F1354BECCAF62DB6E0AFC8C6F604FBB1D495C4D3862649F8B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261353, "uuid": "5d28965d-70d5-439d-bb1e-a116a6d30b69", "value": "1536:CjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX4M:yB9wzbqtWb08UscYJhnpjyq9qBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261353, "uuid": "1b8bda84-2301-4a52-9cc7-f189178093d9", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261353, "uuid": "088dff5b-b6fe-430d-a9e5-249d641d10a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261353, "uuid": "7da466a9-52b7-445a-9a97-ad8043a50034", "value": "diagram-488571223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0fb992-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256749, "uuid": "729ecc43-574e-42df-a832-d4ba5520581a", "comment": "Malware payload", "value": "772815c2b86e42a9a5eb6ae33650027c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256749, "uuid": "fff3210a-d968-495f-a8bf-194f22363109", "comment": "Malware payload", "value": "065556d2df860e5db276cf3f4e4b460fc7d342c9949e952578947cd18243d261", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256749, "uuid": "dba78e0f-1548-4beb-b7b9-d364658fb189", "comment": "Malware payload", "value": "3ffe6ba0de62bbdf7640b0cf2167ec9adb214560", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256749, "uuid": "2fc0fbd0-65d0-4474-8904-8a95fb5d0815", "comment": "Malware payload", "value": "2612fcdc41adbf906b4a6cf6f603a415041ef6d4ad4479a4984ac7aad9318d89c1d214da9ed893932d71c1e6a4c3a84b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256749, "uuid": "b615306a-43d5-49d1-9c32-ae7cfcbced62", "value": "55330196E755018DCF8FE1EB24FAB9DCE19EBE03099A74D0DA6E5A05C1930F0182E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256749, "uuid": "95721dba-7e29-45d8-a502-d175006d9430", "value": "1536:42fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIUJoo:Jfqhp+g5ru2kmUEt88Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256749, "uuid": "b0f35e22-e689-4155-b577-2e31dc1f7d49", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256749, "uuid": "7808730a-d311-4bd3-babf-60df7a6ef491", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256749, "uuid": "2fea315a-04c6-4724-a764-6a3a3ca30a2c", "value": "catalog-106882944.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788feb34-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257981, "uuid": "8252e097-65c1-4a9d-b58a-01558a19eec4", "comment": "Malware payload", "value": "fab9b8316d6ac4273719898566996be0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257981, "uuid": "c041625c-dfa5-416c-806e-77f9ed648951", "comment": "Malware payload", "value": "0666e58edf575a914925b8f0d24568f5d7195bf75b34ccd72b1dcf35c45c1640", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257981, "uuid": "e74a0e95-ab07-4397-9917-6c9b46606508", "comment": "Malware payload", "value": "4cb98803b08ebba3f8c750dafa244a856280d63c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257981, "uuid": "05450ced-fc51-47dd-8ea0-9bc17037aa81", "comment": "Malware payload", "value": "05df949b18e32d9eebb210dd20bf1fb76e671391a68f36593828a1b21cc8cbcdd172e11cbe31d93d9d5f430f4389078c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257981, "uuid": "b21ea32e-c210-4a2a-bacc-07e119495e26", "value": "9333F184D164108DCF4FD2EB70F2FAECE5DE7F43099A68C09A6E2A44D2920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257981, "uuid": "11f9fc80-595b-4695-a720-1e57b75c2bb0", "value": "1536:22fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAb+a:bfqhp+g5ru2kmUEt88mAb+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257981, "uuid": "ce453dec-3774-4212-b464-578ed3c5e08b", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257981, "uuid": "6c49476e-390b-4437-b586-219a44639107", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257981, "uuid": "6c3238e4-33e1-42a5-b1d1-9cd0c04d67b4", "value": "catalog-2010849407.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94e0c1f-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259432, "uuid": "7b881200-07cd-44b0-a7b8-c8a73fbc0672", "comment": "Malware payload", "value": "c25e6525d21c53ab9d7e18a8831c9480", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259432, "uuid": "a6e609ee-78f1-4681-92cb-464334c79826", "comment": "Malware payload", "value": "069de92d6bef56245833d39c1c211db27bb08176db1541190d8fd39ac494f8d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259432, "uuid": "17552d7e-dab0-4dc1-9305-d84b19f50eb5", "comment": "Malware payload", "value": "c611b2fab82ee7da87625265c1bacd0705172d6d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259432, "uuid": "2a3c01a6-fae3-4c5a-8cf2-a5837e2d2506", "comment": "Malware payload", "value": "8585b539950017c22d50c31c2c2ae48419a056258160d56557ef25d6e1a26c788693420bfe1fd2f5be1cb7d58f1409a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259432, "uuid": "c6b05651-8af3-458a-9e7d-56c57db02a20", "value": "9333F17187ACDAE628B2E4BFD8C6F904FFB1D499C4D78A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259432, "uuid": "f96a074e-a4a7-49a0-a070-7695d688b84f", "value": "1536:FjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXzt:BB9wzbqtWb08UscYJhnpjyq9qBzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259432, "uuid": "185dec85-1e66-4364-b2d1-9309d144e748", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259432, "uuid": "bcb5d8da-4e95-4c05-83b7-b16c5fd4a6c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259432, "uuid": "2857144b-bc06-4323-ba32-30cb172b6994", "value": "diagram-1061297953.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d94249-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264017, "uuid": "712186ff-c8a4-416b-b6fd-22c50b73018c", "comment": "Malware payload", "value": "772302d1a507f144343822fa3c06ab50", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264017, "uuid": "b2d39c98-8f90-4fb4-b2df-2facfa2bcf95", "comment": "Malware payload", "value": "06a4c096abcd00b38e2754ec3bd133b2a303dbe0e1fbdfc9a821a2e3426bc365", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264017, "uuid": "0eb5ebcd-b1c8-4bad-89e3-b9c58db2568f", "comment": "Malware payload", "value": "eec31b3a88c3cd70841a1be90ebb80913f31e321", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264017, "uuid": "47b1bfe4-bd69-405a-8817-e154b7201c1a", "comment": "Malware payload", "value": "13953aff7d2ebaf150cf150e1a22edf4bd594c6260345dd6326e80580d99fe08554642fa5ca5f0a588a245a27f9ab381", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264017, "uuid": "44adee47-451a-402f-8724-0c7a6da8db19", "value": "0433F2F4A507E047A749B85CDC6A9D038F3DE91E423E78D2022BC1D74E61AB7A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264017, "uuid": "b57821c7-49cc-4fa5-bf0d-2fd589ae6237", "value": "1536:iXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZMK:yXma7774mfCyWMB/4GpWvZMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264017, "uuid": "fb8a46ad-cb8b-494a-9156-5cb1f68d5dfd", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264017, "uuid": "0bb78db6-c215-49ab-bbd9-ae0977ac399d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264017, "uuid": "bf4d10a4-fd4f-4c5f-8c5c-f4cc56a3d8eb", "value": "statistic-438878775.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941c7f96-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264470, "uuid": "d4ae2cd8-484c-46a3-810c-5fbb26a1b323", "comment": "Malware payload", "value": "0d2c515e900cb6b823c7f58ee5edceac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264470, "uuid": "bbb22968-06a1-4e7c-93aa-3363e5377afd", "comment": "Malware payload", "value": "06c06bdc72322401450678e662b89c5a00ffd1e458ac70cb12c705a54891c2b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264470, "uuid": "3e504fc8-f456-4e8e-96eb-9cac6017f2ca", "comment": "Malware payload", "value": "1f301fab176919859c04d682f483c8d5cc5c6f14", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264470, "uuid": "d9625f70-7bd3-4e0f-982e-4dc03c58b2cc", "comment": "Malware payload", "value": "5ea5ff6607c304736aefaac5ec5936c4949acbd3d75894f41aa67e2b3b64e18c5d93e7c4aa1c701bb444b3bdbab16c8f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264470, "uuid": "08223c4a-0a21-4343-b606-e0f705054549", "value": "653302E0A502B08BA754B84DDCAE5D134F3DDD5E433DB892413AC0C74D62AB5A709E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264470, "uuid": "4658d8ec-8b0c-40c7-9744-7f98c61c465b", "value": "1536:kXXtg3K7774iXfEz5lnm/hQMOEYus1GpuV4p:QXma7774mfCyWMB/4Gpuup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264470, "uuid": "82e37dc7-a7af-4d06-84e8-ffd87e1340df", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264470, "uuid": "01bb4921-9818-4a54-93e4-674be9ba3cce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264470, "uuid": "844aba4a-ee84-46da-81e3-e4160a3207fe", "value": "statistic-747994837.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf802f2-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263732, "uuid": "667cad04-4ea1-46ca-828c-64f7ad8301cb", "comment": "Malware payload", "value": "02c8669e53e642f87f41862dcbaecfa8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263732, "uuid": "fd1e4494-8f24-45e4-872f-ab6a84f989e4", "comment": "Malware payload", "value": "06d1122dd043307608c4912de52e1316e11b417f3097155a3ec226a01b529790", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263732, "uuid": "584245b1-a8fd-487b-ae4e-44f95726b120", "comment": "Malware payload", "value": "86edc1b2397a7f7b30c41684f053d29cdfd5198a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263732, "uuid": "fe00288f-08fb-48d3-9281-9a0506b18df3", "comment": "Malware payload", "value": "334fd51c0f080e523156fcb8299d831531c8944c160f7bcdb30f170c1bdd77c9b71afc6d127903ae9fc61645f08d4317", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263732, "uuid": "f3bf4135-0a8b-4d89-8d5d-6fd270682ebd", "value": "943302E09902D087A7597C6CDC6E6D079F3CED0A473DB853112ED0874AA26F8A745E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263732, "uuid": "663bfb70-6a3b-42f5-a607-df63d1f208f8", "value": "1536:wXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qNg:0Xma7774mfCyWMB/4Gp07t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263732, "uuid": "279a8bd3-ad46-47fe-ae7d-53d17b1199ef", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263732, "uuid": "9589f54f-0728-43ba-a742-1d150749bf00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263732, "uuid": "7ae310dc-d56c-4405-8114-d28ffa3ce10d", "value": "statistic-2123977459.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3125c7d-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260630, "uuid": "cd91b40b-15fe-4a35-9bf9-16d746848dad", "comment": "Malware payload", "value": "4b0b49f8a2f2250fbae4ce3e17ec659a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260630, "uuid": "34efb870-4864-437f-98e0-82f9f77ca6ce", "comment": "Malware payload", "value": "06dbae993a19b4a1cf8c01b81267cfec09e006034b4e863a4fc6dc4f99759449", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260630, "uuid": "939a39c1-032e-42b1-bf7c-1f4c2468ca2c", "comment": "Malware payload", "value": "2944c07f1414b637b85a5f2fa74e00e485299c07", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260630, "uuid": "96c668af-325a-4688-b68c-bfe0def49de8", "comment": "Malware payload", "value": "b769e2c5c714307cb1c40a4f9788e98dad1d3b0e961f1fa613e4b2d2fdb97c3d69387da6a665f9705ec80ec3c4468375", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260630, "uuid": "32d6268d-ae50-43b3-ae9a-a4c6eed45085", "value": "3B33F1715BACDAE66DB1D07FD086FA04FFF1C4A5D4AA861385F8B0C8B6D02915E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260630, "uuid": "0502e688-4313-497c-91cc-30cd6f8d50c6", "value": "1536:WjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67408:OB9wzbqtWb08UscYJhnpjyq9qawC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260630, "uuid": "c5dcba9c-242b-4fac-9858-a13979a26ab6", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260630, "uuid": "0bc5f828-f2ad-4ce4-8765-91be8252276a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260630, "uuid": "553c7c41-b93b-4afc-ae76-061b90bf450b", "value": "diagram-1938847365.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8aed9a-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258606, "uuid": "a77eaaae-d9fc-4a77-bd76-e6c57c849622", "comment": "Malware payload", "value": "3638d39a1df9f3ac1b329ce6152bb4e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258606, "uuid": "46e16341-b6e5-4161-815d-b74bddea21c2", "comment": "Malware payload", "value": "06dcc055ec8e8c7f6534e4a1ad4cd3637f24b5305fb54ad027f7a6552c8c7459", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258606, "uuid": "53dbe200-abba-4fd4-bc98-45800438716c", "comment": "Malware payload", "value": "8e2a4980e51d94299438eed2fae218d73f06f273", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258606, "uuid": "9ce4644a-8626-42db-bbf1-937cadf980e7", "comment": "Malware payload", "value": "82a7172220453b436d78c6355aea64c36f219d79a145f8ffedf4ea136dd331538ec7489023a41707dc7af605c89ed15e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258606, "uuid": "8ca43665-b0c9-4907-8652-344a0dbb297c", "value": "A833F181E558114DCE4FD29B20B6F9DCE2DEAB534E9AB4C09B7F1B44C5924F0482E58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258606, "uuid": "36f1c936-a26c-4b3e-88f7-5d86ec829a4d", "value": "1536:f2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIFn:ufqhp+g5ru2kmUEt88Fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258606, "uuid": "5720c30d-8953-422f-b1b9-3dc9686d0a6b", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258606, "uuid": "9a542a18-f05c-4adb-a2fe-2184ecfcd758", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258606, "uuid": "3275282d-50ba-45bd-8a1a-8f8281dc95aa", "value": "catalog-432533277.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156d054b-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258674, "uuid": "4bcf4bff-b422-47f1-80d9-a284965a7d37", "comment": "Malware payload", "value": "fde265d296f1a1176735dd89f7c55337", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258674, "uuid": "96c7cc8c-28f0-418d-825d-64b2393b0489", "comment": "Malware payload", "value": "06e07d7e2c891bb15d4872d8117581c61666b12de59d0e5ef13ea2a817e9e9a5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258674, "uuid": "765cb21a-c385-4a16-97c9-06006746f10e", "comment": "Malware payload", "value": "c9a90856078c12795b0f51e3cc69d087565fd67b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258674, "uuid": "22166f8c-682b-4e77-815f-32841dcde31d", "comment": "Malware payload", "value": "177f3b47bd6ac228bcf69d165fd84d4cb9a4ef9afe464c485fd9f9392b6b72129b144c12876047106f19a4a3cb719d06", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258674, "uuid": "3527125b-4070-4ba9-978e-8984bed89add", "value": "B7330186D265214DCF4FD2A630F1FACCE5DE7A430DAAA4D0AA2D2B05C1931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258674, "uuid": "dd536cb4-0f8e-441a-9ca7-8f1d7b1cd218", "value": "1536:12fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3R:wfqhp+g5ru2kmUEt88IxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258674, "uuid": "adb14d39-4fa6-42ff-99e7-52c4d7550396", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258674, "uuid": "2930dcb5-8047-4403-8caa-21e6d2bbde3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258674, "uuid": "edcf6c10-f808-4c98-bc0b-56c61b5ef971", "value": "catalog-482812681.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0fbe1f-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256972, "uuid": "ee97f096-e204-4d51-81a4-e8661255ee3f", "comment": "Malware payload", "value": "e0b2e9011b4aeacb21c61f2fa2e92eba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256972, "uuid": "aff3eb2a-560b-4d0c-bc2b-09e7ab66b9ae", "comment": "Malware payload", "value": "06f6f0a829b398886aec4cbe7e673a504e758ec3076622dc36e5ee67d0637a6d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256972, "uuid": "d58b9bc9-5787-443d-a3ff-be551fb8691c", "comment": "Malware payload", "value": "4e9bb63c297d7fb1ccc2355a1b0126c3e97b7808", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256972, "uuid": "68850aec-07fd-4e0e-a45f-6b6c4a9d3c00", "comment": "Malware payload", "value": "6c491a30cbebd44e113e36161aa518f5658b6d9e2382355d7a97f1e97bcd29ef22e8505ec8ead462ed4d23fec7bfd886", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256972, "uuid": "dc8fa178-c652-4272-a8fa-61ea889c3450", "value": "9833F281E554118DCE4FD29B20B6F9DCE2DDAB530EDAB4C05A7F1B48D5924F0482E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256972, "uuid": "b8d59b27-e4f5-4830-85ed-6ddf9fed399b", "value": "1536:X2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIFs:Gfqhp+g5ru2kmUEt88Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256972, "uuid": "81026b09-8b34-4c25-8aaf-0d32c7b30943", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256972, "uuid": "8e5f531d-7510-4b3a-b8a8-be7cee1dff6c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256972, "uuid": "33d19437-0c2e-4485-8973-6d16e2f65790", "value": "catalog-1258779732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f72031-b6bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621220905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220905, "uuid": "f1069bbf-ae5a-46da-9905-18f612d475b7", "comment": "Malware payload (Dridex)", "value": "a64d4f887a7df6fae313ef7cf6f8637a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220905, "uuid": "7b985e39-96a6-47c4-b1b1-ea3fdfa2ec25", "comment": "Malware payload (Dridex)", "value": "06f951e67e0e3d014f66672174bd913cbf5c0e59bdd0a6f87ed5fc30657573c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220905, "uuid": "ab8b8c90-c88f-4f58-806d-47696d28c3c5", "comment": "Malware payload (Dridex)", "value": "f32d80fb5036fa29fdd1080dce9e6b64f668ad51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220905, "uuid": "a6b31723-ac93-4b4e-aa16-8689d9ae45f0", "comment": "Malware payload (Dridex)", "value": "16cd850d27db5c6343242e00b4e05d1ca01789402f8102eb7cfaf1f1ba3e65846ded087792f6e9372a0e11f332b491b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220905, "uuid": "500cbddb-a1fa-4c1f-aac8-e86e72bcf05d", "value": "4BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220905, "uuid": "12e96846-9260-46c6-9f39-31c17d3b3b80", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220905, "uuid": "0d8d7eeb-8c25-42b2-b17f-f9eaa4fc364a", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621220905, "uuid": "3bfb7e9d-1db2-4596-afd7-c910a1acb992", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621220905, "uuid": "0654ca59-2706-4ba3-bcd6-e68f375a0de5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220905, "uuid": "11a5ea84-6f62-4f5b-8afb-3e8d77b39c53", "value": "a64d4f88_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4ff7b8-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259952, "uuid": "104278d0-985b-4412-a503-1109cb09a405", "comment": "Malware payload", "value": "5da94376d288ff0d2abbbc9c1f25b685", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259952, "uuid": "7794374d-125a-4a5f-bd52-6f4aa460190e", "comment": "Malware payload", "value": "070428e19afee3a5a8c4d88e2411f0e5bc5051362ab5aa0dffad7d3926b5aa80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259952, "uuid": "a5f0e9c4-53f5-4110-b677-91d59dba3cc1", "comment": "Malware payload", "value": "73d52f46d01db2b030def5de621da19728fd6c47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259952, "uuid": "8f189878-d89a-4e26-a4fe-2333a63074c5", "comment": "Malware payload", "value": "23a5caf752498591c736c76ab28dbd49123a85b54800ef566d8e80ba6d08ff21a5f00f1d6a8cdec63910527f2ea87e87", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259952, "uuid": "04d56d26-8014-4c57-9c08-5914b2b435b1", "value": "9833F1314BACDAF628B2E4AFC8CBF504FFB1C455C4D786664AF871C8B6901959E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259952, "uuid": "936d7d64-2e41-4cba-901a-1b3f546d3201", "value": "1536:B9jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXqoS:bB9wzbqtWb08UscYJhnpjyq9qB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259952, "uuid": "c8202b33-4e2e-479b-baf8-3ad3ca818bc4", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259952, "uuid": "732e97ff-c962-4d8a-bf57-f9c445970415", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259952, "uuid": "8cca01fd-bd59-4b22-a611-41912060dd3d", "value": "diagram-1479829162.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb65da6-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261664, "uuid": "33687113-a686-42ee-bfcb-98ea23ef789b", "comment": "Malware payload", "value": "e4e00d9134c7a912c180dceaf5ba6167", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261664, "uuid": "d92aa553-6fb9-4945-bd52-7f28d02a064d", "comment": "Malware payload", "value": "071d8c1ac5f8799cbd3ab4f072d626fc2cb7d6c2ae3901f042e6903c3f40d403", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261664, "uuid": "086ebf05-99ba-4989-b35b-bc4ce2456831", "comment": "Malware payload", "value": "808a5c7db98f9ea05a02342e8649a9cf2d092440", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261664, "uuid": "b0c0d1f6-db58-4329-9903-9f371168f3a0", "comment": "Malware payload", "value": "c3e23ca99eb6643767d733722fbf4682ee2c78f464dd722363a9d7544e68496c805655690ee84ff4ce80d0d8233b1af5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261664, "uuid": "750e1a35-452d-48e4-8bee-2cb210e8aca1", "value": "AF33F13547ACD5F629B6D0BFC8C6F604FBB1D495C4D786228AF8B1C8B6D01945E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261664, "uuid": "8adfb82e-1eff-423d-b9f0-8394162632bc", "value": "1536:BjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXz4k:lB9wzbqtWb08UscYJhnpjyq9qBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261664, "uuid": "fddcb5bb-8e76-4f58-aaba-a5e5943ac34f", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261664, "uuid": "3d912cb1-eb0f-425f-89aa-e945ffc2cb66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261664, "uuid": "7ed09e45-6cb1-44f9-b9c7-ebe482d4d753", "value": "diagram-706390504.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2116e820-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264277, "uuid": "c69effc2-6d31-4c22-852f-b49d7f598259", "comment": "Malware payload", "value": "ffe9f2c1c478f585048388ce74657e2e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264277, "uuid": "78b9de7a-e25a-4fd3-8464-81290cf32cb8", "comment": "Malware payload", "value": "0724d5c38b4c5c2ef44946b10cae872c035585e0252b53c6b50ba00e902b74db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264277, "uuid": "cab9b72b-a4e7-496f-9092-a392eb31eb3e", "comment": "Malware payload", "value": "9bf448bade55289ea6dd3fe18e94a71cecc8eb7f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264277, "uuid": "9b4b61d3-4e79-4f1d-8242-13725d82a591", "comment": "Malware payload", "value": "d8920a1917fd14aba65f7e0075885af2b0c5a729a64c44ba12f486e7ed7a881401bb9706f20a0643672fe2ccca3f8def", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264277, "uuid": "718cd97e-8e29-4b26-a48f-8fb338f4c859", "value": "F033F2E49802E08BD749BC5DECAB5D478F39C91E037D3893017BD0878E616B5A645E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264277, "uuid": "193856b0-d449-4860-8f19-1dd859810d28", "value": "1536:mXXtg3K7774iXfEz5lnm/hQMOEYus1GppHs:uXma7774mfCyWMB/4GppHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264277, "uuid": "a21e71df-88c8-45e9-848b-7415b24cad02", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264277, "uuid": "c5a102f5-b003-41f5-8718-0de7c35cfc0a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264277, "uuid": "7f8737fc-5ddb-4b91-8640-d8cab670d25b", "value": "statistic-599738011.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bbb1d7-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258888, "uuid": "04d321fc-3627-4942-9f28-be8b92d94e88", "comment": "Malware payload", "value": "356b7d37e66ff087bc1c59dcf21df697", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258888, "uuid": "1c58473e-df8c-47c0-ad51-721db311a48e", "comment": "Malware payload", "value": "072cdef97252ca0271fdd732d69250fc99c19a40743c40bbdcf299ec5ad19d7b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258888, "uuid": "73efc665-a1de-4051-a09e-5338723f4fa6", "comment": "Malware payload", "value": "062e023e98a625158bd513c4be1e29f4bbac66a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258888, "uuid": "ded8b945-926d-4d99-9d9d-09bcf3b3c35f", "comment": "Malware payload", "value": "06007fe8f1e7bd3105c415b65638aa05fae734468d4e2dbd5b84ea60c566427304811d7e4420dcc51dd9ea47ba1443ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258888, "uuid": "629faa65-593c-4c49-8f87-2ebebcfdd5a7", "value": "D733F255E654105DCF4BD2DF20F6F9DCE2CEBA530EAAB8C0666E2745D1520F0441F68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258888, "uuid": "02ee0774-fa1b-4539-8c62-e34fdb6b9786", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jITh1:Ffqhp+g5ru2kmUEt88Th1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258888, "uuid": "c7317c68-2f88-45ef-b511-e01e3eec8d4c", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258888, "uuid": "cd522abf-b496-499e-b853-6600875d91df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258888, "uuid": "d8324ab9-e2c8-4028-8ba4-169e02809ae2", "value": "catalog-645839245.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b22f72d-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256724, "uuid": "412d3a3d-1cb0-4100-8f31-389a8b487fa6", "comment": "Malware payload", "value": "3cf0d522defa1deda9d6a7aefb8b2f5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256724, "uuid": "c63a792f-cd15-4220-aed1-9a361b8b3a23", "comment": "Malware payload", "value": "074e8a18d69ccf92a532eaa788729d0a233c5cbff915cd1cae24c995c0d606f5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256724, "uuid": "ead2c86b-a414-47cd-bd56-868e29ac0d0f", "comment": "Malware payload", "value": "818c308a766929f199b3ab2c7277fc1fe2b777d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256724, "uuid": "bead8cb0-e4d2-4dbc-a8d3-398cd265f36b", "comment": "Malware payload", "value": "fabdf6b43b9ec2ecaba27f6bb0b71350b194abb422d18e46d870a690ddb87b565c87e9990ca58ec2f5d48aea27bb29c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256724, "uuid": "42726119-425b-45cb-801e-f4a3d52be3db", "value": "0833F184D164108DCF4FD2EB30F6FAECE59E7F43099A68C09A6E2644D1920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256724, "uuid": "dd0881d3-9468-4387-8514-e4df2674ebca", "value": "1536:w2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbu8:Bfqhp+g5ru2kmUEt88mAbu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256724, "uuid": "e1eea142-16b1-41f8-9677-0a4e9b94110e", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256724, "uuid": "0a9d2457-2edf-4cec-83b2-b3401e23cf9f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256724, "uuid": "2899fb0d-cf16-4977-b440-5e7dd9ad6527", "value": "catalog-1059224934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d94cd7c-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260084, "uuid": "bdf85125-dfdb-4cab-ba85-6be9d6973b49", "comment": "Malware payload", "value": "5a3274dfe0adf791b831aaa6b85189df", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260084, "uuid": "db3c6daa-419f-4045-a1b0-b3e35a7b77c0", "comment": "Malware payload", "value": "075b62654b550de752d6b10b5abe94176c06bc792629d7d19880ad93c3ffc0a9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260084, "uuid": "28b40382-404f-4be1-a31f-56fcadb041ab", "comment": "Malware payload", "value": "bd0d6df080da1369b1a2899a2c603f6676678f4b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260084, "uuid": "7538702f-8697-4415-a214-eee51d18492c", "comment": "Malware payload", "value": "a38d7bbc0b2f54f04530158e7b9b8cca61801ce2f28d2cf174085de74e94c0746a0dc3f8f0e67ef96600a32a2d6c515a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260084, "uuid": "790335a7-ae8f-454e-bfe7-f3a514448b85", "value": "663302714BACD9F228B2E4AFC88BF904FFB1C455C4D786664AF871C8B6902459E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260084, "uuid": "d5d27870-265e-48c2-9913-5af6bdf5735a", "value": "1536:BjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX4U:lB9wzbqtWb08UscYJhnpjyq9qBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260084, "uuid": "9c29a3a5-25c2-4924-868c-2bdac050de06", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260084, "uuid": "7879026e-f61e-43f2-a718-6615337b861e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260084, "uuid": "ffad9535-02af-411c-b51c-d86a4d1f5e25", "value": "diagram-1560929568.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5db474e-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263292, "uuid": "163fd1e7-38a8-4ac9-b7e5-097099609e85", "comment": "Malware payload", "value": "69c02bb993cce746b6de927f3ca7caa3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263292, "uuid": "89ef4832-7035-44b4-a98a-469301a51810", "comment": "Malware payload", "value": "07637f7e36e43a36231ce889e132cc97cabc7e0bd5648895a945475999a7bec9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263292, "uuid": "106909d3-638a-48df-9834-f2c7d9b01ccc", "comment": "Malware payload", "value": "6c19ea948fc9cb44ad17d309a95ac959e0833c8d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263292, "uuid": "0ec964b4-c642-496f-938d-b9c6b3efbd44", "comment": "Malware payload", "value": "d1d223f17209d9a3bf2010180659eadc18299c1e3329705f8dac4b145f53b4466358d4c1c047b994cc0f0df58b919a64", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263292, "uuid": "9011b971-44ef-4dc1-876e-4e5110a8bcda", "value": "7133F1D09902F087D745BC49ECBA9D124F79E94A47BD74D3027AC0834E72EB5A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263292, "uuid": "08960d62-e95f-4574-b44f-8f53654f5f85", "value": "1536:fXXtg3K7774iXfEz5lnm/hQMOEYus1GpDkfv:fXma7774mfCyWMB/4GpDkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263292, "uuid": "a773c970-117a-4756-ab36-b520ddb0e281", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263292, "uuid": "17006dbb-6c31-4f9f-8e3a-7158fe8bcc63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263292, "uuid": "9ffa3d9a-166b-4fc5-a806-b0b7938dad24", "value": "statistic-1804551121.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ef6659-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263149, "uuid": "e825fa48-c330-4f1a-a8ca-bbb8239ad346", "comment": "Malware payload", "value": "e28b0d6976c5f9360019ba480be37f20", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263149, "uuid": "7e3134a8-e1ff-46ca-b576-ed7fb66b13db", "comment": "Malware payload", "value": "0772794b1196450d7f159b22b16d2f38eb133852b13621a95e08af67dcef243f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263149, "uuid": "71617d0c-36c4-475f-b250-6328cdc176e9", "comment": "Malware payload", "value": "506a9191b8b56eb764a3c9e50305452955ce8118", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263149, "uuid": "4f082b7e-494e-4cd3-b036-68ce222cbd98", "comment": "Malware payload", "value": "cb883d400b9415a761d3d82ea6d5faf59d07c3ae3ce650af4e80664792ea216563ee01756ab0ee739b205bab4304bb5a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263149, "uuid": "5f319f95-2a08-4d15-a5a6-651f681a38f0", "value": "E03302D0A501E08BA759B849DC7E5D535F7FDA1D033D7843013AC0875EA2EB5E349D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263149, "uuid": "2d48547a-8545-4882-b250-151a8c055e94", "value": "1536:1XXtg3K7774iXfEz5lnm/hQMOEYus1GpE/tz++a:RXma7774mfCyWMB/4GpAzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263149, "uuid": "786ecdcf-42a3-446d-9767-6835c4e5accd", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263149, "uuid": "541278ad-534c-4e9b-ba10-635e722c8f20", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263149, "uuid": "7eae3ff7-8d91-4661-a237-d27cbe24cbf0", "value": "statistic-1679144572.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b95f61c-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264724, "uuid": "ad018ea1-1769-47f4-a5a7-1185f3248df8", "comment": "Malware payload", "value": "2f3323d6252c5826c3c602f934628512", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264724, "uuid": "20e96d1d-49ab-4de7-84fa-8b55b25de4f0", "comment": "Malware payload", "value": "077dbfd3011d24aa07c1694f76a05f5247e64ebcd52f7dbd4ffccf66cde1a588", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264724, "uuid": "aa3975b9-2b5b-489a-acd5-c4a4604eb5c2", "comment": "Malware payload", "value": "03eb595ee08762d9071b6e811ac0f6b2d9642c2e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264724, "uuid": "658451f3-44c9-43fa-8e2e-97714d4d89de", "comment": "Malware payload", "value": "b450827de769b121fa32e131a7e6afd9f2ee42306a585ba077d5bedd5bde7442ee7ded3418c89edac6ddf862913fdcff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264724, "uuid": "d0bb98da-7dcd-4f79-936c-ab950b82fcee", "value": "5C33F2E4A507E087E349B81CDC6E5D038F3DE91E423E78D2122BC1D74E61AB6A145E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264724, "uuid": "97c8eaeb-5b67-4291-8f9c-c40b20a8f612", "value": "1536:+XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZSc:2Xma7774mfCyWMB/4GpWvZSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264724, "uuid": "d959fa04-b460-41c6-b423-90af8a32a455", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264724, "uuid": "33c03041-60ae-4528-9009-e6ec54c4b741", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264724, "uuid": "0d9a7abf-045c-43fd-a083-39726ecd29f1", "value": "statistic-917035079.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c229fa-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260612, "uuid": "ae4e2452-171b-4869-ab49-5c71f9cc94e5", "comment": "Malware payload", "value": "112fb7bf2cfe441ec7ea47550b16397e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260612, "uuid": "45fb30aa-115d-4d13-967b-85b5b4be9196", "comment": "Malware payload", "value": "0782885d9a9659cc34456fa058013b6cb4dfb91a261e96f9c186a8928c3c5efc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260612, "uuid": "27d48fc3-2a0d-436b-8c5b-8425b4a26a63", "comment": "Malware payload", "value": "dc9eec77fe27e0a4a8a2edcaedab92cbd507cc1a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260612, "uuid": "3a469df3-6047-43b7-9d9a-0e5109f25d72", "comment": "Malware payload", "value": "228cb776947cdf950ae0cabfde3241011356cf842063369058f68d6257e5d04be9fc81c6c8a3cf6e717f48bc33fcdf3f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260612, "uuid": "bef24810-41df-45f5-9c57-5f668f3adf34", "value": "3033F1724BFCCAF669B2D0AFC8CBF504FEB2C465C4C78A6149F871C9B6901459A22E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260612, "uuid": "3a565365-7ae2-4364-8711-f6d5bda3c7ee", "value": "1536:AjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXQi:gB9wzbqtWb08UscYJhnpjyq9qBQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260612, "uuid": "11c8353f-a59d-4cba-a84a-6a5afc4361fd", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260612, "uuid": "1ccb7915-fa37-4986-bb90-1c5b2b2c5f81", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260612, "uuid": "758fd25e-c3db-41b6-a895-9d140d2a01de", "value": "diagram-1920243326.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad55f8d-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259220, "uuid": "9c4f6d11-c19e-4481-80bf-0de8309e5fdb", "comment": "Malware payload", "value": "8afb43b3f27b2ec03bc1abba0db74b6f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259220, "uuid": "32572145-1e1e-4cbd-bc52-698fd7b9db45", "comment": "Malware payload", "value": "079e91e335a89aa68a03bdecbb9be495d9b479cc5696700420a32df4e22aa0ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259220, "uuid": "1b011f9c-b814-440c-9e37-afc7ffe77015", "comment": "Malware payload", "value": "a89795fbb708392c336d77b75436df7f716dea1f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259220, "uuid": "9b3609f8-82ac-4cb5-a0d8-aae2ebbc3458", "comment": "Malware payload", "value": "15d2cdcbe7efa9ddf7898bbaf2185961a071242fbc0d685ebb95a3c87126af2585390b27712e679a40baec88b6255555", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259220, "uuid": "322558a9-6a14-469c-9619-51498840e4ad", "value": "6333F184D164108DCF4FD2EB30F6FAECE5DEBF43099A68C09A6E2644D2920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259220, "uuid": "72d9bd30-da70-499b-a67b-5dc8327681f7", "value": "1536:C2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbOo:Hfqhp+g5ru2kmUEt88mAbOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259220, "uuid": "f3ea3006-7e9d-41b9-9a0b-43c2dee977b2", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259220, "uuid": "90e613f0-6725-4587-b42f-d6499ea193f0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259220, "uuid": "6e062289-be0e-442d-b2b3-15d282cc6f55", "value": "catalog-867723744.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b30e71-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264817, "uuid": "c5bf01df-5c37-4e7b-a6da-6ede4e59de85", "comment": "Malware payload", "value": "d975077fbf5f408f21371ad5ea093435", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264817, "uuid": "204ac5c6-4f0b-4598-941e-5784b7b46af8", "comment": "Malware payload", "value": "07a09471d382753eaa24e8d9c951fbfe0b199dadbc79f434108147a9dfe0b629", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264817, "uuid": "7738244c-99ae-40d3-994f-88062ae09ecc", "comment": "Malware payload", "value": "9aef2b94a5c38edfe061a1fbd9d2032c8a1ce289", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264817, "uuid": "042d15e9-c5d0-41ff-912f-5994c440bf04", "comment": "Malware payload", "value": "ab3f2a7a04ab5d9367698d3ebccb7f5d84532718c504f1e716064d0cf40e5c1db18ab4ade268c79f90bb4aa10d1933f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264817, "uuid": "19d42a82-a47f-4569-8736-645f663f7702", "value": "9F33F1D0A905B087E349BC4CDCAE9D134F7EED1F463EB992023AC0875E61AB96705D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264817, "uuid": "16ea9612-1376-4ac9-b503-e2ca737e0c74", "value": "1536:6XXtg3K7774iXfEz5lnm/hQMOEYus1GplItWA:aXma7774mfCyWMB/4GplDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264817, "uuid": "9ab71ddc-aa91-43fa-b2c3-c52830937ec7", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264817, "uuid": "37eebf9f-419e-45ed-8199-d8445695ee1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264817, "uuid": "b4980b57-c745-4e36-9e32-5ece46b92216", "value": "statistic-974178367.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5474bd7a-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263075, "uuid": "71851835-0257-4fa2-9685-bab7c611027f", "comment": "Malware payload", "value": "4b3f15a1e20e5a99a76a876fb0d6ac4b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263075, "uuid": "300a0a2c-1649-486d-83ad-ab063123e3ec", "comment": "Malware payload", "value": "07b05e4f87de5e4c82eef7f95f22d2b022414746055d16c4e1a84f4b4573133d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263075, "uuid": "b56e2ad9-881a-41f9-92e7-751c3ee294f5", "comment": "Malware payload", "value": "94335dacf6829447a0c364de0fdf86ad40dfd13d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263075, "uuid": "0c72ff15-f1e6-4dcb-81d7-cd7fea325e3c", "comment": "Malware payload", "value": "9ce41fecdbc7e4a54a36cd212f3c02cd968a947a38fa3fce06a21a8908b541d3c61e349ee65e5157739eb68a87b7e6b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263075, "uuid": "79726991-f745-4166-ac17-439dff86bed6", "value": "4933F1E0D901E086A754FC58DCBB9D038F39DE5A073DB852027EC0C75E62AB5B64AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263075, "uuid": "a771072d-830b-4604-bc66-d35d2cbfee29", "value": "1536:WXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOcC:+Xma7774mfCyWMB/4GpCOcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263075, "uuid": "691cc650-233e-4d88-8fa8-d984349c42e8", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263075, "uuid": "4b5e2932-1fe0-4140-b148-efae66f7a801", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263075, "uuid": "d9aa5be9-1f6d-4214-9c56-7d08fb34b911", "value": "statistic-1609603853.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e5de55-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260336, "uuid": "ef8e3527-9dc4-4782-bfca-ad8ae8a01869", "comment": "Malware payload", "value": "13c24f69510f5c706cbd2f08b4ac651d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260336, "uuid": "07cfa5b8-cf8d-42e7-8024-c583bc49c157", "comment": "Malware payload", "value": "07c2133e8b65eaf1e6be15aaad6fbef8d8d8f054a60a8875170641eedea0d4a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260336, "uuid": "61ac3efa-7dbd-4688-bb10-5a2e4acc9ffd", "comment": "Malware payload", "value": "d53113a0a94115d95613275a6c16c781e4d3834e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260336, "uuid": "610dd05e-f323-4189-abae-91109d78e5e6", "comment": "Malware payload", "value": "9bf135a9f0a7760b42f3dbf798848583db49fb2e20e84138cfc9f85b822c02becbae734d29e963777499921077593d50", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260336, "uuid": "14b99650-ed83-4262-af15-fd94132ec3f1", "value": "BE33F1710BACDAA62DB1E47FD58AF900FFF1C8A4D5EA861645F870C8B6D42558E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260336, "uuid": "54c029b2-ad5b-4f03-9b83-9795f3748ba5", "value": "1536:RjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67/4:VB9wzbqtWb08UscYJhnpjyq9qawQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260336, "uuid": "20804b7c-bab9-44ad-8594-d7200cb9a7e5", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260336, "uuid": "6b4f742d-4a6c-4749-b0c2-e3c2480ac64e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260336, "uuid": "cf84db29-4521-4a9d-9394-8c308b957ba0", "value": "diagram-1710512644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c70a346-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259625, "uuid": "0f25075d-18d2-4ace-9ff0-226b6d13449d", "comment": "Malware payload", "value": "e0575fdafd9392ffcb242bad56f01407", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259625, "uuid": "c2dd9c42-3a09-4262-bf27-8fff53c46698", "comment": "Malware payload", "value": "07cd5a9c569e55e30c6c8102be72cd84daa00a9216e322a95239dddd0f925c97", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259625, "uuid": "14b7249f-35b4-44e1-9d3d-8b0fdd4897a9", "comment": "Malware payload", "value": "6114afac798cac596f3534988e3d89a3d8a7062f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259625, "uuid": "4afe0b54-42fd-41b5-84fc-32bbf5884f5b", "comment": "Malware payload", "value": "4d3a2c26d05e77045fabb4c43dec96531b50fc9b59b8832b97d498ccfdf352c8ec656573fdc7d9cf3824fbd916265d3a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259625, "uuid": "7232001c-e4f5-4cd5-8b00-95c805bc315b", "value": "6C33F13647ECDEE62972D0BFC8CBF905FBB18465C4D78A2249E9B1C8B6D01855A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259625, "uuid": "d38455b7-d853-420d-a076-cda00fad8c3c", "value": "1536:5jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXgI:dB9wzbqtWb08UscYJhnpjyq9qBgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259625, "uuid": "82f84d0d-60e3-4163-8bbd-3e57e1f59661", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259625, "uuid": "57ec687d-9c28-4396-b228-4fda4ca373dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259625, "uuid": "21b9b44c-e7e4-40a8-92a1-6adf808f1c52", "value": "diagram-1198092970.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fb808d-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258373, "uuid": "4ab0d2ea-2382-4aee-bea9-f79b05f699e4", "comment": "Malware payload", "value": "73295e191dd27836597c862e17946763", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258373, "uuid": "2b1a2fd2-39bf-4b5d-8c87-c7860561dde6", "comment": "Malware payload", "value": "07ce155a49874b8ae8c926781e2fe3adbfdd21acd9aefc275d871f698cc53103", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258373, "uuid": "66b2d1ba-ce21-4033-8de7-e36f62d7a1b6", "comment": "Malware payload", "value": "f5fd037f414179bb3129d0d74a827812fad3939b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258373, "uuid": "197b8c75-b6c5-4fff-a6fa-0e37b7167728", "comment": "Malware payload", "value": "fafb7e91d1b2c99df41ec04b66e77285dc5837fccba88bb7f4ea2a68c4de17dc60d9cd97c6f1573ec7517dd928c3dd14", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258373, "uuid": "7c859651-d986-4fe3-9d3e-c92352ef763e", "value": "09330186D264214DCF4FD2A630F1FACCF5DE7A430DA9A4D0A67D2B0581931F0492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258373, "uuid": "a5548919-9553-4e17-a748-720fb47ba77c", "value": "1536:+2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3J:Dfqhp+g5ru2kmUEt88IxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258373, "uuid": "5819aa96-417d-42aa-b028-32194994959f", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258373, "uuid": "8a245abf-dda3-4284-9167-84a05e0920d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258373, "uuid": "82e041a9-9371-4629-8917-d4720a0bf93c", "value": "catalog-372602302.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a671fa-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263510, "uuid": "ee5c58ff-9e3b-4661-844b-6df9bf19c498", "comment": "Malware payload", "value": "113e2625a6ae15c5d637b25352448aaf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263510, "uuid": "75f18c95-8a9d-470a-9164-12df17d2438b", "comment": "Malware payload", "value": "07dc3140d25b66bcb6628bc34b10a44da027e562cab4329d699cf1ef07ded340", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263510, "uuid": "5c4cd634-ef56-4fa2-b832-4bf7c84d11df", "comment": "Malware payload", "value": "92dc7dbe3d6dcac63fa45e7b5d90714ac1aadd39", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263510, "uuid": "1f05a83e-c44e-4c86-a379-4f843cde47e3", "comment": "Malware payload", "value": "0f4725a36db539cc36ef61305c76c31566c3813e23905878a25ca6a53aff85ede9c25aa73a8922ec26c4af49b14f00fd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263510, "uuid": "a8f46d74-4d79-459c-a812-d5f2b66ff68b", "value": "CA33F2E49906F08B9B49FC18EC7E5A134F3DD90E427D78C2113AC0C79E91AB4A605E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263510, "uuid": "94d302d5-7d03-4d56-8969-fdb35a280cde", "value": "1536:SXXtg3K7774iXfEz5lnm/hQMOEYus1GpyunY:CXma7774mfCyWMB/4GpxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263510, "uuid": "e9fb588c-8597-46d2-a09a-12872e22b5cb", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263510, "uuid": "9d5b4ae7-6a6f-4123-912c-338c21b36cf2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263510, "uuid": "5740724e-ed04-442b-8e9a-00b2e54f35ff", "value": "statistic-1957871424.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5484b8-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260595, "uuid": "b39deee0-c38e-4749-8236-ec481ae88341", "comment": "Malware payload", "value": "d79fb90027be46c574c71e313d92f9ba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260595, "uuid": "568af61d-ca11-486b-a4e1-f35178a9fd55", "comment": "Malware payload", "value": "07edeb233bb50fe281e9eed2a2f3f7209b7e0b7215fbcd22cac3a15a95cd9d70", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260595, "uuid": "9ac1b177-f0c5-43ea-ad58-456f739f76f9", "comment": "Malware payload", "value": "1d167a7fb4ca30578864a8dd5a20ad31779e543f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260595, "uuid": "4e188f98-74ae-4426-b482-03d205bcf92b", "comment": "Malware payload", "value": "2e96c25c59b9e42a7e8175493a41366cffa816c7870d819e65a7f82669e841521d10acad39699cda846ed729adc7a7af", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260595, "uuid": "e3ecb72e-726d-4ed4-858e-6eacc8aedce6", "value": "0D33F1714BACD9F628B2E4AFC88BF504FFB1C495C4D786264AF871C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260595, "uuid": "83a2cb2b-b297-4da1-8ab0-64667aee627e", "value": "1536:wjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXF0:wB9wzbqtWb08UscYJhnpjyq9qBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260595, "uuid": "21f75748-454d-48bd-b64b-7a19e63fc07e", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260595, "uuid": "035e1227-1701-4bd6-8c42-5518f17032b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260595, "uuid": "a06084d0-b3bb-4cb2-ac7c-cd6979be66ff", "value": "diagram-1913714573.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15a7682-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256869, "uuid": "fa248e7e-6a22-4a28-bccc-a73a68e958df", "comment": "Malware payload", "value": "30402896f327421cad3716c136549b08", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256869, "uuid": "25f46ba2-0cb0-4ac9-93b1-8fa776dde7fc", "comment": "Malware payload", "value": "07fa6aa9caff06c8bea21c90d6176839935aae3cbd5084b070a8869c3bdf0f19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256869, "uuid": "f598204e-9f48-438d-849e-a324f9a4073b", "comment": "Malware payload", "value": "c885f5d085a703902ee3bb981aeadd43e3a4d50d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256869, "uuid": "029daecb-cd74-4e48-8fa2-a1b020fcc3b5", "comment": "Malware payload", "value": "b5e728a64c311a300b096c314ead98b812cfa6cfa81b996f084dbdd9f355e8f6dfddc96e1d0c98184b512d5be79c6b38", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256869, "uuid": "d792916e-6be9-43cb-a944-f5c530c536a0", "value": "2C33F1D6E654018DCD4BE2EF30BAEAD8E29EBA430D9DB4C0973D1605D1534F0482B68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256869, "uuid": "1e5f1bdf-0151-468e-8c4e-f8c7e1c0b586", "value": "1536:Y2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI08A:pfqhp+g5ru2kmUEt880L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256869, "uuid": "616647fa-84b3-4804-8847-5ae4745e6b0a", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256869, "uuid": "b5916536-0131-4ca4-9755-3abab9903ef3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256869, "uuid": "d578c54c-90f6-4de6-a102-5acd41bbeb13", "value": "catalog-1156529668.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d1490a-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259072, "uuid": "3dee4ad7-405b-4204-9c4f-e11dca8bc314", "comment": "Malware payload", "value": "b37a4a08b8f2adf196a20a4f92a2cce8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259072, "uuid": "9d065a86-7448-4dec-8d6f-c24a19b3bb27", "comment": "Malware payload", "value": "08104977db2bcc2158fe019a9356c7dcebbcc0cbd1a95a6193f9471ed2399b61", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259072, "uuid": "3090d335-b14b-42c5-9fcd-7d9c253cacef", "comment": "Malware payload", "value": "f43ab7f70ba0b9baee16917f8dc9222e38992fb2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259072, "uuid": "5a3e42f1-4398-4474-8a25-2b72b0a9a10c", "comment": "Malware payload", "value": "775616b54e350340e004b0780f7abdf7da324bd2223418013c63d9d220424c627d47cb0226eb55c6147dde58f9df34d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259072, "uuid": "6904dee2-4baf-48f7-b5ac-bab96ffa33fb", "value": "A533F151D645028DCE4BD3DB30B6F9DCE69EAE034A9D78D09A7D2B0490938F1892F19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259072, "uuid": "fdcbe851-6bda-4ac5-97dd-ac758e01f7f4", "value": "1536:y2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jId4Ri:Xfqhp+g5ru2kmUEt88Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259072, "uuid": "ace13e14-9b99-472f-957f-ecf04e92e4ed", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259072, "uuid": "75f43797-1d93-448b-9672-a8f1d687fe2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259072, "uuid": "fd46d24f-d791-47ac-8f71-3d090bcc56fd", "value": "catalog-780807628.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37fb761-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264603, "uuid": "3eb06ee1-f924-44ce-a4f3-62788f273eee", "comment": "Malware payload", "value": "1a59c631e526412961c54769e02b9929", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264603, "uuid": "8e674c2c-0c38-4908-8ab1-08dbaa0fc84d", "comment": "Malware payload", "value": "08169cf3c3e832b075f78a1de29a65ab9359ce9ac976ef5eab4f0811271574de", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264603, "uuid": "a2ddb177-de12-4acb-bc5a-463a68a6c0e8", "comment": "Malware payload", "value": "6c4d0073df8d8039813f60dda61fed8edfe782a6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264603, "uuid": "b27eae34-958a-4b3c-88de-dc3267245c60", "comment": "Malware payload", "value": "6f7b1cfc12aead3709233b8be64fc7b25f7db008cdca2e482a76d59de45cd2b757446b4c22e3e426df2e5c25febeb396", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264603, "uuid": "aae8bf1a-fa65-4595-a802-a820c2def716", "value": "F233F2F4A507E047A749B85CEC6A5D038F3DE91E423E78D2022BC1D74E61AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264603, "uuid": "f4b47b52-0dfb-4a30-b908-e06c3c15db67", "value": "1536:MXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ+S:oXma7774mfCyWMB/4GpWvZ+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264603, "uuid": "df8914eb-88d5-46dd-9684-4446b97ba8af", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264603, "uuid": "36153f32-c655-4583-86f0-bc8c5a144d78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264603, "uuid": "b5f7583f-f287-420b-86a7-121660201b68", "value": "statistic-846223248.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f6ef32-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257383, "uuid": "4d3306fb-c08f-4436-a870-7122aee2b8b1", "comment": "Malware payload", "value": "432512ea49282ac05e17f275779def3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257383, "uuid": "ff6857a6-ede9-435a-8139-64b34bf98033", "comment": "Malware payload", "value": "0818766d07e36c0adaf770504016102ce15f5e59f8900ca9bcd2b912d63c2865", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257383, "uuid": "decb0ae0-f02e-4a67-8c17-12bd9001b8e4", "comment": "Malware payload", "value": "f896b514b499ee9ecb5ff3d771627e1dc7baf44a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257383, "uuid": "fcaaa251-79c9-4468-bece-86522b1154cb", "comment": "Malware payload", "value": "be8586eebb0ad3f92100ea14517e7bb4dabd6cd0c1ab5606898ae50329480288116fee9b722594a63ac92c93eecf306a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257383, "uuid": "0e0824ac-7184-4721-aad3-65485d405026", "value": "7933F184D164108DCF4FD2EB30F2FAECE19EBF43099A68C09A6E2644D2920F54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257383, "uuid": "396bdcae-b0e2-408e-bc2d-eeca6c2f6d1c", "value": "1536:W2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAb+e:7fqhp+g5ru2kmUEt88mAb+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257383, "uuid": "c0651f6d-0676-4e4e-8ad2-1bb69e43fa4f", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257383, "uuid": "15904f5c-9815-4bfe-b5be-2629cac1c8aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257383, "uuid": "61282ffc-054d-4173-9198-c66876140445", "value": "catalog-154406584.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d950be6-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264352, "uuid": "2a53970a-7aa0-413c-8448-59ef3016443c", "comment": "Malware payload", "value": "51323e4aa819ff19f379095a7edda425", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264352, "uuid": "d1d281a8-d29c-41ca-a8d7-62bcf26afaf6", "comment": "Malware payload", "value": "08199d9902779c461fb0a7c0b6f91b189dd4477d3f08c38bc34e78503c10a809", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264352, "uuid": "b5499059-3fb8-4517-95aa-054665ac7112", "comment": "Malware payload", "value": "9ab4b87030a04295e37546e6412c96a1b3cf1587", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264352, "uuid": "7c23084d-f26d-4a16-97c9-089fdf26e14b", "comment": "Malware payload", "value": "04b1ef97e6c7e0cb054dad54393f2fe5d332b30512f5bbee3a1cdc45641987a28d38a3ef2511188720825a3a8c134e02", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264352, "uuid": "5f747411-0ad6-424e-8893-8c19b23c4dc3", "value": "BF33F2E4A507E047A349B85CEC6E9D038F3DD91E433E7892022BC1D74E61ABA6245E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264352, "uuid": "87b07c4b-6b1b-445d-b604-af1182e3215f", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZx4:bXma7774mfCyWMB/4GpWvZx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264352, "uuid": "4da2cc9d-cf2a-48d5-b6be-773bf59253c4", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264352, "uuid": "44a2836b-150d-4699-af8d-07798efb1fb9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264352, "uuid": "ab959614-2ffa-4fd2-8100-54b1b2479be4", "value": "statistic-662394365.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab5cbc1-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262280, "uuid": "3c66e6e4-42fe-40de-9cdc-2b8ac406cf0f", "comment": "Malware payload", "value": "5fd52423d0b54bb77d4e6696db2d1836", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262280, "uuid": "4c2fffc6-d531-46af-9eed-3c4f77af2019", "comment": "Malware payload", "value": "081e690ff957bf7849ab1c5b1d3c75c429214eca51372bda507f23d69ffff75b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262280, "uuid": "affdffcf-7211-4f56-ba3e-472ececabc60", "comment": "Malware payload", "value": "36050e1da99b04068c9db4b3310de1bc76bc55f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262280, "uuid": "46a298c0-fffb-40e8-83e3-7d5a7db42625", "comment": "Malware payload", "value": "cf70c85ff1d6cf084ba554e91266eb6aec5b02953aac5f1a9a3038d7d61b719623da931ba712818f9f8cc665cb77d5d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262280, "uuid": "63edb418-b86b-43e3-9176-de72fb3a326e", "value": "A93302E09502E047A358FC58DCABAD038F7DD95E473D7842027EC0879E72E75B24AD2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262280, "uuid": "0f66f6ac-fa6d-4cd5-9466-3805f9e3216e", "value": "1536:TXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOy5w:LXma7774mfCyWMB/4GpCOyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262280, "uuid": "d3b3810a-6a10-4e4b-83d1-fe13884b2da7", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262280, "uuid": "6663e858-def7-49a7-a416-0568c03acfc4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262280, "uuid": "97e2836b-0c95-4306-a03d-ec3676664bf2", "value": "statistic-1022643484.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d137ae9-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257157, "uuid": "9a2363ae-9883-4a9a-95e6-96403345541e", "comment": "Malware payload", "value": "e000c37a7ad0f28eefef0e76eb93a19e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257157, "uuid": "900030dc-ac59-466f-9e5f-2d81d577a9e3", "comment": "Malware payload", "value": "08250d132c05f84822bdc6c4c1d0d3c6ea895e772a91ec19240879925e850ff0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257157, "uuid": "736f00ec-1634-4264-9590-0d1a7b7b71ef", "comment": "Malware payload", "value": "ba065fe8f3866835728ec51b273240b597255be4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257157, "uuid": "f2043829-f9a7-4e29-9f64-5e95e05cd051", "comment": "Malware payload", "value": "e9f8ec8d8feda5c58742543dce9dac2a4a5b14367a0f7e906d2dc9aaf1ead2a21e28f59814d0605cb083fecbf733a16d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257157, "uuid": "c072b60e-94b9-434d-9f7e-63fccf379c9c", "value": "6833F184D164108DCF4FD2EB30F6FAECE1DE7F43099A68C09A6E2A44D2520E54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257157, "uuid": "a40998f2-a0a2-4105-afc0-f66a7cd4f1e1", "value": "1536:N2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbaV:ofqhp+g5ru2kmUEt88mAbaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257157, "uuid": "1b91c533-6b32-47eb-8075-170d343b01e4", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257157, "uuid": "4bfa1d71-59df-40b3-af30-d74234a2e2b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257157, "uuid": "b19f33bd-9ac8-431c-9364-32888136b5f8", "value": "catalog-1398214905.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abfbe97-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262978, "uuid": "e4fde95d-254c-481a-87a5-bead2be8a782", "comment": "Malware payload", "value": "d8af0b346f2e2421e2b83afee6e17331", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262978, "uuid": "7ba9076f-492e-4945-a952-11841dcd5493", "comment": "Malware payload", "value": "084c287e86739d2a42d5789b82752e82962727cf91460de02da4be62a88e93fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262978, "uuid": "608ade56-96d0-4105-8dc4-a1bb6dc30538", "comment": "Malware payload", "value": "7e89ed1c348571fab2bd18d9693e6c4ebb6bb45c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262978, "uuid": "9850ec00-f9e8-43fd-bcea-650bbfe5a996", "comment": "Malware payload", "value": "5006db05d7afbf23b0fce9b9fa39fe114de0e3e5842c483517760474d0d01063fb165c0235fe5cfea4f12140e2f51365", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262978, "uuid": "be26ba3e-d665-4bf5-b71f-afbfe5f3b365", "value": "D633F2A0D502E047A358FC58DCAA9D038F79EA5E477D7843027EC0879E72EB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262978, "uuid": "5d648105-16be-43cf-bc2b-fb8574452d19", "value": "1536:vXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOu5W:PXma7774mfCyWMB/4GpCOuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262978, "uuid": "025a90f4-0be1-4c92-8e72-ab088572cbd5", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262978, "uuid": "42fa41e1-59f4-42a2-9a20-d0e48f86383d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262978, "uuid": "1a6e4147-0a5b-4169-809e-1cc7439278f4", "value": "statistic-1532053058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05de9523-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261225, "uuid": "96e2cdc7-14a8-4037-9db2-8e4df6befaea", "comment": "Malware payload", "value": "554af2674b04c62201c4a57bdb8f824d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261225, "uuid": "860c1135-1894-4e91-975e-665f03d18884", "comment": "Malware payload", "value": "0862c43e6cb1a30004aa6ed3664e95ea192b6073187efda8c5679eb38a5fa850", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261225, "uuid": "618c2b17-b1bf-4b9d-8306-d9937875d786", "comment": "Malware payload", "value": "c3c5cdebda0ecdfaf8d5102b2bd6ffe9f45ffd33", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261225, "uuid": "833cbc3c-543c-4610-9600-14b38c552fe5", "comment": "Malware payload", "value": "20d6b0b92beaf7afccf114c3453bdf4eeec2ccc5770a5611129ccad4af6bb554d2a6bfd1442471fe770a2b8f2c0f4bf0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261225, "uuid": "07cfae6f-3fc9-4891-8af6-1a76beb89bc6", "value": "0933F17547DCCAA76C72E1BFC4C6F845BFB29821C897872249F9B1C8B5E12564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261225, "uuid": "ca6d4760-dabd-43b7-9adc-0fa9e1430e0b", "value": "1536:1jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wL:RB9wzbqtWb08UscYJhnpjyq9qEK0wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261225, "uuid": "35623f9a-470a-46e5-a58a-681257d1e30d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261225, "uuid": "8ff82a08-d649-40ea-b1bc-0095bf07ed7b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261225, "uuid": "bffd192b-9f6a-43d3-b86f-4bb84ece40f6", "value": "diagram-41884069.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897b6d1e-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262305, "uuid": "b59d56f7-634c-4fd9-9a8d-a9ffff9bd371", "comment": "Malware payload", "value": "2ffcaf0a8089dab47706ff6abc82ab3d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262305, "uuid": "6675cd32-f6e4-4c5b-baf3-d3c9bc14d487", "comment": "Malware payload", "value": "08659051a80e5479b58ecd1d42f9ce506077e96f5fc385bb4f852063aee86004", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262305, "uuid": "79b13ff2-5daa-4e7f-bf04-91eea815dae3", "comment": "Malware payload", "value": "6918cdb87de4eca1db852a62096b21246275ba55", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262305, "uuid": "e209bf6b-395e-4d50-80c4-66689adcd622", "comment": "Malware payload", "value": "334725d7e2f4a93eb85506242c69d8ae7834bb462fbbeff5b4565b9da3bfed8012427ba94300e6ca4aec630ba79f1b99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262305, "uuid": "8977e73b-dc75-4caf-8a93-0e560de09fcd", "value": "C133F2E4A507E0479749B81CDC6E5D038F3DDD2E433E78D2022BC1975E61AB66245E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262305, "uuid": "3d354313-2b09-4ab3-a6ba-6a41984fbe21", "value": "1536:FXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZVW:BXma7774mfCyWMB/4GpWvZVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262305, "uuid": "5c6a0c24-2643-49df-916b-08867405e5ab", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262305, "uuid": "02a61178-95e0-44dc-bf3b-649445738323", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262305, "uuid": "78fc26b6-6e76-429b-adc8-37b8f953097d", "value": "statistic-1044829354.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f95665a-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264275, "uuid": "32fd5839-d197-4a0a-a813-123fe156034f", "comment": "Malware payload", "value": "440766ea72e61a2075adabf18331206b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264275, "uuid": "9ced97cc-55e5-446d-a72d-9e4cb4accc50", "comment": "Malware payload", "value": "0868fbc3265695a7034f0f5b54cb9137205ff0a85d0799a42ef9f8957b5aeefb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264275, "uuid": "fd643d9f-2b87-42bf-9424-437c49e2f865", "comment": "Malware payload", "value": "8f0abf4b55ddfa94bbc323406357a3e33cb37645", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264275, "uuid": "b0892f77-fe0c-4b5b-bba7-15039bd638b6", "comment": "Malware payload", "value": "176696727c7bef93519c2bc52a5660a02776b505621304c7d933e6edf987bc4937fb3a544647c11242e4948bb4d9df1c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264275, "uuid": "e074f21a-32d5-4dac-bada-3c8002b7db72", "value": "3433F2E4A507E087E749BC1CDC6E5D038F3DE91E433E7892022BC1974E61AB6A245E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264275, "uuid": "0668b5b0-71e8-4920-8b3f-7e27ab90d6f3", "value": "1536:0XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZl4:AXma7774mfCyWMB/4GpWvZl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264275, "uuid": "113cb0fd-6873-4ee5-b556-2fdb50448cc2", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264275, "uuid": "3aae6411-f0d3-4832-981e-045204373b3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264275, "uuid": "e3343e44-99f5-43e8-a84d-ccdf82da62c6", "value": "statistic-597325065.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7b3254-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263330, "uuid": "b8d5817c-c92a-49f2-a8ea-13004e110522", "comment": "Malware payload", "value": "db410e2531b220e4e9178f550c28a2ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263330, "uuid": "e788a7b4-d0ba-4ac5-8464-be7ba1db4e0f", "comment": "Malware payload", "value": "0881a97b3681ff9dee723d634e28c5954438a6291bd4794c2a53929bab141b8d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263330, "uuid": "4c0064bb-8f1d-412f-80de-aeef52ee477f", "comment": "Malware payload", "value": "45abbb022271e0a3f788fc64718516bae331d3d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263330, "uuid": "85ecc0a5-1cb9-4471-90ed-c7b7fd28dde0", "comment": "Malware payload", "value": "4ba1d9e48731adff8eb9e453617513db82b4112266f486f03015c73aa5960f3d218a7807ae10a199dc3375a01fb663b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263330, "uuid": "cbbdf9c4-970d-4790-a732-c3519d3b97a9", "value": "C13302E49507E0479748BC2DEC5A9D438F3DED1E033E78D2122BC1975E62ABAA245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263330, "uuid": "63777ea0-2f0c-4091-9ddb-377a27ec8954", "value": "1536:9XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZc:pXma7774mfCyWMB/4GpWvZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263330, "uuid": "029b6328-bc9a-4a3d-9f32-08cc72ffc6ca", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263330, "uuid": "705f00dc-721f-49c6-b6b0-707436750593", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263330, "uuid": "45ded51a-9652-464e-bb4a-42b04474f1d1", "value": "statistic-182653315.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf402ee1-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260677, "uuid": "6a52e94b-29e3-42f1-845b-02bc406d9df9", "comment": "Malware payload", "value": "a4072b5b37a828dd0e723aa4e995bd16", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260677, "uuid": "a9263114-a90d-4900-bb83-8b99c1fa89d3", "comment": "Malware payload", "value": "0887dbb70a70e749c02cc342f3529a255273f6e98a08bae64f1fa20f46729a5a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260677, "uuid": "770bb82f-96b4-450f-8ccc-95539baf9e20", "comment": "Malware payload", "value": "95e283f96f73763bd7be4f5028dcc111872edf8c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260677, "uuid": "64e50b77-9363-4e27-af8a-605a5e14e4da", "comment": "Malware payload", "value": "4b575a7b562b3d1aa7db19fdaab34ab751d3ebe2a03e4df6a8e0230460291d0183813e8291367767ccc41f2342edb690", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260677, "uuid": "45f6792f-063a-49f0-8663-58114c2c0a9c", "value": "BC33F1714BACD9F628B2E4AFC8CBF504FFB1C455C4D7862649F871C8B6941559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260677, "uuid": "4f5c66d1-2b6b-4a47-bf78-982f419ea3ae", "value": "1536:ejfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXPO:WB9wzbqtWb08UscYJhnpjyq9qBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260677, "uuid": "3cf48b08-8f94-4826-8c0b-d08b5a97891d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260677, "uuid": "7d783fa8-5a41-4230-817b-102afb5bdc3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260677, "uuid": "e82aa99b-9f0b-4e13-8980-991c3ec58e9d", "value": "diagram-196419239.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342e20a4-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258296, "uuid": "274c614a-dedd-4091-811a-4c5c2a6d99f6", "comment": "Malware payload", "value": "a7cfad040fdfea7f98a5035721ca1726", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258296, "uuid": "d6d39deb-e21f-4fb5-9c77-65e18ffef13d", "comment": "Malware payload", "value": "088f86d71b87d992a4b59d4feb5e8dde45c937bb487182d5dd479ca0d6c4c149", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258296, "uuid": "3ce8221c-3293-48a4-8758-f42baaba81d0", "comment": "Malware payload", "value": "78afb18a1dac1f7d0d34fe8cfd88b9a306b0d7a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258296, "uuid": "4bd23963-7604-4f44-8087-09f1dc743938", "comment": "Malware payload", "value": "8d1d4455a8cd8f91efc6c3fdf53b4f65b1d9ed4e58c37cd0c1f02cf9be1c3c5c4508d5c3afd9e0b8750238c12a2c1ee4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258296, "uuid": "0cddaed1-8feb-46f1-a44a-308596973667", "value": "903302509554028E8E4BE3DF20F6FAECE2DEBE03099974D09F7E1A0491A30F5492E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258296, "uuid": "af3d4c2f-e0e7-467b-9be0-0b37bf58bd5f", "value": "1536:A2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIiMJ:xfqhp+g5ru2kmUEt88ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258296, "uuid": "04bbcbc9-8272-40da-b9e7-bbc19fe698cb", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258296, "uuid": "850e3905-52c3-481a-b1a4-c968a27d5edf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258296, "uuid": "43d6604e-4c32-4c1d-a940-b9d331487924", "value": "catalog-304849207.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9d062d-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263812, "uuid": "87e67563-7804-4993-b316-d67d66f62bf8", "comment": "Malware payload", "value": "aa2e802784725aec3540d261a6ea429d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263812, "uuid": "1d1ca471-d9bd-4b20-88ab-039db911c12f", "comment": "Malware payload", "value": "08ae6e462a2e063d32a52be64b430f79f56b41035dccc2c67a79508509f8cf23", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263812, "uuid": "2b154ad3-55fe-4c89-ac02-f92e25efb7a2", "comment": "Malware payload", "value": "8dc237ca06f134f57e2104096d1abc072e4ab439", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263812, "uuid": "6588e08e-fc6e-444c-9ca5-c7edbcd37aed", "comment": "Malware payload", "value": "65706a0b52788cf692476511caf7427f5dc56bd5bf8d9f481d5d844d64465b1d631b3c3f116cdbd3c8c6ac233802570c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263812, "uuid": "da09105e-8fc7-4728-adc5-136499f8237f", "value": "C23302E49507E0479749BC2DEC5B9D038F3CE91E033E78D2122BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263812, "uuid": "1b2a516f-01a3-4d44-a5c6-cd6e2ddeed4d", "value": "1536:VXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZO:xXma7774mfCyWMB/4GpWvZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263812, "uuid": "9f707058-702e-47c1-b276-26a9f2247116", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263812, "uuid": "c6c75102-8665-4206-9a0d-96d0172a7e99", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263812, "uuid": "bdff577b-e0ca-48e5-9adc-57658c9439bf", "value": "statistic-266787692.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9696d861-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621256743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256743, "uuid": "cfbd1029-96a5-43a3-9a93-fb1a694b475f", "comment": "Malware payload (Dridex)", "value": "3bbda45738ca94eb1abe3763c6e795e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256743, "uuid": "629d237f-f426-4261-b102-6e1de4e03ce6", "comment": "Malware payload (Dridex)", "value": "08ce401350f0f972deaa9993713a68f2439769c8dd0b5267a2736c75bdb0c7fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256743, "uuid": "a18cb34e-c121-4fd8-8ec9-0cef56c15f6f", "comment": "Malware payload (Dridex)", "value": "8c861960cb132c40330b6e4eda0e98af4e82670b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256743, "uuid": "95a4fab0-6460-48ad-bc78-cc2288be9e43", "comment": "Malware payload (Dridex)", "value": "caa6658516c53b0c4aaa79f2440d661f0572d14c688faaaa51fb2e66bb9bbfff08d91acbd82b6eb7ac38f86f52726114", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256743, "uuid": "a6774f32-8030-4909-b247-19ba6e448d7e", "value": "94F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256743, "uuid": "e368aa01-f3db-48ae-89da-bb83452c7d96", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256743, "uuid": "b0d75965-34fd-45a0-be38-bbe2bac19a64", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256743, "uuid": "45fcd728-a52f-42aa-b959-97d102167d5d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256743, "uuid": "222db274-ba5b-461c-ae40-ebfa9b172ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256743, "uuid": "27aa3c2b-6dbd-4c13-9aac-4358fe454c65", "value": "3bbda457_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14aacb4d-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261679, "uuid": "1864de51-7612-4828-a202-8a79e5023958", "comment": "Malware payload", "value": "31fb560f80d0f4c031a2c161eae2f3fd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261679, "uuid": "b7934e1b-f8cf-4863-8155-9ef2941276a3", "comment": "Malware payload", "value": "08efa94322b8389686df86dbe629be99cba0a95ba72f6b6786455b4980105f10", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261679, "uuid": "3d729f71-2e1d-4bc3-8b6f-8fc3a11e681a", "comment": "Malware payload", "value": "de2800c45d48ad71fc7b4589ab423636ee087350", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261679, "uuid": "4b640c57-1dc3-429f-bf96-6ad86bf7e233", "comment": "Malware payload", "value": "2561d83f373a448762ffa69c9ae805cf0ca8f7dc84598b33addd6d518586c1c72ad3605d06b9dc34cd7ea4431888f6f1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261679, "uuid": "7e4ac888-74a2-48c9-a432-7ac169397c1b", "value": "113302714BACD9F628B2E0AFC8CBF504FFB1C455C4D7866649F8B1C8B6941555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261679, "uuid": "a08df741-b8d8-43ac-b254-c6f6bb5b93d6", "value": "1536:NjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXNNY:JB9wzbqtWb08UscYJhnpjyq9qBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261679, "uuid": "a474229d-dbf4-4e1e-857d-6bd81c8f858d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261679, "uuid": "55adde4f-3b4f-45a6-8fb0-9dba606cb40d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261679, "uuid": "ddc5c280-8722-4212-9cb0-6c5d15793e40", "value": "diagram-716805382.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34eefb2c-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260875, "uuid": "c0e0c44f-0221-4993-b898-3d41bb58465a", "comment": "Malware payload", "value": "67ebd7da13d372b49cd1876eb3697dd9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260875, "uuid": "218ba3db-ca2e-42f1-980b-07a94077d60c", "comment": "Malware payload", "value": "0901896d2acb05b087f85f4caa97dd784936524a360d6ffeeaf8d1a16f66463b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260875, "uuid": "6612b06c-05a0-4c52-b923-22c6804843ef", "comment": "Malware payload", "value": "74bcb75ac741592f43ce4f782a764bb21d9869c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260875, "uuid": "1778c09e-0f15-4421-ac98-9cdd3b7bbb34", "comment": "Malware payload", "value": "f6001905b633b019f04c32889b92791aa68c7182e899a858e6bec4fee5871656b188ad8eaa24f61b7f4ba0e49f70c802", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260875, "uuid": "3d9ef039-11d3-4b09-988f-754ccc3fbcb0", "value": "C433F17187ACDAF668B2E4BFD8C6F904FBB1D499C4D7862246F871C8B6D11544E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260875, "uuid": "05402123-0ccf-4d2c-ad5d-89d79c6f793c", "value": "1536:MjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXjx:0B9wzbqtWb08UscYJhnpjyq9qBjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260875, "uuid": "3c81043e-f54f-47f4-a414-1b1f8394fb29", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260875, "uuid": "cffe71f2-8ece-441e-b9ad-99656944e47d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260875, "uuid": "b27557e9-1e55-492f-9663-c9ca259fb1fb", "value": "diagram-2123293131.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd70899c-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259412, "uuid": "9a19fa95-96b0-4dc5-8ed3-80696753da0e", "comment": "Malware payload", "value": "5c84af025e8b571d25a6e204c9cac67a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259412, "uuid": "26d52662-9cb7-49eb-a7aa-cc788c32327e", "comment": "Malware payload", "value": "09098935fdd6dc756983a3ba8121102e910e11b0a979fbab8b6dc204caceb1d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259412, "uuid": "2e067bf7-c4ba-427c-95b7-6edeab2316a3", "comment": "Malware payload", "value": "22a163ec7224ffad5e7b6fa05f1e36a99baf3dbe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259412, "uuid": "a5f184e7-ff08-471c-b86b-ee17f6cdcb0d", "comment": "Malware payload", "value": "ecbaa221302af9e4064ad86f0c9d85b69263487ea0dd928fb832d37165d91a184485f46acade203ff27efade8399880b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259412, "uuid": "24fe0e1c-99d1-46ce-9a60-acd6e6cb640b", "value": "9E3302314BECDAF629B5E0AFC8C6F604FBB1D495C4D3862649F9B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259412, "uuid": "56bab83a-2a51-4276-94b7-8daaadcd28bc", "value": "1536:vjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXBI:LB9wzbqtWb08UscYJhnpjyq9qBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259412, "uuid": "c7bdc444-1a95-48bf-aca5-6e030a258539", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259412, "uuid": "ae23fb72-6b97-44c1-b848-fa27c4b0bf54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259412, "uuid": "2ca19173-3008-45bf-a0e4-7d4dc2a11e3e", "value": "diagram-1047356465.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e2c1b6-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262888, "uuid": "b8443510-921f-46c8-a6e3-54ae21415126", "comment": "Malware payload", "value": "54bb4c4cc0a2c9ec1bbd6dcd2be5635f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262888, "uuid": "50ef033d-80d0-4f8c-bcea-c71739838ecc", "comment": "Malware payload", "value": "091e1e1f5ef5477589f7c182a5bd0a93c3ed4b2634fd3973f124887717ac38e6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262888, "uuid": "8dd3cbbe-87f0-4163-80e9-8cbc402a0a2a", "comment": "Malware payload", "value": "010bb6e94dca328303c2b8b975b5c8408438bd68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262888, "uuid": "179fa3c9-efb2-4199-9828-98cd9bb6f46c", "comment": "Malware payload", "value": "61ebfc311b37b586106fa86da4a55e6f42087bc7d20d807aa1d7c0a58084a89b45231f9c3a1a76fbf6086c06f8b3719b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262888, "uuid": "23362059-42f5-4b3a-8cfa-245344cf7539", "value": "D033F1D0A902F0879745BC49ECBA9D124F79E94A47BD74D3027AC0834E72EB5A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262888, "uuid": "010a57e1-6218-405d-8f92-6b10003be2b6", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1GpDk+Q:6Xma7774mfCyWMB/4GpDk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262888, "uuid": "7e19dd57-871f-4845-9820-446e90013615", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262888, "uuid": "e7abfa79-de14-4298-aca8-6b7abcfd8d93", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262888, "uuid": "0a7c67fb-1851-4e15-bc5c-5e6c82f50106", "value": "statistic-1478209999.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c771b2-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258351, "uuid": "5231f1b1-3f16-41e2-b170-05cfd4613caf", "comment": "Malware payload", "value": "50595a0dddb5f80ace0321bd886a16e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258351, "uuid": "cf92b759-da1c-437a-a955-516180857203", "comment": "Malware payload", "value": "092a3f6688a25555abcfea0ad2f360c6a9afac9920bbec499af896ff6bed1664", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258351, "uuid": "aa9b0d2a-d46f-4d81-ab93-f804e5bd739c", "comment": "Malware payload", "value": "07486bf2f9f8b28ede7f15bd8d126d69e9c6e1d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258351, "uuid": "90b9df5f-1422-4b3b-955a-8e00f1dc00ff", "comment": "Malware payload", "value": "370791d4c2c4d155e650a725e6841194754f2fbbab8eb268f7372862e9252e5c4e73a5082905a1c156d2897077a4b67f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258351, "uuid": "604088b6-8de6-4068-bcde-7aef01bb0041", "value": "3A33F1469215118CCE4BE1EB30B7FAD8E6DD6A430EA9B4D09B7D2745C1A30F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258351, "uuid": "8c887b46-ae5b-4906-9dd3-1852fa5e8d6b", "value": "1536:J2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuaS8:Ufqhp+g5ru2kmUEt88AlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258351, "uuid": "7928991a-509e-49b4-a0a9-d4f764b8680c", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258351, "uuid": "2f21ef43-bf18-4962-824d-78be353480a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258351, "uuid": "0abe42f6-b868-4598-89f8-e1634d48461d", "value": "catalog-347506311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9821b1ff-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258034, "uuid": "8e25e864-c3e3-43eb-99e3-ecae49732107", "comment": "Malware payload", "value": "51e18ff643cf803ab39696daf4e9a5f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258034, "uuid": "9edcc82a-f1ad-4d8a-b55f-b4d6f86ccd96", "comment": "Malware payload", "value": "093a7b07cdb85e96d2bd813304603f89f1b1a9c4ac9297a8e946beb292b8aed1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258034, "uuid": "04cc3a21-2bb7-4277-b577-dcc43124ce1a", "comment": "Malware payload", "value": "59417def11e44ef2669bed8d221bf00c6dd0f645", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258034, "uuid": "1af37cd5-3d8f-4454-b850-ad8d354234d3", "comment": "Malware payload", "value": "beab5e35dd54ca8f1c97275eb8c27143af9b61367b7a4b0cd9adfe27517182c0ce540c1d27bc2ebcf5833252333050ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258034, "uuid": "e626079f-6b40-4549-bf05-042051e49c8f", "value": "8A33F19195541189CF4FE2EB70F5FADCD68E7D130DA978C06F6E2B4581830B5092F58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258034, "uuid": "5927b187-e2ef-4ed2-8ac2-ff9c94b7de82", "value": "1536:J2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIh1p:Ufqhp+g5ru2kmUEt88h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258034, "uuid": "2c582461-54c6-48ad-b27c-24b57679697d", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258034, "uuid": "a2930aea-423f-4092-975d-43b9d0d97637", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258034, "uuid": "90808ec3-b610-4c74-9ddf-5bf5a58c485f", "value": "catalog-2057172171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8bcd91-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258203, "uuid": "2a7f8a9e-cc5e-4631-8630-41f3a4925b89", "comment": "Malware payload", "value": "d175f8c2ac56eb90efeae9b746a576ed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258203, "uuid": "7623af69-ff94-42de-87d1-5baf4ace44e3", "comment": "Malware payload", "value": "094790ef9b9d6b53652f0b28496b78d96f00f9703580bf84640150090f4f1500", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258203, "uuid": "de37fb90-5146-4c96-b2d4-ebbbdc6b1675", "comment": "Malware payload", "value": "0803997f83bac261acb02d4db9b7364d6fa918b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258203, "uuid": "3ec51334-b372-4543-beaf-bd73e3be7bc1", "comment": "Malware payload", "value": "c666aec1c6705b5dc8b67053f92c2c8c04a357f572b8246d091e9b4b647b1743ea322d6e6d263f2dcaa3d136bb64dd9c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258203, "uuid": "490fc43d-cdec-4fb6-a869-5d9cfc35179c", "value": "EC33F194D164108DCF4FE2EB70F2FAECE19E7F43099A68C09A6E2644D2920F54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258203, "uuid": "b280cfef-e83d-469b-ab17-e4ed277f4474", "value": "1536:k2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbag:Vfqhp+g5ru2kmUEt88mAbag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258203, "uuid": "3c16ea71-00b7-4c7d-a5c4-0c00187ea2d4", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258203, "uuid": "c1950138-3c0e-4cd7-a5cc-2de85791ad5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258203, "uuid": "10f996db-fa9a-493d-aa6f-5f314c4967bb", "value": "catalog-247833381.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c387ca83-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262832, "uuid": "c8231ed0-c6eb-4036-aa30-91af5fceaf97", "comment": "Malware payload", "value": "40a8a22044e50a273fe69669b0efadb5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262832, "uuid": "86e237e0-de71-4772-acd8-3b44061563ee", "comment": "Malware payload", "value": "0960d65e05ddef4f995a7560544be483acb80bc033d7c4ece7e83a54975a56c9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262832, "uuid": "db4c4b22-88a8-43bd-982b-92da86fd7f9d", "comment": "Malware payload", "value": "441c3936a60db281faf1276931631153186a5ea9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262832, "uuid": "e3be5b13-d6de-4737-bd1b-da1fa86e5ca2", "comment": "Malware payload", "value": "8e20fc1fe465b39fad315af5c300b3c194c841b820ff805b0666a5becf85d11158f9acd85aa0109f8d39cc0db103c86d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262832, "uuid": "078cb811-ba1b-4710-b409-503d1c785f85", "value": "4B330290A805E08BA359BC5CDCFE5E034F7DED5A037D78920136C04B5E62AB5A74AD39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262832, "uuid": "b89a045b-7c7c-41aa-bd74-0f24a31847f7", "value": "1536:GXXtg3K7774iXfEz5lnm/hQMOEYus1GpIz:OXma7774mfCyWMB/4Gpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262832, "uuid": "e3fe0829-31ba-4015-88dc-b29d8198877a", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262832, "uuid": "3fdbe7ea-e0d2-46f7-8950-94ce18674c20", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262832, "uuid": "59d0d99d-2da4-4f0a-982e-a83e75482f4a", "value": "statistic-1446896474.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cab01b-b6de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621235031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621235031, "uuid": "01b5dd81-2dc1-487d-b7c2-b4f8a8aef594", "comment": "Malware payload (Dridex)", "value": "9ecc27d783664857b4a5baa94b8e1721", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621235031, "uuid": "e4bb9b5b-d651-467a-b967-2b7f0e80c815", "comment": "Malware payload (Dridex)", "value": "097081f03b11c366d323df54eabb668dd262e8d5d8835dce5d2fd47915b514ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621235031, "uuid": "b6151926-c2a7-4d40-9ee1-fdbf1e31851d", "comment": "Malware payload (Dridex)", "value": "08925d0d056a0122bf11ebe52aace3a7d703bed4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621235031, "uuid": "8a647750-4cd6-4896-8220-37e13be6382a", "comment": "Malware payload (Dridex)", "value": "09a3265b25a1bab6439057841e6ec6bec58bc5b7e3d230bad5c141d1c4645ff22c636b30be52ef622361a9ac11ff0c83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621235031, "uuid": "f8905679-701d-4692-b355-f515dd75960d", "value": "BAF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621235031, "uuid": "2df84a81-6181-4157-bf62-ca9f91ba3e4a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621235031, "uuid": "c7b23c79-9203-4bb5-87e9-3673eb11dff9", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621235031, "uuid": "aef3bb4f-294d-47b5-b59f-bbe1071e4ece", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621235031, "uuid": "36b31057-15c2-4391-8dc0-62dfce5a499d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621235031, "uuid": "65f0d717-c39f-41bc-8327-80bfb394badc", "value": "9ecc27d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f9ed72-b6d5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621231479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621231479, "uuid": "fe699401-c181-4141-b431-8ddb10304bbf", "comment": "Malware payload", "value": "21423f5fffa94f593d5b299557cf2e6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621231479, "uuid": "f05b0dc2-6011-415b-be41-d5c2e4b3ff2b", "comment": "Malware payload", "value": "097ad0570e308cd7d53aa759a1ab8a75bfef28a82f213951d98fe934d66edaf9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621231479, "uuid": "ff88f2d1-d55c-4f85-a1d7-9c0f492d1883", "comment": "Malware payload", "value": "816371df786da7af241b1151f8c77d5c849b7f45", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621231479, "uuid": "90240b19-1092-41bd-bdc2-a69a60d923d6", "comment": "Malware payload", "value": "14361ba8f8588f267096846b037db4f7c8cd84080b5599b66270845a664c9c27fde7115cd48c62621e2f6aa17ee9d108", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621231479, "uuid": "91e0db5e-b43a-4e62-8481-c8722488f8e3", "value": "77B423406C7ACD7A8DE12F89E72B24429E9024C677FE77FB5221944D070FF38D859A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621231479, "uuid": "e0f5d84f-0ff1-4650-8605-f082c333adb9", "value": "12288:HbZFE82YrnCqWdUftYfJZjC26jdhBxDIglEj9JMo+ao:Hb/52YrCqYIYfvj2BNIgujH0ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621231479, "uuid": "428a0012-123d-4805-bff8-70af72fdc090", "value": 505728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621231479, "uuid": "d64ab970-2393-4d11-8159-49fdc8ce3e34", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621231479, "uuid": "3e28eb71-5586-4f86-90b8-8efd68ad0c35", "value": "DHLXShipmentXDocumentXBL,INV.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7f1a83-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257503, "uuid": "2e9010fd-f2a2-4d34-ae1a-1f32e9d28be5", "comment": "Malware payload", "value": "183f1148a335bbdae2597e0cdddaa0a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257503, "uuid": "fda6ccde-3476-4985-a273-fa880b2197c0", "comment": "Malware payload", "value": "097aeef8764ecebff244f4163bcd58edf415c1b87fb42e81645af7b2a0898397", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257503, "uuid": "89cebf76-6940-4076-9045-2d932dd396e5", "comment": "Malware payload", "value": "71e9b0ef2207a7a61431684244086be7a6222f89", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257503, "uuid": "44cf399a-7102-454c-bbaa-98ba4cc8d8c0", "comment": "Malware payload", "value": "4bf315b8f0f884de3f99662f415cff6e4b059c27d3ab42386c49d1ef9b4202d5015f10497e590edd5c241989cd259e66", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257503, "uuid": "48d07444-0987-46a7-a8eb-bdb274c58a44", "value": "C7330196E648114ECE4EE29A30F6E9DCE29E7B430DE6B8D09B2E1705C1970F5082E15B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257503, "uuid": "6f04a5c8-282d-4f40-a7e8-95bad2e8fc8f", "value": "1536:82fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIBfR:Nfqhp+g5ru2kmUEt88BfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257503, "uuid": "1bcdfe4f-2d4b-4ea9-b8bd-1c8766113696", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257503, "uuid": "82489f6f-9e47-46c8-9c21-b302ccfd9696", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257503, "uuid": "49efdce6-317a-4351-b40d-cf5876b4d8d3", "value": "catalog-1636965595.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5bc6d9-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262258, "uuid": "0ec830c6-c704-44b1-8dae-fe1446256e22", "comment": "Malware payload", "value": "df0ff931b226bb49b5231338fac5675d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262258, "uuid": "6ea1b3b6-897d-4a65-9bb5-d569ea9a6e50", "comment": "Malware payload", "value": "097c4b28219bb9c3890d0ef68d2e12ab29f9437ee56dce60db9eb9c6f7208363", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262258, "uuid": "3555ed5b-539c-4bea-8997-34a2d0f84182", "comment": "Malware payload", "value": "9b002209b2ae0891687f9f62330a78f97ed8cdd9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262258, "uuid": "a25551c8-4af1-45f8-b964-faf62d0822bc", "comment": "Malware payload", "value": "8a671f3938b4d3df4d13811e39554c2035eaee59d7172e27fddedeae9f93841e977a19d88c2366af212cb20617798e85", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262258, "uuid": "9356e609-0980-496d-865a-0103576340ac", "value": "D533F2E09502E047A358FC58DCAB9D038F7DE95E477D7842027EC0879E72EB5B24AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262258, "uuid": "de7d9b52-e103-4c53-8c51-70de891c3f28", "value": "1536:/XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOy5i:/Xma7774mfCyWMB/4GpCOyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262258, "uuid": "6f4abe34-413a-4470-9f74-fce7815701da", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262258, "uuid": "e3e69df8-ecc1-4b18-941e-7e11ae1b6388", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262258, "uuid": "c78ca7f3-6fa6-4cdc-ab6c-7b8a89209fb4", "value": "statistic-1011543395.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88cc7a7-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262840, "uuid": "f42eabc7-710f-42b3-abb1-c92190e2946f", "comment": "Malware payload", "value": "ed163324edeaac00082b36e1958d60c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262840, "uuid": "1f36acbc-6f06-4798-b92f-7758a99357ef", "comment": "Malware payload", "value": "098a02ec0abd0b13c6cd7f140aaca299fd42272d878b211f38266c1568bb967b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262840, "uuid": "f48f0f41-9702-4cdc-99e8-e1fbe5c53767", "comment": "Malware payload", "value": "172856b159fc22506d3f4fb454cb75915c39cc43", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262840, "uuid": "7cffac5a-7c20-4a52-825c-b7b300b1d010", "comment": "Malware payload", "value": "f6b1e1aebe9830bfb5919c4e24360da0c536b867a4d1932a24bb0e241d7363aa1ec1735f75a81ced7d622b2fd264c893", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262840, "uuid": "91f423d9-3e6d-48f3-a36e-2934d6c59cd5", "value": "2D33F2A09502E047A354FC58DCAA9D038F7DE95E477D7842027AC0879E72E75B24AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262840, "uuid": "c2baad29-f0fe-4cd5-9965-07cddc28de6c", "value": "1536:yXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMO/5C:iXma7774mfCyWMB/4GpCO/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262840, "uuid": "400619f5-72b5-4ead-8fff-ef6cfcd351c7", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262840, "uuid": "2f3ce3b2-52cc-4ffc-b9cd-ba9fd9636267", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262840, "uuid": "8652c5b0-ac4d-4823-8e8d-bc452453ec23", "value": "statistic-1450697234.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca238208-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263702, "uuid": "bfeb8232-2d0e-49a4-89c7-1f90bc934123", "comment": "Malware payload", "value": "6e41bf7be873cb793cc5768d9a625c25", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263702, "uuid": "ebecc5af-2667-40e2-8c0f-a299e47e4fe0", "comment": "Malware payload", "value": "09a46e0b804a677923ba9f041e232e03f4c5db94b45955981f5ea77f8de46b72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263702, "uuid": "f58ead94-4f6e-4412-8cd1-5c623a25c9f8", "comment": "Malware payload", "value": "a0c516528006466cf3a8442ac0a4472758902df0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263702, "uuid": "b792607f-b1c8-4305-8913-d3a096acf0f6", "comment": "Malware payload", "value": "8caae64b50e8fe179282ac7c6eca23295599a393d49c5d3d9d8691f3f8ba09ee1bc5b6b87e9f448f7eabba93f1c4e182", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263702, "uuid": "4e064175-105d-4d27-8c32-ed37c993591e", "value": "3833F2E4A507E047D749B81CDC6A5D038F3DE92E433E7892022BC1975E61ABAA245E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263702, "uuid": "678b4a95-1ca1-442a-bfc2-544068dcdbac", "value": "1536:kXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZI3:QXma7774mfCyWMB/4GpWvZI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263702, "uuid": "458322e1-e2ae-4a1e-8478-fbe0adf05d1a", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263702, "uuid": "ef3d136d-c885-4e00-8228-86e85c426aa9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263702, "uuid": "21a68818-0ed7-4ece-b142-208478b3fbd0", "value": "statistic-2113262389.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be87b4ca-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258099, "uuid": "94a460a0-6ff3-48d7-955e-41c37cc9fa4a", "comment": "Malware payload", "value": "3db45d9ecc74f1d2d7ef443746118c3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258099, "uuid": "836d1e17-ca01-4a00-8fd5-1321e824ae08", "comment": "Malware payload", "value": "09b029765a3aa5c5837862e4cab92ea6739e8fedb9d97d1ac1f45ca92b26b871", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258099, "uuid": "7debf658-117e-4f0c-860c-c3f8042f474f", "comment": "Malware payload", "value": "626ae71b0ef384e8f11d170f0f3b49b5c1118574", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258099, "uuid": "eaad2b61-cadf-4506-b7ac-775d4029cbe7", "comment": "Malware payload", "value": "dde8ee43bdfc7bc89086d14728b4bfe7fc93c72e5fe1e15b9f4fb1aae5f3d15b1fd887302cb673f5b5b633f0b3d422a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258099, "uuid": "0d1a394f-85f0-4e88-9f74-c3abb986c712", "value": "8E330196E754018DCF8FE1EB34FAA9DCE19E7E03099A74D0DA6E1A05C1930F0192E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258099, "uuid": "9d477122-cd99-4110-af94-2ecd093b16cc", "value": "1536:I2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIoJoc:5fqhp+g5ru2kmUEt88oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258099, "uuid": "60eed281-aadc-439d-bff8-5b5b08987c51", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258099, "uuid": "9dfd6b68-a067-454c-9adb-9588843fbb58", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258099, "uuid": "f844671b-e1bd-489f-a9bf-8abf8d9ba1dc", "value": "catalog-2098975429.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7558273e-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257117, "uuid": "3f3ecf1b-5e8e-4512-859e-105f7093c92f", "comment": "Malware payload", "value": "ceb435eac91035e7177297dac99a64a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257117, "uuid": "1b9cc821-3e70-44ab-9efe-d7caf2e39422", "comment": "Malware payload", "value": "09d5689463d6dfbd156ee04e8294d30cb00f375f87b5479039a4ab1a6dcd485e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257117, "uuid": "e4d1d1b0-848b-4a19-9bc7-5118f56577ca", "comment": "Malware payload", "value": "360f25078f8ee17514aa1c96e017f2638a1ccd71", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257117, "uuid": "55ab924d-0c74-4a2d-a976-df0d1c32e9a9", "comment": "Malware payload", "value": "678d46ffcd01be5ac9f79dcfbaeaea8014ae4594bd9517062e6ba7af9ebe11c5ebe8e5d8c9c5f888072c642ce3d1b29a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257117, "uuid": "96837fe0-1121-4c2d-b0cd-49cfd5b22736", "value": "8433F1469218118CCE4BE2EB30F7FAD8E6DD6A530EA9B4D09B7D2745C1A30F1482F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257117, "uuid": "bca1f9c4-04cd-4ee2-8c9e-33b96a1d9eb4", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuzSS:Ffqhp+g5ru2kmUEt88AAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257117, "uuid": "6142d3fd-6246-464a-8f19-b8d75bbbda55", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257117, "uuid": "6da287a4-0325-4453-922c-f520ce3671f7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257117, "uuid": "0239f1d3-b3cb-402c-bd46-aa90273cc68b", "value": "catalog-1371048747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d85cf80-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257802, "uuid": "f8c27447-c370-475e-a446-a2ddb71ae798", "comment": "Malware payload", "value": "2c189d5c832d99e9f95989f04e2f1473", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257802, "uuid": "ce36eab0-4acc-4b9b-974a-f4ce3922fcbf", "comment": "Malware payload", "value": "09d6979da9723796af9b64564be6fdd40b20204fd6ac405c569abe69d4c95415", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257802, "uuid": "f06fad0f-1b56-4126-bbb1-fda1b65f779c", "comment": "Malware payload", "value": "20b30e1155e20d80d86f5207f5dc1ec2cbf00743", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257802, "uuid": "b60eb2bf-6f7f-4a73-898c-cba73804c235", "comment": "Malware payload", "value": "87ef20278ea99180bb71ad2391f502deca2bb24a2e67004faf58cadbcd208b8da385394a0fd4134a405fdc13cb9b0c13", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257802, "uuid": "69478fe5-bb93-420a-905f-e19f9c399f63", "value": "E5330186D264214DCE4FD2A630F1FACCE5DE7E430EAAA4D0A63D2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257802, "uuid": "cf7fc4bd-1431-4845-9d65-9ee3b2f0f6ed", "value": "1536:I2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3R:5fqhp+g5ru2kmUEt88IxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257802, "uuid": "51c0f1d6-0601-4e9d-a880-5632f968bc9c", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257802, "uuid": "76ae4e2f-13ed-4c27-81e3-9d7f7bd80306", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257802, "uuid": "8dd044cb-8671-4cf2-99ab-6d30e729a331", "value": "catalog-1889578404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cfd294-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257120, "uuid": "b539070b-c9a1-4c69-8f7a-c60564240adf", "comment": "Malware payload", "value": "cbc33db446c89f0a052267feddc2365e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257120, "uuid": "a85fca6d-d8f6-4d72-93ab-3bc014ae23d4", "comment": "Malware payload", "value": "09d7a139a4e24a902e6e98f643bf07d3044440df9399f73480ef06046017a018", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257120, "uuid": "041ce605-8b1c-4d51-b0ec-4b559195346d", "comment": "Malware payload", "value": "bd70e7b4b705c70440d51fc97405681f40bb4ede", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257120, "uuid": "27047422-1d2b-4a37-a7e2-33a41e59ca58", "comment": "Malware payload", "value": "57a6fe115ec33b416353fcdf9a810886254d2ccaeef13c5867d7d0ebb4e638d32fc7f27f006ac6be652bb33736bce2d9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257120, "uuid": "66abf5ff-f3fa-4119-8626-1883eb5f96e1", "value": "DE33F241E655028DCE4EE1DB30F5F9DCF6DD7A030EA974E09A7F2A44C1560F4492B68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257120, "uuid": "b3694fa5-bff3-4c24-bdb1-da3c9602d90a", "value": "1536:32fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIC1:mfqhp+g5ru2kmUEt88C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257120, "uuid": "18497e11-299c-429f-8629-601e8399bdfc", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257120, "uuid": "bb913942-771f-44f0-a5b0-5f519b94f991", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257120, "uuid": "b329e840-1fdb-4852-bc10-2c66c4ff50c4", "value": "catalog-1371120139.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e013e221-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262450, "uuid": "6e304331-7063-4e91-aea1-78f5bc6e4a96", "comment": "Malware payload", "value": "575167ff930ce43d27468b39b9314221", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262450, "uuid": "504b7708-2b98-4ab6-81c7-59a0ef8c23e8", "comment": "Malware payload", "value": "0a0a8373069daa5a370727f06a9dd510c4ff78ba6f9865f4077d731c836bbcbd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262450, "uuid": "01fb491d-72ac-4498-aabb-d2a1ad1b8e15", "comment": "Malware payload", "value": "eae19423707ea186f987ebcd7ed324f05b5a8e18", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262450, "uuid": "d8b2ff6c-8a62-4ece-8691-36d5afd37281", "comment": "Malware payload", "value": "410aceeb827bbe125eee52764c170fa0addfa84e90bdcefc3e70e51a8bedee7560b47f29e1ddc2be3175fed4f5afcb22", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262450, "uuid": "d9fdbb67-d557-4dff-a9ac-a7b87815daaa", "value": "A63302D49907F046E759B81DDC2FAD078F3DDE0E83BC7892026AC0839E61A756549D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262450, "uuid": "a1366452-fd8d-4c71-9ea8-a2f9568e8674", "value": "1536:LXXtg3K7774iXfEz5lnm/hQMOEYus1GpFK:TXma7774mfCyWMB/4GpFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262450, "uuid": "52243d5a-6229-4088-a9ba-539c056dda53", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262450, "uuid": "644b879b-2d70-4db7-94b5-3f9c6857dcaa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262450, "uuid": "b403df57-0244-4929-999e-de78f4d02f46", "value": "statistic-1181384217.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20648e1e-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258263, "uuid": "7e2a04a6-87a8-4114-aa5e-f5e0b166c3ce", "comment": "Malware payload", "value": "d665abe99081314c6dc22866a8b3b7bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258263, "uuid": "9e85b121-56fe-475a-997d-69732681e34f", "comment": "Malware payload", "value": "0a12a3e9a2321da440624946c9bad0acae195c01d74bdf1090c4be3ebbc4cfa6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258263, "uuid": "07499ca4-a2b5-40cc-8eee-7761dfb5f444", "comment": "Malware payload", "value": "54191dd6f0b1c06a3281ecfa6c11578cfffeaba9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258263, "uuid": "2015f446-5ae4-4f1d-862c-7c1222e37518", "comment": "Malware payload", "value": "ff50cde42a7efaff9c1ff72b4ffa98954fb19ba64245bc9757ea97edda82692dfd917f5eefc5ce8151b5176a6565122e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258263, "uuid": "81edd9db-b9a2-4bbf-96a3-996c701c12e9", "value": "2933F241E655028DCE4EE1CB30F5F9DCE6DD7A030EA964E09A7F2B44C1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258263, "uuid": "c1dba604-9785-469a-aa3a-765b537fc98a", "value": "1536:32fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIH/:mfqhp+g5ru2kmUEt88H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258263, "uuid": "6a887af3-79a5-47be-9457-baab00797b86", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258263, "uuid": "47296c9e-4743-410f-9c63-8405b2b3dece", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258263, "uuid": "f5fa4a30-ca53-439b-96f3-186ac2ffd263", "value": "catalog-287547859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ac0398-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258893, "uuid": "d21a8257-7349-4645-964f-eb41e0ab48ad", "comment": "Malware payload", "value": "08d330b980cbc3bcb8199036d9f8e561", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258893, "uuid": "c6ef0b61-b6a0-4cdb-a365-2a808bb8dcca", "comment": "Malware payload", "value": "0a22b105e9226b7bf9cfe23526248212f93101cf3168ad69cc0bb1fecb8b5d7f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258893, "uuid": "9bca99a4-a768-464d-ab3a-80d8d0aa0e95", "comment": "Malware payload", "value": "b10ffb435b68907d92432a8a1afec6834af82cb4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258893, "uuid": "4f6ed439-04fa-40ef-81e4-ffd1469b1a9c", "comment": "Malware payload", "value": "ab6e2bcef5f70ca34fb22da22a6c095df47d2bbe83c3c98ec3fc4b41e054eea74aa88fcbb7a3ba345f99aca3987ea9eb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258893, "uuid": "4478174d-1f7e-47c3-a8f4-f111a7b20266", "value": "E233F181D615119DCF4AE2EA70F1EACCE2AE7E430D9DB8D04AAE2B0591530F50D2F58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258893, "uuid": "9a680ddf-bec3-4f0a-9536-2e69bd80ec6f", "value": "1536:62fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIzWvSzz:/fqhp+g5ru2kmUEt88zWaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258893, "uuid": "37d40e6c-e786-4358-9cbc-4ef80f37e8fb", "value": 52723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258893, "uuid": "a4ebef1a-0f43-4f5d-95f8-a3ddce883972", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258893, "uuid": "7b74edd8-bd0e-4cea-990c-2bfeece85684", "value": "catalog-65099298.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5b0a21-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264402, "uuid": "edff2487-ddec-4e4a-9a25-2161d89b65d9", "comment": "Malware payload", "value": "10d92bffd7d7f825e5fa080e72520b99", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264402, "uuid": "9cbafac5-566a-4ef8-927d-661d5bb871b0", "comment": "Malware payload", "value": "0a32b39f3211846e7e4af29a06861b41fdedd533af8d30c01891bfc00fb96f6e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264402, "uuid": "62893424-e139-41ce-93b7-a4dc183989ad", "comment": "Malware payload", "value": "badd5e8ca233cd8cfad9b48d67d9ea4194d2eb1a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264402, "uuid": "141ee7fb-83cc-43ef-87aa-b4c25ef9d1ee", "comment": "Malware payload", "value": "ae24755250870d338619a6d9c79c45894cd57be92ceaa64abd36054236e16d1e92cbb270f6786608edd345a9084cb3ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264402, "uuid": "cb9ddf13-2172-4573-8302-187969ed4c00", "value": "1B33F1E09902F08E9755BC58DCAB5D47CF39C91E027D3883017BD0475EA1AB5A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264402, "uuid": "31d8a4a0-3cdb-468a-90d2-228544f8ea38", "value": "1536:HXXtg3K7774iXfEz5lnm/hQMOEYus1Gppz/:3Xma7774mfCyWMB/4Gppz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264402, "uuid": "2103d635-c5f0-46f0-9a19-d1d89babc932", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264402, "uuid": "e63316ee-3d47-4b6a-89f9-b6f0d06f604d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264402, "uuid": "32210805-45f1-40c9-b13f-633b015d3587", "value": "statistic-704708357.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38ae069-b6bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621220795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220795, "uuid": "a241f7de-2ff1-44a5-8f78-879ae101f660", "comment": "Malware payload (Dridex)", "value": "e8ffa667ee5baa2a8d77b76953f96c02", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220795, "uuid": "404e9f81-e7e2-4353-80b3-3d4acbc0d559", "comment": "Malware payload (Dridex)", "value": "0a3b61116fdf1168cb902c0ea5374ff57edb2bc69bf9822a87f4f6969fe52151", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220795, "uuid": "b95a6632-eb73-4acf-9d64-753a17dc3855", "comment": "Malware payload (Dridex)", "value": "881fdbbad413b3f750536a79e1d6de4842b706c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220795, "uuid": "6df2df1c-be00-4236-b1a1-c4e854ca719e", "comment": "Malware payload (Dridex)", "value": "59519a5f28ca924f55469a16af037e5ab5b513ea738c4ccdf96ba84e01c3d6a1c59d545270aa614dd3192a345cd7356a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220795, "uuid": "f0dcfa63-9b47-404d-935a-1693ef770b4f", "value": "63F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220795, "uuid": "d13babcf-9a8e-4593-bbfb-032361a102b6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220795, "uuid": "9d9cc350-39c0-4fb2-9c4b-fac3a23ce32c", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621220795, "uuid": "b5b176b4-0585-4ccc-8731-55b899337af9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621220795, "uuid": "84d96f19-f155-4216-affc-a9a3983de2f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220795, "uuid": "69ab4e8a-50e1-4b8a-a49a-e82fc75a1ee7", "value": "e8ffa667_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698f443b-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259245, "uuid": "72194642-79f5-48b1-8a00-44736a5d5cc2", "comment": "Malware payload", "value": "b05cced566d02cf70d347f5d7aa7ee3a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259245, "uuid": "ce2907b2-a503-4d47-8385-6dbc2b5f30b1", "comment": "Malware payload", "value": "0a3f9ee921f6bdbb8a17d0fdda2a3251eddd3d76c2b9613ce59a93c9572e4c52", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259245, "uuid": "e2ca8383-0fca-4cdf-bfc8-f0b38e8a3c76", "comment": "Malware payload", "value": "a1ba386193df8a3d69bbd3e98a79e7ca0046d7b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259245, "uuid": "7b73b72f-b63b-46a1-b711-3daff3d31c95", "comment": "Malware payload", "value": "86ca878ba609fe5bee30cb7200a0090c6083ef4515f95469d2a5fd0b06ad50b5cbcdaedea180427afb6e08a15f5e7adc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259245, "uuid": "901a8d1b-43e5-406c-b75f-343cf773119a", "value": "9233F151E655028DCE4EE1DB30F6F8DCF6DE7A030EA964E09A7F2A44C1560F4482A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259245, "uuid": "b6af9247-8df2-43c7-84f7-6a3fd6b0336e", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIhf:Ffqhp+g5ru2kmUEt88hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259245, "uuid": "57e7459c-48c6-4fde-9a6e-9ea07afb5eda", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259245, "uuid": "ce4f918f-c6d0-465b-b5d3-5d8be3c3144f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259245, "uuid": "f113587f-1c8a-4d6d-8f9a-cd7b5bcab644", "value": "catalog-894572799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c14b99-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263184, "uuid": "3e013f81-1b80-4861-b6ff-b57eb43f2cb3", "comment": "Malware payload", "value": "9cdc21552eda4f60ca10b6da042f3f40", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263184, "uuid": "c48c0873-1dfe-4c81-bb2a-793d22d30abe", "comment": "Malware payload", "value": "0a57a5aabf8dd76101d13500e4ff9a77fa84cb0bea9cd734ca4e4b5246c5ddcf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263184, "uuid": "ee7a6096-bb2f-4246-9203-af8fe9ddb3f2", "comment": "Malware payload", "value": "5a88e17f2ccb90704f03b2e3eec0714b0f864c7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263184, "uuid": "a51ee01e-2d6b-4672-824c-b613f6dd4d5c", "comment": "Malware payload", "value": "ada775837ff4af10635b989ed39f528f59ec63b397035b8ef594a20791905bd7c706d0e823cb29206f15b0d890a0d1c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263184, "uuid": "ce0692cd-25d2-492e-81d6-85ded1ed46e0", "value": "1233F2E4A507E0479349BC5CEC6A5D038F3DE92E433D78D2022BC1D75E62AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263184, "uuid": "5cd3f26c-131c-49d5-a371-4fb084fbc4a5", "value": "1536:jXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZnq:7Xma7774mfCyWMB/4GpWvZnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263184, "uuid": "baf2281a-4672-434d-af59-e734f43dfaa9", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263184, "uuid": "c7189788-24cd-487c-9676-9d62859640fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263184, "uuid": "f47da39c-f1f9-4612-ae09-9607a1d3c61c", "value": "statistic-1714672128.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fafaca-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256977, "uuid": "74677aef-4646-428c-ae61-5a7677ea3979", "comment": "Malware payload", "value": "d549e9f9efdef755f39470c3ac3d44d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256977, "uuid": "67835424-2166-41ca-9a6d-1e6dfea1ab73", "comment": "Malware payload", "value": "0a58fc243974cdf2ec1ff8ebdc1c1f8050bcbab12d00f797e33e1055f729dc65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256977, "uuid": "c3b128fa-454c-4990-a9da-6b01ffdc31c3", "comment": "Malware payload", "value": "64ff405198cb481f55440cf48d6e843522a61fe5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256977, "uuid": "a2c179e4-b485-4df5-ac2c-3982c10b9894", "comment": "Malware payload", "value": "585b37a7e3b92cd0b1eaa3aaf9ade8d26160fc324de98cc61fac70a6626ed5aa77130523c94f20511ffef6dc7d342532", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256977, "uuid": "9f7bf859-5f2a-4bb0-bec8-7bdf77b4bdb6", "value": "3C33F184D164118DCF4FD2EB30F2FAECE1DEBF43099A68C09A6E2A45D2520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256977, "uuid": "b8e754a7-0601-4fe7-b351-3b91cb98a241", "value": "1536:W2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbBp:7fqhp+g5ru2kmUEt88mAbBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256977, "uuid": "5dd7171b-ee30-496e-954a-f719015769ba", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256977, "uuid": "957025ca-82f7-4b3d-b895-0d99ecd083d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256977, "uuid": "bf20f607-cec2-49ca-b54c-50adafa3629f", "value": "catalog-1259208433.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770a2475-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263992, "uuid": "51b50c71-acb8-45cb-bc26-0eba93865955", "comment": "Malware payload", "value": "b89816f05fe273da94d89e5045178f2d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263992, "uuid": "972e410b-a496-4fe2-a4a4-5f633c0c517d", "comment": "Malware payload", "value": "0a638fc5d07d0c59b84dad31e049fb1a00ff7deed653b90ed88bcf5aa7803c8e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263992, "uuid": "44d03d79-306d-450a-ad51-ec84cbb33998", "comment": "Malware payload", "value": "ecd87ff2bf4aab1e088b32787ef717330cd7cce3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263992, "uuid": "7de90eab-e69f-464f-bd84-8ae434bc01df", "comment": "Malware payload", "value": "4f8632782d6abf05dd5f285dc44f830cda7a778511b9169392f2568fa613c3e09c46aed953a3feb56b5adb090e2fa517", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263992, "uuid": "14dc3b95-55da-45e5-88aa-a15907869463", "value": "9D3301E48907F04BA759B81DDC6FAD068F3DDA0E43BC7892026EC0839E61AB56549D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263992, "uuid": "9ab16803-7ab4-4302-b2c1-6b8b3c70fae7", "value": "1536:EXXtg3K7774iXfEz5lnm/hQMOEYus1GpFb:wXma7774mfCyWMB/4GpFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263992, "uuid": "c6c81830-850e-4ae3-b89c-61d55bfb8627", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263992, "uuid": "a1f0dd4b-aa2e-480c-8e1a-7cf1875395a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263992, "uuid": "967083f4-c368-4b6f-85b5-903366d020b2", "value": "statistic-419435493.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b9a010-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259584, "uuid": "f0f63968-01be-4655-abc3-2767d8b77a8e", "comment": "Malware payload", "value": "53bad362930ca436bb9f5452658c9a74", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259584, "uuid": "3dbbc76d-1d1b-4a6b-b53d-baefc907a974", "comment": "Malware payload", "value": "0a7df9f41e6aab092317f6f5152581ec983faabb5d20e74359d4295c56489758", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259584, "uuid": "d7390323-8ca7-4ba1-964c-6afb2d878c5d", "comment": "Malware payload", "value": "84a8eeb42f1edaf19349dbe424799a5deed8fb4f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259584, "uuid": "dd930aff-6095-4809-8941-21c3ce43dd9a", "comment": "Malware payload", "value": "906402ee6209c2dd47c9a9057bbb2c000931f3c9c208e06a78d7dceeb0f78df6bcaacda57ba3fedd9fa8413493456660", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259584, "uuid": "dd345c01-4700-4c31-969a-c4f8b6137a3e", "value": "6533F13547ACD6F62976D0BFC8CAFA04FBB19495C4D78A6249F8B1C8B6D02845E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259584, "uuid": "0535bd25-3d91-497d-93d7-d1e0be64dce9", "value": "1536:6jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXN4m:qB9wzbqtWb08UscYJhnpjyq9qBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259584, "uuid": "cce10b50-e87a-4b7f-93a4-1a7d66bc0484", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259584, "uuid": "7721859b-571c-43a2-8258-8e3a03b97b0e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259584, "uuid": "a74893b0-ed8b-455b-b9f0-d66709f7cfe9", "value": "diagram-1166953889.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19461d7d-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262976, "uuid": "2522419c-171b-42ce-9e46-4ee06420a0f3", "comment": "Malware payload", "value": "1992f2ad5cf54b9a790161e3d19f3330", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262976, "uuid": "2071129b-f356-45d1-956b-341bec2bea10", "comment": "Malware payload", "value": "0a89fbb9f215dae6b676f209d379a55946a59c6957f3e5b13686c7c4f889c0ba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262976, "uuid": "19af49fc-c379-4b8c-8626-609aff1e3d2c", "comment": "Malware payload", "value": "0cc04dffca3e029eb5550fd411febc3688f94b4f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262976, "uuid": "a1a2d2bb-1da9-4d16-bbc2-0c9f760bd403", "comment": "Malware payload", "value": "68f0e0dce5e14d73fabc623a1538c205049b9fb0c515a15837ddf4e3e2fa1ba4d46b40eec0866901b15939fa12046c01", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262976, "uuid": "14eb6b49-a5c3-43b9-b3b4-d4cc486d1346", "value": "2C3302A0A902D087A759BC1DDC7A6D039F3CE91E473D6C53013AD0875EA2AFC7645E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262976, "uuid": "e5be1b35-f68e-4818-b44d-3376f464824c", "value": "1536:nXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07q2xr:XXma7774mfCyWMB/4Gp07VJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262976, "uuid": "ab40a942-3944-46cd-a5cd-b6538a6f0e8f", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262976, "uuid": "e5660229-b113-4fe5-988d-eb3731fb1542", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262976, "uuid": "15732202-0291-489a-adec-2c0a048d83b2", "value": "statistic-1529974663.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b5a93e-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262183, "uuid": "7120df41-2825-4165-96a1-33a3a7810713", "comment": "Malware payload", "value": "0228e0f7c597f8cd9f2c7ded322a0d4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262183, "uuid": "54bbf7ed-1416-4d95-93a6-80eb9fcbcdc4", "comment": "Malware payload", "value": "0a8dd2294a7ff7ac068c98f81a96463cf704b9eb7ff18cb4977c171b9d073f24", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262183, "uuid": "8d7b36c8-e2cc-4e85-86f5-569dece5aff5", "comment": "Malware payload", "value": "36efc9bbc2a966996a314d2151ffc2504b97598c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262183, "uuid": "a6da06a1-0861-41a8-914c-0d5e294a8e1d", "comment": "Malware payload", "value": "14a960b51239db84061a37533cb95311e8028d321f43ef0bd82c77cfc2b9324274f91d35479b43fd0a25e6f63da792ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262183, "uuid": "6b41b2df-7ed6-40a1-84b8-3cd60633cd3e", "value": "B833F17147DCCAE66D76E0BF84C2F808FFF29951C987872645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262183, "uuid": "62b89b74-56a2-4ef7-a39a-d6c959946322", "value": "1536:OjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wYl:mB9wzbqtWb08UscYJhnpjyq9qEK0wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262183, "uuid": "ca114f33-e10b-434e-9f9c-f12e7bdf1c6f", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262183, "uuid": "5baca06c-f3bd-4573-b275-0ba6fbb04f03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262183, "uuid": "f4523f76-541f-492a-b57b-71522ac98c75", "value": "diagram-966022861.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2658589f-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256985, "uuid": "d77b38e5-710e-4f1b-8c12-e784e16a5431", "comment": "Malware payload", "value": "f3cb317ca4c19e8b7599b636083b289c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256985, "uuid": "db3e481d-1748-44b0-bd5a-395e308f669a", "comment": "Malware payload", "value": "0a98409a2cb3ddbf1a15a8cd829b28413e479d59a0e9c8bf960aab2fa0f0b66a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256985, "uuid": "28bead72-b6db-43ab-9556-44a9156af8e4", "comment": "Malware payload", "value": "b026415580fcc60fe5841b4053259fae6955f588", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256985, "uuid": "417a7300-3c06-48fd-aaf2-45a82365d95b", "comment": "Malware payload", "value": "24abb426beae9b5c5035339c15eef2f99e59edb03fdff9060f2eb3077d35e2c43d0037133b3548c20226e9d400a878b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256985, "uuid": "5a4ffa9b-050a-4604-9d23-4f55ed3ad3bd", "value": "1233F184D164108DCF4FD2EB70F6F9ECE1DEBF43099A68C09A6E2A44D2920E54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256985, "uuid": "7f7c8278-8963-4d6d-b1b9-6e3a9fe687fd", "value": "1536:42fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAb64:Jfqhp+g5ru2kmUEt88mAb64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256985, "uuid": "2282669b-3548-4905-b879-53316e124d75", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256985, "uuid": "1ba29018-de8f-4462-8565-8e006f85c393", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256985, "uuid": "1443a01b-dd0c-454f-9411-5867f6bed0f9", "value": "catalog-1266868644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df964c64-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260731, "uuid": "0d90940e-7f25-48a3-a1bb-e76da3036257", "comment": "Malware payload", "value": "fef63dd73b9cd934ebcb79cfcb347cd6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260731, "uuid": "77534120-21ec-47ca-8d27-612faf8e0062", "comment": "Malware payload", "value": "0a9fcbb54d6123aba1fe65bffb01165ff5500c6210d68b7f5066b36c2d519b61", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260731, "uuid": "8368144d-bcb3-40c1-b705-e4e22b26438f", "comment": "Malware payload", "value": "a861011aa5fc25e6a5dbd73a495a94bf9d5cabd1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260731, "uuid": "dfa9e87a-b2a1-4d64-9a6f-da0f9c97adc4", "comment": "Malware payload", "value": "633e05e8c5f03fa03781063cd262754a1d04227bf232a4b61a04a3846e4e25e4d821e623a098f2151e2cb0566cc9171a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260731, "uuid": "38720100-65b7-42b0-9d4a-7b097ca8f8ee", "value": "7C33F17157BCD9F628B2E4BFC8C6F904FBB1D49AC4D78A2146F871C9B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260731, "uuid": "fe8218a6-58af-46eb-9350-2e2f0d7ace5c", "value": "1536:njfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXXK:jB9wzbqtWb08UscYJhnpjyq9qBXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260731, "uuid": "ac1c5435-4269-4d00-9638-f84fa405a525", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260731, "uuid": "b421b1d9-b4fa-42d7-a0e9-b56773a05bdb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260731, "uuid": "bb540d0d-ad1c-44be-b323-656844648a3b", "value": "diagram-1999718272.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef65490-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256945, "uuid": "e62ee5d5-9c8a-4ea5-a3fe-fe98c7d9b370", "comment": "Malware payload", "value": "0335885d394785a794170459a8c52a8b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256945, "uuid": "90f126f8-d519-4ca3-97dd-668f9f287ed9", "comment": "Malware payload", "value": "0aaaf62c2228a3ce7d81346198445970285c388bf7d092cef1a53934e20961a9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256945, "uuid": "76f3d7be-201c-493f-9cab-f29f60ac845f", "comment": "Malware payload", "value": "c011e200a5d8bad25fc1a0be6c5241e648ea48a8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256945, "uuid": "2931a483-e694-460f-9e23-0f6d55d2aa00", "comment": "Malware payload", "value": "64623041fdcf08aff68325ce645c8683528aeebe5bfa9cef853f75503b1682ae927d9a7349f781d8abc0ce96f67fab89", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256945, "uuid": "8e5c9b09-600b-49a1-b27c-0ee6a41a405b", "value": "A033F191D645018DCE4BD3EB30B6F9DCE69EAE034A9C78D09A7D1B0590938F0892F19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256945, "uuid": "1ef2b040-2a42-42e9-910c-3fa6ded61e72", "value": "1536:W2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jId4R+:7fqhp+g5ru2kmUEt88W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256945, "uuid": "8657964d-6723-4bd8-a247-03b2eeb390af", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256945, "uuid": "6a90a290-9c56-41da-b88d-f1dbe53f4c73", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256945, "uuid": "b3337f6c-a441-4e3a-a0d1-c3596fcdfe1b", "value": "catalog-1225492371.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52cd81d-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257654, "uuid": "408f96d6-cf1f-4d5e-a79d-baf10c57c884", "comment": "Malware payload", "value": "43f85e397bbd2e3f4e9008df4ebec7cb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257654, "uuid": "1cfbfcb5-fb8f-4c3f-baa9-d9d96bdc8fed", "comment": "Malware payload", "value": "0ab3f06a34adb66d4c06b11ae437cb621411431dbebc9d6f021ac991c4572ed1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257654, "uuid": "70ea8f14-09d7-4a78-9c22-1cbd228f829f", "comment": "Malware payload", "value": "dee89e67c92370506e6a67b2b4a7bd167379d0d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257654, "uuid": "b59b34fc-5555-4447-a15c-61a3ea1c1e66", "comment": "Malware payload", "value": "ec323b196bdcc04709cc81c16cbe5849c481886bc9678ceb2e4e92bf436f65511fe3e86b7149580081dc53f674ce7e8f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257654, "uuid": "336835d4-ace1-4777-a2b4-6b88925b22f5", "value": "2533F242A654128DCE8EE2EF30F2F9D8E2DEAB570E9964C0576E274581574F1082F68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257654, "uuid": "48c39615-07ad-4ccb-87f6-85896e2cae08", "value": "1536:r2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIs2pf:Kfqhp+g5ru2kmUEt88s2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257654, "uuid": "2ec6617f-d17f-4149-ab3a-7da62dd59b64", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257654, "uuid": "66dd66fe-dd24-4a81-ab2f-7514b7252f4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257654, "uuid": "f0a3b11c-dcfb-45ff-9fbd-ebda24f2831b", "value": "catalog-1768935401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be14c50-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261799, "uuid": "e82e0aab-767e-4f0b-9aff-a29b6dc315b0", "comment": "Malware payload", "value": "17e1f9e0384dad3b6d0fc144124a8c21", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261799, "uuid": "ba775805-2808-4371-9d9b-40ddcf288791", "comment": "Malware payload", "value": "0ac6510ee355c8442b648db672990590c9c5f8806633e18e822a46560cfcb5ee", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261799, "uuid": "dddab8bc-3a78-4d49-a986-20522cacfc51", "comment": "Malware payload", "value": "30c8c2eb141a61889b07fa419e026cc1ed5c19d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261799, "uuid": "173a6ca7-f46f-4617-ad47-8aa629dd9831", "comment": "Malware payload", "value": "242308dd69a11ca5c43b1979b1bfd5cbb41e0c66718257469d62b92dc77bd3bf5e559e2b22fa2593dbf2466ef5d56b20", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261799, "uuid": "447ea251-f406-4539-9d65-f145c634bd75", "value": "0E33F1314BACC9B62DB2E0BFC8CBF504FBB1D495C5CB8A664AF871C8B6941555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261799, "uuid": "e852f3df-e63b-4733-ac14-28bfcba4a259", "value": "1536:ojfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXS6:IB9wzbqtWb08UscYJhnpjyq9qB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261799, "uuid": "a5ddc565-c815-4090-8ff7-46d664da8765", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261799, "uuid": "0cefda07-f29a-40cf-b5cf-24a7acedbf8c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261799, "uuid": "62477d2f-70a8-4811-8783-67887ae3658b", "value": "diagram-79669910.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490d2516-b6f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621244587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244587, "uuid": "d14ec437-00b5-422b-8a45-e57dc2dd9039", "comment": "Malware payload", "value": "7bfd6d4d20c1a4101a7fe1438fb4012d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244587, "uuid": "87f9824a-5241-4c86-824d-49934b7c5222", "comment": "Malware payload", "value": "0aceb8dff16bd1f1792dc8e8cfdcb873e1cd76cf89f36894f2c55205930272fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244587, "uuid": "bdf258ad-bec7-4699-b128-afd28ed7dd23", "comment": "Malware payload", "value": "9a413725da8b3e4d040a2c51c0b1140cf55813a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621244587, "uuid": "a2f098d9-0be3-40b1-a1b5-297fcd8b31f4", "comment": "Malware payload", "value": "fd4772c74da5260a176ff5432cf7245c2f9776f80659a9fd40db78cf28c20acf5e11cffbf1951343d1b9ace06fea297d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621244587, "uuid": "7e4992de-23a6-47de-b731-75aaa2ca1bb3", "value": "56D18E79DD08E329E37A7B3B903E7C129E4974ED050467456B00E49606CDB87D585B8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621244587, "uuid": "6852016b-6569-4ceb-a506-68c35ee6ec70", "value": "192:WmxVBC4FhXbpI/rWDFQZrkYfsjM2WpnwmmBeD:WmfFhN/+duM2Wd4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621244587, "uuid": "83cb2928-68af-4ee2-a1e4-1496bc589321", "value": 6411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621244587, "uuid": "78a43b67-2e15-4dd8-a3d3-7512234096c1", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621244587, "uuid": "5757f649-6a61-4bb8-90a7-49cb0c14d15e", "value": "dhl-tracking.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ba65ae-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263189, "uuid": "6578b005-9660-4475-8110-f854c261c5e3", "comment": "Malware payload", "value": "a39b9ebeed889716c65ed87c4302594c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263189, "uuid": "6438a70a-0c6c-4aef-ad4f-57713dea2ad9", "comment": "Malware payload", "value": "0aeb6893803278423f719a3ce344e89d04181ba57d8654a6db8c2ef8598d442a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263189, "uuid": "c1d15941-0a2b-41f9-b608-44600066978e", "comment": "Malware payload", "value": "995cc613dafcd7497c17e7c87250b74f8a584bab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263189, "uuid": "caa367a8-81f7-41e0-aeb8-880e0b0989ec", "comment": "Malware payload", "value": "58412a47c16412ec26bbfc1b22aceed8772c72a9e119c1d382f05113b75ce830fb06a3bf0e906900354b25a72a023682", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263189, "uuid": "7da991dd-795e-48b6-af5e-7c08547dff7a", "value": "743301E4A902F08BD744B84DDCBE9D435F3DDD5E423CA892413AC0C64DA2AB5A715A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263189, "uuid": "c7d152b1-9fab-4b83-b59e-31dc78c1240e", "value": "1536:jXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVJl:7Xma7774mfCyWMB/4GpuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263189, "uuid": "76b4c929-90a8-408a-bfde-6a0b5230f62b", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263189, "uuid": "190afa66-cb68-4cff-8530-d2b166a6806a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263189, "uuid": "b87fdad1-cdb9-4257-ba6c-3cd42d3ee63d", "value": "statistic-1716937411.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c47cce-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263666, "uuid": "7e083359-35d5-4fc3-9509-642ad215c527", "comment": "Malware payload", "value": "2dc008ad3c3ee24c6be57cdfda32ac97", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263666, "uuid": "38731b9c-c66a-4586-9eb5-9fc4e48eab34", "comment": "Malware payload", "value": "0af171ed67e9b4e12043440c67e25319df1b750ab2b1e809bf27610564d688bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263666, "uuid": "4099b93f-4f6e-42c9-b9fc-f29960c31aae", "comment": "Malware payload", "value": "5a6b4f0d9136488a84b29c544df0e357aa4333d6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263666, "uuid": "8f23c08f-d215-4f5e-ac7b-e89f439db3b2", "comment": "Malware payload", "value": "e3f5f031df328ce90a08f3b32c3b6c557937470d3884d7e6bb131de522bc319def572ceda0e75ecd87244cc4317b8b9f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263666, "uuid": "c87d66a8-c3f3-4641-86c8-8ad3b7d1197d", "value": "703302E49507E0479748BC2DEC9B9D038F3DE91E033E78D2112BC1975E62ABAA245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263666, "uuid": "d91c6af3-7a84-4516-967f-bee8e615486e", "value": "1536:wXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZK:0Xma7774mfCyWMB/4GpWvZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263666, "uuid": "0ace2756-692c-4221-b971-58173d5bdde1", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263666, "uuid": "8e8712cf-0b5f-40df-9b53-6bf0a0860a28", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263666, "uuid": "c69dfc2c-27d5-411f-9b88-fceffbbbf020", "value": "statistic-2089329588.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905b036b-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261887, "uuid": "5b50dba1-fe0e-4521-a659-f91803e84d0d", "comment": "Malware payload", "value": "75bddd459bad32c6eeee9ef0f65f03c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261887, "uuid": "fc2dd62c-9df9-4fd2-b5ca-9f90b0c3b07c", "comment": "Malware payload", "value": "0af640e01ac83bbeab192c3701cf4280028a7d2c7d2a8f113286deabe336d27f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261887, "uuid": "64a081c6-afc9-45aa-8722-9a176e2b1cc0", "comment": "Malware payload", "value": "1af6783247e28e67809b73960c7ef711fe9051c6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261887, "uuid": "ba3bbb71-f400-4d72-ad12-643e6f7b4064", "comment": "Malware payload", "value": "d587cdf60b0e1b46233e4af76067a86202c21fa4ce08dc4bbf70ed928e1ddbb03edb2fa2bb43c92438efa4fd64b8e782", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261887, "uuid": "3c81ed63-c0c1-4f17-bf97-2eec82408d68", "value": "8D33F13547ECDAE62DB5D4AFC4C6F504FFB1C4A5C8C78A2649F871C8B6902959E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261887, "uuid": "84335145-a431-4b83-b0ee-97a9ccf12b6b", "value": "1536:IjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXEpV:oB9wzbqtWb08UscYJhnpjyq9qBEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261887, "uuid": "e6f29cc2-626f-44f4-ab9c-0fe76e6b4aa9", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261887, "uuid": "b2750e06-6d8e-4165-8012-b14888eb5b30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261887, "uuid": "cb0e87cb-812a-409f-b737-e65e01e135a2", "value": "diagram-855143001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965d112e-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263615, "uuid": "61e28d2c-bbc7-4574-895b-f5d275a41ab0", "comment": "Malware payload", "value": "b2c9d1a8bc1e50d0b7cf2cc544b28a2e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263615, "uuid": "b48f0d77-11f1-4acd-9dab-e6bc75c6b59e", "comment": "Malware payload", "value": "0b095f0cbd694dac637b8581d72ac8e589a875f2ac216848cd561abe7e188316", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263615, "uuid": "aba2c95b-8397-471f-8660-ec79fa95816d", "comment": "Malware payload", "value": "8bd82b776b6b5b14affb8ba5e63eab5251ac24c1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263615, "uuid": "8db6614c-e5e6-47bd-884d-6685674e018e", "comment": "Malware payload", "value": "772a67982c8852648d18f57fa6a44c9bfe71a5be1bf417100edec90dac47460ba0cadd91becab8b751847210be9e157d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263615, "uuid": "7e7d3bf7-2bda-4c19-bbac-ecdcc3cde69e", "value": "2F3302E49507E0479748BC2DEC9A9D038F3CEA1E433E78D2121BC1975E61ABAA345D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263615, "uuid": "ac307d39-9003-43e8-b55b-507acca42609", "value": "1536:mXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZT:uXma7774mfCyWMB/4GpWvZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263615, "uuid": "d62834d8-5236-42c3-99dc-9ae0aa64aa35", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263615, "uuid": "4f3754ca-4233-4d75-afcb-2b04e5ac4f59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263615, "uuid": "b5fa46e1-5e4c-4f2e-9088-1e102ed0ae3e", "value": "statistic-2043941944.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f57605-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260331, "uuid": "9dd105e8-d7f0-4621-b02d-c1e2d0ee0b21", "comment": "Malware payload", "value": "68c03c6cf7c34d9a58bd17578cae43a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260331, "uuid": "f6d05515-57f4-4f3f-b6b1-8e46a6b85338", "comment": "Malware payload", "value": "0b300242cad1d1c9977e3354d7aeeec291419038a23c07631ba8d424cb1ae5d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260331, "uuid": "660a7434-6ff5-4207-a7e7-f21b59556b0f", "comment": "Malware payload", "value": "06df6919aa7ea911b9cab08d457dfb14ec5b02ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260331, "uuid": "c2de20f7-d09a-420d-b689-8dec0c078966", "comment": "Malware payload", "value": "613f2488d575047a69551e0a66c87da8f88ae9463e0ba725aeb253a1ec56287d017645132c3ae285a041baa41be2eca8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260331, "uuid": "637656ce-d098-42cf-8209-5f854cdf1af8", "value": "9633F1314BBCD9A62CB2E0AFC8CBF504FBF1D499C5DB86624AF871C8B6941555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260331, "uuid": "3b174805-5026-4258-922b-88c7443a00e3", "value": "1536:6jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX/s:qB9wzbqtWb08UscYJhnpjyq9qBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260331, "uuid": "0fe30ad4-1b68-4086-b637-455e075e90d5", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260331, "uuid": "65eb830e-e376-446f-bf15-0ab09e9d5b29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260331, "uuid": "75cd9966-29e8-49f2-9435-29c922a48d8c", "value": "diagram-1708999238.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b02bf9-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259055, "uuid": "1899000a-b323-46c3-a54c-eb6abee5d70a", "comment": "Malware payload", "value": "e85d3ddd8371b3bce8db30fee25a9a4b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259055, "uuid": "b472f2d6-bb9b-4937-a3bc-602244ed0c34", "comment": "Malware payload", "value": "0b33d419a87a297a59225b2790422a43a77fb01d447f37978e04ef33d00f495b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259055, "uuid": "2e6eb3c9-7dc8-4915-9636-7f0350216379", "comment": "Malware payload", "value": "f880b3183f3ce22b7d392b7258c5460124966314", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259055, "uuid": "43eccf01-dcf7-48fc-8c72-7ecc8ac165ad", "comment": "Malware payload", "value": "f2263eadf1b76f7932aeff333d660caf89338daf34426f183973e7208c7a709486f4d70a9136fa7fc6208db310059b3b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259055, "uuid": "d165f1f1-0b5c-41d8-858c-7c76737eb6d2", "value": "7033F151E658028DCF4BE29B70F5F9DCE1EEBE530DAA74D0962D2B0191530F1482FA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259055, "uuid": "39dcb2dd-de23-437a-8c79-17e3d6ff6b2c", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxD:Ffqhp+g5ru2kmUEt88xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259055, "uuid": "00f02d92-c0f7-4487-bd2a-e97e95919d57", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259055, "uuid": "a421c2cb-7903-44da-82b8-9b530eb39b53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259055, "uuid": "618d167e-fbba-4fb4-9399-76b42b748b43", "value": "catalog-774690365.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e15723-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263154, "uuid": "f28b9e42-fecb-4c5f-abcb-779fb97d2bcd", "comment": "Malware payload", "value": "cc0e7b6153ab053867aa29198fef1bae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263154, "uuid": "caea5cb8-13bf-445a-b2b8-7f3198f259c6", "comment": "Malware payload", "value": "0b76c43c9328667d906eebde53ce3512114201058d9bf793b8647a384ca76073", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263154, "uuid": "a53daecf-cf35-4448-81fd-684737ab1f58", "comment": "Malware payload", "value": "92443aa47b6b441121588f0aceed6f5489454690", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263154, "uuid": "932a8e1f-2401-48b9-a2b2-672f4c4ba5f3", "comment": "Malware payload", "value": "ac0bd7991eaf29cba859a516b061149e4d3a47243d1df68cd0e803d3c88cc5f6aad20774c9ccb36365437b299b8c2c14", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263154, "uuid": "27785756-9ba0-44f9-b928-2034019326ac", "value": "7F33F1D09906F08B9B45BC18ECAB5A038F39DD19027D7882117EC0D39EA1AB4A709E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263154, "uuid": "f15cb43b-c5a6-41f8-8c62-b768a427be4a", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1Gpyui1:6Xma7774mfCyWMB/4GpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263154, "uuid": "a68b21cc-3e62-4221-ac63-4943296cf1b1", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263154, "uuid": "8d4b976a-e71e-4c30-a245-22ca0655d9f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263154, "uuid": "f886a281-b813-49e1-b6fc-1cc068d0637a", "value": "statistic-1684646885.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123378ab-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259528, "uuid": "9b84fd20-5b4d-49b1-a4f7-427df54aad0b", "comment": "Malware payload", "value": "fc1c33c3e05ffa0932697742d5060a64", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259528, "uuid": "45626b97-ecc5-44ab-9dc8-cd299cc21516", "comment": "Malware payload", "value": "0b8238ea106aa632d4488ebd4a126c3371cae214c23f22ac70a329eec754996e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259528, "uuid": "3c58e7fe-1330-4a60-93cb-2120b808d105", "comment": "Malware payload", "value": "41b8e8d68f97beb50c784b0a9c45e283e3cb4c27", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259528, "uuid": "1e789076-fde3-4f4f-aaab-dbcbf1611691", "comment": "Malware payload", "value": "fcc5454791c7cc45d9ae1c8af4df4f0ac054251a4a9654e2822266d7ec5a561ca1e8c050829c61062a4b615552987769", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259528, "uuid": "e649fafa-a9e5-4e0b-bb9d-8a7d17a30324", "value": "603301314BECC9B62CB2D0AFC8CBF504FBB1D494C5DB86624AF871C8B6942555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259528, "uuid": "3e500ed5-6376-4074-aa9a-f59a012b9276", "value": "1536:MjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXft:0B9wzbqtWb08UscYJhnpjyq9qBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259528, "uuid": "326b0487-dbc0-4326-a213-19c6ba647012", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259528, "uuid": "8657bb76-9a0d-4f4a-9f0a-5e95bc1e8102", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259528, "uuid": "72bb3feb-8a66-4879-8cab-302263f47803", "value": "diagram-1121677285.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e3d323-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258804, "uuid": "a42bd8e4-182b-4c5b-bdae-10c76f1afdd5", "comment": "Malware payload", "value": "3ef3f2930c69ff2d2d1ab4c4b1bae53f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258804, "uuid": "d4ec9eac-c7e9-42e8-b0a1-c11f0a3f75d9", "comment": "Malware payload", "value": "0ba697e4510e6f6abd62f108e252e64f86c2b90803e653709e731e45f4747f57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258804, "uuid": "efcb3d38-f895-406d-beb2-b5d104e88cfc", "comment": "Malware payload", "value": "b12874d9f73ba57ceb585b72021090362f3da7dc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258804, "uuid": "217c6fa1-c49d-44ae-afbf-760bcfa25703", "comment": "Malware payload", "value": "d8526a9724dd392af8d0cc07ce456a948b2325e49e4db3ba117ea9358dc5658a6b95e1a9cb1f8999adecd1a55f5f69e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258804, "uuid": "f35aa0d1-c0d2-42e5-83dd-b5db6461829d", "value": "B733F195A554114DCE8BD1DB20F6F9DCE6DEAA430E9AF4D0AE2D1B05C0A70F04D2E19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258804, "uuid": "0a3fb923-429f-4a81-a811-14572a82b3f7", "value": "1536:72fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIp8O:6fqhp+g5ru2kmUEt88p8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258804, "uuid": "6f91e446-6a94-4fe0-81e2-ddf6be62ec58", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258804, "uuid": "7684987b-aed4-4743-b5e7-80a578cbbbfd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258804, "uuid": "4fcd78f0-7264-40f1-8956-e24ed56528a2", "value": "catalog-579829006.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39281077-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257446, "uuid": "325004de-012e-4255-b0cc-e2fe90bc598d", "comment": "Malware payload", "value": "bbeddbcb1c4a0e1fea18dcd5afc47495", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257446, "uuid": "b7204095-d8c3-4e09-9b9e-a9ddee431dcf", "comment": "Malware payload", "value": "0bb12ef1ec66f34b02949765ea4ba03fec97ad3f8910c75624c9e4a824c71695", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257446, "uuid": "6350a115-8ffd-46f1-8348-adb51391f0a7", "comment": "Malware payload", "value": "60ee8da9940b4af3d3ba3b11e9a9eaccc7d538a4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257446, "uuid": "09995e81-408b-4bc0-95b8-4f9992754848", "comment": "Malware payload", "value": "a2026016b9e5119225a2f964dd565904e4c3a5ea1e22114a6595a0d8a4f2bd727c4e602cbc929c7dc487b29ae27c2b9d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257446, "uuid": "af8692dc-ef84-4757-8778-40a28165f0d9", "value": "FC33F142A654118DCE8ED2EF30F2F9D8E2DEAB4B0E9974C0976E274581574F1082E69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257446, "uuid": "f9fc1d1b-2154-42a7-8847-f92af8935512", "value": "1536:r2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIs2do:Kfqhp+g5ru2kmUEt88s2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257446, "uuid": "f0c432a8-5033-4439-8e91-c418eb6096dc", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257446, "uuid": "fff59db4-0001-4609-b68a-5bc28eb25081", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257446, "uuid": "8315f8fe-7d0b-4391-8db2-e599bece8961", "value": "catalog-1584578411.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43266261-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260898, "uuid": "67519cfa-3f75-41a2-ba14-da1e83f075f2", "comment": "Malware payload", "value": "0bfa1766be176c431c6594dd81aea7cd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260898, "uuid": "53b7aca3-5fd2-457f-b40b-80386c762f93", "comment": "Malware payload", "value": "0bbc1d4fd211603e909b8ff7cfff6bc20181e44829e6bc33d49784eeadddc5bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260898, "uuid": "72320448-34a8-4b55-be45-31edad69c788", "comment": "Malware payload", "value": "f7af1ff539fe66fde5f767be743700f40421a0c7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260898, "uuid": "5d06a80c-b2d2-44ae-b1e1-d2015badf5b0", "comment": "Malware payload", "value": "3eacf22e2acc65e7a06e9b7b6a6463ff9b42f6040a8c2898b2eabc458ec05148e8c4a62a98e0b1d07610192bf256e26e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260898, "uuid": "064aef82-bb77-4ae4-b97e-93f42e525ba3", "value": "9B33F1314BECD9B62DB2E0AFC8CBF504FBB1C495C5D786264AF871C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260898, "uuid": "9ed1ac8b-933d-4468-9702-03a0f750ba6c", "value": "1536:4jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXGI:4B9wzbqtWb08UscYJhnpjyq9qBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260898, "uuid": "121ee1d2-83bb-40d7-91f7-2e144fdf042f", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260898, "uuid": "046448b0-cf39-4d25-9516-626bd0b2133a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260898, "uuid": "b291e474-5b19-4d2f-ac46-e5732d281090", "value": "diagram-2141246317.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ac108b-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261998, "uuid": "58f6e651-05d9-4a48-8654-2ed8ba069649", "comment": "Malware payload", "value": "86416ef2df54e120f6c75737bac137dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261998, "uuid": "5c61c514-8cae-4071-be18-68190753c955", "comment": "Malware payload", "value": "0be27c34052a21e17b4b7590164083b34669bc88a6532ec6810be5694d96c40e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261998, "uuid": "3dced716-1a12-4110-834d-46d16ea02218", "comment": "Malware payload", "value": "7b914c35154cd8e0185034d3159365db11d30d12", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261998, "uuid": "5a888f72-eef9-4d30-97e6-0c9501d1d407", "comment": "Malware payload", "value": "beb61e5ce4aed2797c24944415e62fdd79377c4a843fb6166af2fc197c5d01da30e453fb0f35a09d51c28cfd421886cb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261998, "uuid": "c6c6def6-ed6e-4a89-bde8-bc2790cff34f", "value": "293301354BECDAF629B6E0AFC8C6F604FBB1D455C4D3862649F9B1C8B6D01855E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261998, "uuid": "97016447-89f4-4378-add9-b52c14d7e236", "value": "1536:0jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXay:8B9wzbqtWb08UscYJhnpjyq9qBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261998, "uuid": "7e63bdea-5fd8-410b-aae7-62007cc64aa9", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261998, "uuid": "a5827b2e-9790-46f3-b92f-c9b0002458a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261998, "uuid": "a1f4712e-a9c8-4266-a863-ebdb1d300ca0", "value": "diagram-936201172.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2880b8f1-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259995, "uuid": "6ed7bc05-f298-454e-bb17-becc9a93ab72", "comment": "Malware payload", "value": "f408502045122f98191caad95904da66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259995, "uuid": "cf7ed9a8-f29f-4dcf-9132-e9e7f68f7f84", "comment": "Malware payload", "value": "0bea86169a66bfc7d0b04651887359a1a6c7bee1bbfb7bc6780e8f2eac1e29e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259995, "uuid": "88ae8711-96f5-4b0a-95f5-0510d71c3382", "comment": "Malware payload", "value": "f3a81366b58212ed0da9602f5fcfd048455f6f9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259995, "uuid": "15b14940-f094-48fe-a8cc-19a3e5cc8604", "comment": "Malware payload", "value": "aa5c3315a9b3cf9a0d7ef19722845b6fe400d8369c396795e4f9e51b83b5c5a1f4b03ea015497094299a58e27f08d62a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259995, "uuid": "4bcc4a67-22c1-45d4-afef-bc4d058c8dbb", "value": "3433F1354BECDAF629B6E0AFC8C6F604FBB19495C4D3862249F9B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259995, "uuid": "d2229cb5-0434-49ae-9dd2-7ecae9a0333b", "value": "1536:4jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXuJ:4B9wzbqtWb08UscYJhnpjyq9qBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259995, "uuid": "4d3fb007-6b4c-4290-9818-99413b1956ce", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259995, "uuid": "793fee52-ad82-4cb0-8d0b-09405c7d7e7d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259995, "uuid": "a895f1a6-da36-42fc-ac13-23dd9e400e3e", "value": "diagram-1506552998.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46063c0-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263289, "uuid": "aec7098c-8a28-43e5-9a16-5ec89de26ff4", "comment": "Malware payload", "value": "a0515af05105af949c8865dba4c48215", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263289, "uuid": "19bcb944-d4f8-4f56-b9d3-de810e785009", "comment": "Malware payload", "value": "0c0aeb9ff29567c00a1b44be6a191aa3f9e76395f92615c2d16adffd6177e0a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263289, "uuid": "1777f6c5-6760-42a3-b3e7-5784cf68a30a", "comment": "Malware payload", "value": "4534d5240d5f228c5e2dce7bbc4f6fd311f20299", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263289, "uuid": "3ce9abe2-bd42-43bc-907c-24f309eb05f4", "comment": "Malware payload", "value": "8fb4673fb7e7264a27a76e57ffefd8f1213628ed0202bb764f47c7a8167d3e8dfc51d24b39ab26ee436df5f3ae383747", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263289, "uuid": "c914d3c9-4398-4d9d-9a52-1407f77754f1", "value": "4D33F2D0A905F087D749B84CCCAF9D078B7EDD1B473DBC92017AC0871E616B96745D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263289, "uuid": "23bf8ea4-8020-4d6f-ba8d-535351b60bec", "value": "1536:oXXtg3K7774iXfEz5lnm/hQMOEYus1GplItcrM:8Xma7774mfCyWMB/4GplLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263289, "uuid": "4606fc14-18ba-42c5-bdf3-570e20b7cdd7", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263289, "uuid": "7734145b-483a-40b7-947d-695f7a725e2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263289, "uuid": "cd957266-c3fe-4e3c-bd89-ebe379994dac", "value": "statistic-1801949558.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f4713e-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261119, "uuid": "55a9129b-5f73-4d73-b772-3a34a92b6ddd", "comment": "Malware payload", "value": "96613dcad297cd23a9de6f6b44d700c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261119, "uuid": "d6f79d47-2c49-47c4-b7cc-1e74fda2daac", "comment": "Malware payload", "value": "0c0be047b701db871f89426a8bf351346286535192de00db56bf9a2fcd1eff51", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261119, "uuid": "0ff0b3eb-8160-4fb8-8843-8ae5857d5d97", "comment": "Malware payload", "value": "3987d4ada523bac368807ca1c871f75e5d8e2236", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261119, "uuid": "5710a792-6e3b-4b32-8d75-83f1728c9674", "comment": "Malware payload", "value": "dea656c3914b0a8db8d4d47f227187b687c06091d597641874b434a8f34198b1946935797089935888a14f2225bd512a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261119, "uuid": "524de72e-5a15-4d53-b98b-ac0b250774ca", "value": "DE33F17147DCCAA76C72E0BFC4C6F845BFF29821C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261119, "uuid": "3ad81ef5-5fc1-4809-b64c-5c0727bfef0d", "value": "1536:BjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w1:lB9wzbqtWb08UscYJhnpjyq9qEK0w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261119, "uuid": "6c947904-0782-4f8f-a259-502fdeb66696", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261119, "uuid": "282b3ef8-443c-4e6c-8adb-422e9d598da1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261119, "uuid": "14d001c4-ad5f-4364-8e7a-aca1abf4cd3c", "value": "diagram-321499797.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec05bb9-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261562, "uuid": "27578538-9219-44aa-a687-a21583b84e2d", "comment": "Malware payload", "value": "eb6c1d2af1cdd7717669bed0c26e6881", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261562, "uuid": "e8858c2f-659e-4c55-a7bd-cf4ead582813", "comment": "Malware payload", "value": "0c11f4ab62c252f4c7c5a18d581bf99840c7f1f9e848e0be274784fcec3d2c75", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261562, "uuid": "09b6cfad-d6fc-49e7-8d3b-6571f48c0b4f", "comment": "Malware payload", "value": "dfa5e4a7bdaaf2d65a4a9d0fa6f3deca53bfc229", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261562, "uuid": "b36ae4f3-2414-4743-bf75-8ac4f50b2ef0", "comment": "Malware payload", "value": "58243bdf2bcabc77786e627d3e3a0f47205b3c79c95fce1df2a162397b26252b56e4bc8619ab3a66c8b81732ff7ffdc8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261562, "uuid": "b7d2d39d-1ad4-4261-907d-17e9f2706060", "value": "0E3302714BACD9F628B2E0AFC8CBF504FFB1D455C4D786264AF871C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261562, "uuid": "083046de-4bcd-4fa2-9872-4126e63b13f6", "value": "1536:HjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX51:DB9wzbqtWb08UscYJhnpjyq9qBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261562, "uuid": "c17c0573-d274-47e5-a7f7-ebe131769bdd", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261562, "uuid": "6dfcb802-261a-48ce-919a-930e88c65891", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261562, "uuid": "404064c9-8dc8-491e-bf05-195250adffa3", "value": "diagram-626585061.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977c5c28-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264046, "uuid": "ead0bded-357d-4194-ba7b-51457694a99a", "comment": "Malware payload", "value": "916d0a7ec1b9c35660130067a7511ef6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264046, "uuid": "48d07903-a96d-492f-9252-67bdf58829c8", "comment": "Malware payload", "value": "0c239181b39cb07ffe38c14e147478a0c1c14acf2074d223627d29c67fbe61cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264046, "uuid": "4b628f9e-be61-42ea-9269-d1e2daaa11be", "comment": "Malware payload", "value": "6e4d79cb091e78ec459dd819690e809eb18059f9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264046, "uuid": "bda5ebfd-ed7e-4546-8e08-773979f41cdf", "comment": "Malware payload", "value": "3184010ca266a41741eca4580a3dff402f97f2c056f80aa1882268fe78b8b47a7b12c2153640a9fe438320f3c6dd83bf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264046, "uuid": "745448c1-b4f6-4a80-abba-99f05c589477", "value": "F13302A0A906D087A719B81DDC7A6D038F3DE90E473D6C53113EE0874E629FC7649E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264046, "uuid": "48e009a1-cbe4-4178-9e58-0e8d609976af", "value": "1536:BXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qCx1:FXma7774mfCyWMB/4Gp07J/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264046, "uuid": "7cc5599d-18a1-4fa1-8dbb-0079b6281dd8", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264046, "uuid": "f50430a5-355d-41c1-8b68-107a2e97b8b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264046, "uuid": "2b5c44c1-703e-4d9d-b6c8-638e7fa325f1", "value": "statistic-4490235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8489f32f-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257572, "uuid": "3ed1bd60-37ff-416e-a394-dbbe5010f4b2", "comment": "Malware payload", "value": "d58166343de9a4a03c478774bb0236a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257572, "uuid": "181ddf64-316b-4905-ab07-7d5cc0e77030", "comment": "Malware payload", "value": "0c2be02e229f9abecceaeaa08adb86b6556eb33c293b42bba50b860111b393aa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257572, "uuid": "2c6cb351-2ec2-4b70-bbe9-987900ce190e", "comment": "Malware payload", "value": "4c6c82e85c1b07f3087ae096423525ce28f3c7ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257572, "uuid": "b0539f24-e793-47fc-8e77-0fa86ce72faa", "comment": "Malware payload", "value": "b54a4132889d6d0deb6a299b238b8923e1d4f5db4cbed8bfa21b8518fd6bfdc0a38eae7d2dca34e8eef47bc35f88dad1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257572, "uuid": "116ac699-beb5-48e1-95b0-fbc6b10a6ec7", "value": "1933F185D65411CDCB4FD2EB30F6F6CCE1DEBA834D9A68D09BAD164480970F0492E68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257572, "uuid": "800c03ed-e779-47fa-8836-97f761ac02d6", "value": "1536:g2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIno:Rfqhp+g5ru2kmUEt88o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257572, "uuid": "33b3b692-4843-4bb2-96b4-49e9ea287a15", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257572, "uuid": "bd18e905-a582-4a11-98ef-de320a0de80f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257572, "uuid": "7b1cadc0-c522-48fc-946d-71433f17d8b8", "value": "catalog-1698644874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287ce69f-b74c-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1621282328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282328, "uuid": "9ad39957-1320-46fb-aacf-6f0b9ff2289a", "comment": "Malware payload (FormBook)", "value": "998a7a8336338d87419ff23e04c54de7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282328, "uuid": "99b18cff-5c9a-47c4-b440-f57ef8e0bec1", "comment": "Malware payload (FormBook)", "value": "0c3748f23fb4ade0edb0e497f0f39adc528cec04ac7530e15e3f5baad6b69567", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282328, "uuid": "35f4e08f-2398-4eeb-8191-84fb77fd5aeb", "comment": "Malware payload (FormBook)", "value": "0ae9a9404f7836e94d6f4099b00dab766c69e0bc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621282328, "uuid": "40a43f41-e694-488e-b7e3-2b37dddfe133", "comment": "Malware payload (FormBook)", "value": "119de6cab9e2b2685fdc3a874757b87e68e832b8251c2423fc653253229ee828a242da3089010cc3d24a89bd03701459", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621282328, "uuid": "0e271722-472c-4e4b-8cb9-caa49582a770", "value": "9C259DF2B2D04476D12F1B741A1BA6704A267F157A58297567F83D8C8FBA2D02C3B18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621282328, "uuid": "bd472984-9bd6-4e27-a55c-e3cfb7596a9d", "value": "c94f50af201763db6490061394abc384", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621282328, "uuid": "1506fb6f-830a-4f95-b4e5-5754f17bcd53", "value": "12288:Pkg3UovZ5r7f0IfggMvlgDjNSwQUe7vUzBjpu08eiQ6qR66nIF:cc/f0If2lkIFTk8eilqR66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621282328, "uuid": "f5621db5-6640-4f26-a23f-1faddc6d9741", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621282328, "uuid": "9b27f417-6cf1-402d-9935-dbfdec6dc1e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621282328, "uuid": "631d9bad-eb5e-4e03-a4cd-25b21786aa51", "value": "Nepodmireni racuni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da15a91b-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259004, "uuid": "ef13104b-ab8c-40c9-bd07-6f285ea7205f", "comment": "Malware payload", "value": "0be2c3372d0432ced30320cddee35fa4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259004, "uuid": "2a1f4784-ba11-48bc-acd9-8c7d822d6f83", "comment": "Malware payload", "value": "0c5937607b4db17f52d29877038934130334615f3c75ea58860a3c516aa6ce97", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259004, "uuid": "c1f05a87-3a60-4f1e-a790-799324cc78da", "comment": "Malware payload", "value": "73c05681e61633ac4aca6ee50bf50ad0db7724f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259004, "uuid": "f37c4f98-5787-4825-a247-48bc8e21884b", "comment": "Malware payload", "value": "30903e6e57bd37d549ff7296d046171321c20b84ce80e4ec26a98c28e7048399c8a314e119cab799d3e6d81441eb90f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259004, "uuid": "cf93d6ec-ed17-4e90-b9a7-3a4e94714556", "value": "46330286D264214DCF4FD29730F1FACCF5DE7A430DA9A4D0A63D2B4581931F0492AA5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259004, "uuid": "a7c31fa0-ebe3-4968-b38c-0d07dc9595a1", "value": "1536:b2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ31:afqhp+g5ru2kmUEt88Ix1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259004, "uuid": "bf20f85a-ebb9-4e16-96d7-04707c050871", "value": 52722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259004, "uuid": "bd85aa98-9216-4b76-b288-aa437fc31019", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259004, "uuid": "ac5c83f5-2414-4199-abf7-3afe1df8c03b", "value": "catalog-7427012.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac97fcc7-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261505, "uuid": "a876b58e-c9ae-4235-bc8c-47c2d0902327", "comment": "Malware payload", "value": "22b8bf1c7927c965a083bf45007e601d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261505, "uuid": "8c0a26a3-eb3a-4c05-92cb-03c38d7fc531", "comment": "Malware payload", "value": "0c77875d734d0119e189c457143fc6f13723130fcc980d6855bfed462bf52886", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261505, "uuid": "c93e6fa4-f268-4be6-9916-3123fc3ef389", "comment": "Malware payload", "value": "abeeb868a19f91b3c3823a6c4e92647633a374b4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261505, "uuid": "5fca23ba-fbb0-4b14-97af-ab121006db6d", "comment": "Malware payload", "value": "dd0f49cbeb82696aa2b501502e4eb404eaf440f68c8b492b42b5a7572bc2cb39aaf566e6e3fb610ae8acb12d820d25c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261505, "uuid": "6a161e5a-8535-41b0-9c4c-34ec8c8fbbb5", "value": "9B33F13647ECDAF62972D0BFD8CBF905FBB18465C4D68A2249F8B1C8B6D01955E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261505, "uuid": "a8af949e-bbee-4761-873c-b09f9cb6452b", "value": "1536:OjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXTz:mB9wzbqtWb08UscYJhnpjyq9qBTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261505, "uuid": "e30058c6-abe0-4b92-ad9e-06126f884969", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261505, "uuid": "f9ad7ed7-cbde-46a4-9db9-1cf64a250f7e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261505, "uuid": "5e774565-e353-491c-bf72-77324454d16a", "value": "diagram-599990074.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71083be-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261549, "uuid": "1d29602b-d3cf-4d97-9635-b72653fcf6d3", "comment": "Malware payload", "value": "b7bf6a53130607f9f08711843e501d55", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261549, "uuid": "3cf9ef3a-e46d-4234-94d3-66f4f9e3f391", "comment": "Malware payload", "value": "0c8352fbf1f2bd6188d5fc6c23ca1c86b8a8b003547c3bd43c8563dc4110be6b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261549, "uuid": "b9f6807f-803d-4a2d-b11c-176f37ce9b76", "comment": "Malware payload", "value": "4651f3645f95425f3adfbf4931b8968b4e1fe19f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261549, "uuid": "ced92033-c954-4794-af47-87ef119432b9", "comment": "Malware payload", "value": "34d45f86af8f579ebaec5c244df703a03272bb1b59bb3ee7cbc5233c019183cb12b5627153cd9135418b498328d54c2d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261549, "uuid": "587c6788-08d9-4354-b54e-00411a54283c", "value": "3B33F13147ACC5F669B6D4BFC8CAF604FBB19495C4D786624AF8B1C8B6D02845E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261549, "uuid": "065fed20-6855-4221-b430-72343674691b", "value": "1536:ojfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXz4U:IB9wzbqtWb08UscYJhnpjyq9qBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261549, "uuid": "f4fd0063-98e8-412c-8412-4d7ec8f212b5", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261549, "uuid": "e12d5085-1fea-4f0a-b273-8a37d469bb52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261549, "uuid": "f01a9117-6d60-414e-a8e7-ec66567b1854", "value": "diagram-619993441.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856e0195-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259292, "uuid": "8bd13e59-c03e-488e-98c3-f1315737e53e", "comment": "Malware payload", "value": "2d3ea72428ff97c06cce74d8eb6ec3be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259292, "uuid": "2463cbe5-fb85-42ea-a9df-6e76ee2e0664", "comment": "Malware payload", "value": "0c984314732a3140dc9d02e2c8d82b9c806ebb55e46bf325dc13809695cf77aa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259292, "uuid": "a81362c4-044d-4324-87eb-67175523b44f", "comment": "Malware payload", "value": "e78012f9c83bf8a04ae20d9d3a4cab653e137142", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259292, "uuid": "76bc8978-f353-48d9-bc97-998a2d9599af", "comment": "Malware payload", "value": "1620dda008d1d95a8556c34e95f56b8e4d0f34fd68ea32ee2617f6dfc6bc935f5544a33c50b18d47a83a51616e2108cd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259292, "uuid": "fed80a6d-c4b7-4002-9fa1-411fd27c7dc6", "value": "4933F1469218118CCE4BE1EB30B7FAD8E6DDAA430EA9B4D09B7D2745C1A30F1492F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259292, "uuid": "3be52a23-3d4e-4a24-9ee7-b4ea7cbb88fe", "value": "1536:e2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAulSwBBh:jfqhp+g5ru2kmUEt88AuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259292, "uuid": "92892b4e-5762-4426-9aa3-4a72883a4c24", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259292, "uuid": "b34426ac-7517-46fe-9ae9-96a6638d0f11", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259292, "uuid": "f26806d5-1e58-45cd-8355-69e8cd483495", "value": "catalog-929950521.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000a46d3-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263363, "uuid": "da116da9-4363-46b4-893e-344ca15b641e", "comment": "Malware payload", "value": "de1661c828a9590fbd763a3efc408c94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263363, "uuid": "6039c2b6-4d77-4af7-8dce-5368111795e7", "comment": "Malware payload", "value": "0cb43866e624bdf938d17b895039b8bd166334390bf9c05c442424df8c7ea138", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263363, "uuid": "167d6016-84f9-41e1-b173-0e479b543ecd", "comment": "Malware payload", "value": "54f2efb319bacb9dd146ca6f8206e1ab643f8261", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263363, "uuid": "c5956cbc-052b-40eb-af4b-257ae3227841", "comment": "Malware payload", "value": "0ed0c7bdf215cc93c734a4578a9dbd55e901d4618d25542aab9bcac0132794215ccf732f94045da36dc6a9bdf2d75750", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263363, "uuid": "185d6bc2-fbc4-4873-abc1-92323f3995ad", "value": "EB33F1E09902E08E9755BC59DCAB9D078F3AC91E037D3883017BD0475EA1AB5A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263363, "uuid": "b2e505cf-61bc-4e05-8b87-5451f1648946", "value": "1536:uXXtg3K7774iXfEz5lnm/hQMOEYus1GpphO:GXma7774mfCyWMB/4Gppk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263363, "uuid": "9aa3c2b0-45b8-4c49-98f1-12ef7d3a94d7", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263363, "uuid": "b8aea4e1-c6f2-4fe8-8178-f9a659eb489d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263363, "uuid": "2c81d18c-694c-4aca-8ad3-2c27222746f6", "value": "statistic-1841447364.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f93552-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256898, "uuid": "8c192ad8-e596-4081-8268-53b7795c6df7", "comment": "Malware payload", "value": "a5938fb47a72205afb0af854e754ce9e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256898, "uuid": "c35f65b3-e15c-4e07-9734-49c6c42d96bc", "comment": "Malware payload", "value": "0ce94b51e75a2da1d41b47e53639d337a6b474b797e17f2771f809ecfdd1e071", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256898, "uuid": "6ed2bbc6-1ab5-4a05-8826-eb5527ea6d51", "comment": "Malware payload", "value": "1a97623d184c43ae43a2ab9589607e5ef79a898f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256898, "uuid": "bad1e85a-857c-4126-bce0-01f8cc179b13", "comment": "Malware payload", "value": "f5897a34a12ab28c08896e0107f1aacddee3c48558ad4a2daabd237ef24a6743a177aeee45c55d8f94b9064b684bdde4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256898, "uuid": "445fd868-1a29-4eb5-86dc-552f9443afe4", "value": "1F33F1469218018CCE4BE2EB30F6FAD8E6DD6A530EA9B4D09B7D2745C1A30F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256898, "uuid": "d8ad9aed-19bf-46d0-aeeb-23364cf79957", "value": "1536:S2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuZS4BBj:3fqhp+g5ru2kmUEt88ACb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256898, "uuid": "3f210e6c-c54d-4e16-8289-dcff81092037", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256898, "uuid": "d55c7d92-a855-496b-8661-c5599660f8cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256898, "uuid": "6000292b-868c-4371-a66d-2dc6c32b8b1a", "value": "catalog-1184631828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b01697a-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261448, "uuid": "77b010d8-0776-4782-8ea3-0f2da4c06847", "comment": "Malware payload", "value": "c9ef9471d8facb13c17c499dbc8594b7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261448, "uuid": "56c6489a-3cab-4c9f-8996-9caa1955b1a1", "comment": "Malware payload", "value": "0cf34aadd5001653af7175eaeac9ce4ff45395d33369b050482736ccdc531222", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261448, "uuid": "d4025024-0d1c-414c-980b-5db0857c51c3", "comment": "Malware payload", "value": "268b9fc3f8bf98d6923915f3c28ae0606ca0c4da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261448, "uuid": "47f47ffc-0131-4609-ac89-0d7ffba9d3ca", "comment": "Malware payload", "value": "689fda267ad57f1154e36f7741ba56ed00a06b628018a6a2f32cb1f1e1f89c3fdd4f33374dcce6d29ad236fa52e7fceb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261448, "uuid": "8266dc8a-b48f-42fe-8af0-fe5f7be84e0f", "value": "9833F13647ECCAE62972D0BFC8CBF901FBB19465C4D68A2249E8B1C8B6D01955E32E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261448, "uuid": "8f1c9ed1-0f0d-4cb8-ade3-f65844af36b9", "value": "1536:EjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXrk:sB9wzbqtWb08UscYJhnpjyq9qBrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261448, "uuid": "9be95bfc-1647-4a0a-b183-b8e7aef0c8c2", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261448, "uuid": "8e5f0688-ded9-4038-8a1b-294b76f5d149", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261448, "uuid": "ef6a632d-f4a8-488b-ae1d-2e2e52f9dd3e", "value": "diagram-553548945.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a86c30-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257324, "uuid": "b22e0abf-d15a-4868-ad3a-7d946fcdec05", "comment": "Malware payload", "value": "016e2e13f1a1ca09b223babdbd09f1d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257324, "uuid": "aa0936e5-e04a-43a2-ac68-c6851060f8ca", "comment": "Malware payload", "value": "0d010c4ac90e3cd23d2ecd19383fa025ebd8c2b974391261e934fcb9d2a417db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257324, "uuid": "017c5376-42cf-4896-890f-6c789881f14c", "comment": "Malware payload", "value": "c01128492c31569f8a65efb646185ed6e5ffce7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257324, "uuid": "0da5d0a3-868f-44a2-af71-a2a6ad01b5e8", "comment": "Malware payload", "value": "4b1f49d2ecff2bb6703b2a1e2603ace59f434021f114deac7bc76c2c4a1d159348694aa59c91b3c3d384f13e55b0b107", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257324, "uuid": "c4c9bd4d-17c1-4bc3-af26-3e6d062867fa", "value": "8133F2469214118CCE4BE2EB30F6FAD8E6DD6A430EA9B4D09B7D2745C1A30F5482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257324, "uuid": "6649df2b-850b-448d-9a17-ba020d08bf18", "value": "1536:y2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuSSD:Xfqhp+g5ru2kmUEt88ABk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257324, "uuid": "67d21d02-c0da-4e78-91f0-8b25da42d892", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257324, "uuid": "82feac8d-2e59-4fd6-ba17-6ec3e6887858", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257324, "uuid": "4c73920c-12aa-40d2-94ec-cdcd9069307f", "value": "catalog-1497411134.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cb1e5e-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261220, "uuid": "0df93cbc-7321-41d1-a015-1b3ce07b4dcd", "comment": "Malware payload", "value": "2c37aa35838c3bf85b5cbb4a4097cfc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261220, "uuid": "9b707330-357a-4bc8-b422-9cc9e1759861", "comment": "Malware payload", "value": "0d2cf77808581fac71558ef57dce57c3671a45e55d4a454a024337ef26b3ca8f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261220, "uuid": "24d51d2c-f20c-4e92-b40d-2f5d68d544b7", "comment": "Malware payload", "value": "66fe56f6c7673397d3db5ea575fe132dba36854b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261220, "uuid": "bf2e58ff-94a5-4c76-a06e-798ac8da8e95", "comment": "Malware payload", "value": "25e34e38031180f332c0c3cb0b0db147c810e8f071f50dac8746cbf1ae75cfa8c6fab9f5715549ee50a7d38a0ad25560", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261220, "uuid": "f98be0a2-ef86-465c-9a06-81e740ca9f88", "value": "D333F1314BACDEF628B2E0AFC88BF504FFB1D455C4D78A6649F871C8B6941559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261220, "uuid": "c79e6dfc-7fd6-48be-b9ed-83ed6ca8140e", "value": "1536:9jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXmd:ZB9wzbqtWb08UscYJhnpjyq9qBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261220, "uuid": "248ddea3-6f72-4d3f-b1c3-d75cb0c69d6e", "value": 52849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261220, "uuid": "cc6980e1-3abd-4dca-a4e1-9ada25466b13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261220, "uuid": "bb919337-959a-4bd2-957b-d99c5b922e4a", "value": "diagram-41507795.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8700592a-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259724, "uuid": "de64fbfb-12a6-4e0c-808b-6c5ce7150eca", "comment": "Malware payload", "value": "697d305e1830ed72142b23bd64023962", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259724, "uuid": "4d31494e-e56d-4b1a-8476-ac796c5cfe12", "comment": "Malware payload", "value": "0d303e25b2ec01c1725119969279699282c7a3b31298cb3432f2784d0af0e23d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259724, "uuid": "f1298584-b01b-4333-b3d2-981bc4e530a6", "comment": "Malware payload", "value": "393583cc8e46ce92b70060427e8cdc40aa799f86", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259724, "uuid": "279717ea-94ab-42db-a31e-c7b8b72d3eb3", "comment": "Malware payload", "value": "3be8f43e81e3fd33e84ba00ab3211f21434d8979b90c424c0174046e64a0a65e9f200ec896bb795603f858131250b41e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259724, "uuid": "24c3e09d-84c6-47d4-b250-d086db0b1609", "value": "5933F13147ECDAA62DB2D4AFC4C6F504FFB1C4A5C8C78A2249FCB1C8B6901959E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259724, "uuid": "44a27847-ffee-4388-bbf1-2281a0a3074c", "value": "1536:YjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX5Ic:YB9wzbqtWb08UscYJhnpjyq9qB5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259724, "uuid": "67b24c97-89ac-4170-9dc4-c6fa6942ed6b", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259724, "uuid": "29a0a7a5-6df8-4505-ad39-44d14e6f2444", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259724, "uuid": "dd5667a6-7fba-41b0-9c20-91dc300a01e2", "value": "diagram-1270399541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bd4b63-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259611, "uuid": "2a392a7d-e1da-404a-8ecd-6b0faa2d481b", "comment": "Malware payload", "value": "6812c0d92a31e5e79c89f266d7341687", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259611, "uuid": "82a0e329-4424-4d23-b7ab-a219558866f9", "comment": "Malware payload", "value": "0d4e56e77b41aa54725a86a047cbc727930b73cec616a9e8ff3501e40285161c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259611, "uuid": "45e9ce3e-8744-407a-8b04-3f4af74ad362", "comment": "Malware payload", "value": "f706303dd3feb992e43183785c795fb6f8bbc65f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259611, "uuid": "6b2a2d25-33c0-4d93-bdac-29c533651a45", "comment": "Malware payload", "value": "3011ca90c33f07c8cd206e94326f0b1896139bf3bb252f76a155f370e58b2c7ddd0b15a544c2c51f3d28a0f12ed52139", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259611, "uuid": "48d53ee1-f24b-457c-89b4-9d5204b4cf68", "value": "3C33F17197ACDAF628B2D4BFC8C6F904FBF2D495C4D78A2246F871C9B6D11944E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259611, "uuid": "94de05ad-5a17-4224-aa3a-0fe54148e33f", "value": "1536:QjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXB5:QB9wzbqtWb08UscYJhnpjyq9qBB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259611, "uuid": "59c5ec5c-064b-450a-a2ba-873a8a974ed0", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259611, "uuid": "5f73f156-0a7b-4be1-887d-020c54533e41", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259611, "uuid": "b0c19e23-97e3-42a3-b294-bdb7d83cb3f9", "value": "diagram-1183976290.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09144d2c-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263378, "uuid": "4207f0a8-29f1-48d1-8f07-bcf161873b18", "comment": "Malware payload", "value": "5c7abd9a1917e37105bb6423045f3e6b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263378, "uuid": "a01f5e43-f513-404c-8c34-ec02d18651fa", "comment": "Malware payload", "value": "0d6829637f9494855a751956d37b510c9ad3f1e8bd9b28bea728f8f25849081d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263378, "uuid": "668e89df-cf8e-42d2-9898-7685d38e37ed", "comment": "Malware payload", "value": "4aff1820c8b2e8d55617f18fc69afe734415e12d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263378, "uuid": "c6390db8-4b79-441a-aaf8-f45f954c448d", "comment": "Malware payload", "value": "d381450cc32418669cc58c90e54dec6477283a59c8b4febb574d639aa0a089c5e56b259a315d0b3d013ca3a67e71fc47", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263378, "uuid": "3fd07536-3505-4b1f-b7a1-58de390a835d", "value": "C133F2E49902F08B9749BC5DDCAB5D078F39C91E037D3893017BD0878E61AB9A645E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263378, "uuid": "56bfff72-4588-46f5-92c6-d3c097d3aede", "value": "1536:FXXtg3K7774iXfEz5lnm/hQMOEYus1GppnC:BXma7774mfCyWMB/4GppnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263378, "uuid": "7adafb8b-e20d-4ab4-bf34-734dfc1a8829", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263378, "uuid": "828d4626-4340-4861-8f21-77a8c3f9468f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263378, "uuid": "6a70e235-d02c-476d-9673-b372f40536c9", "value": "statistic-1851640547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50054317-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260490, "uuid": "4d4f66b5-25ff-4d76-bcd7-375448a59532", "comment": "Malware payload", "value": "50806e91bb14e587d8dd6c4e4f82f1c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260490, "uuid": "99adc01f-a573-4f8c-a332-d5b061c5f088", "comment": "Malware payload", "value": "0d73fe183d504a8078a75fa59ff7e2ecc04c2a331f6343803bf396de818d40f5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260490, "uuid": "9ab59414-1fbd-4c15-813a-904118b9c63c", "comment": "Malware payload", "value": "07c6fc8f0288eb05a39cf17b32babddcc735f25c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260490, "uuid": "aa5b565f-d9a1-421a-822f-41e75f18321f", "comment": "Malware payload", "value": "9a99ff038690b0a0241930641cf1969d9e5e71ca8a2e8193238fc78ff210015d7b79100a0f89ba98325550759c7ab3e9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260490, "uuid": "118049a8-c853-44b8-86f1-84f124c42483", "value": "9333F07147DCCAE66876E0BFC4C2F808FFF28951C987866649F9B1C8B6E52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260490, "uuid": "0b3e318e-446d-48d4-8ca7-e3945245532d", "value": "1536:tjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w3w:pB9wzbqtWb08UscYJhnpjyq9qEK0wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260490, "uuid": "dc9f0f8a-0afe-496a-8ee3-496bdfd43a65", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260490, "uuid": "64e5fe06-2c88-4982-b64b-9a5ce77a54be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260490, "uuid": "f2340f98-2bb8-477b-bc84-f192944622cb", "value": "diagram-1812728631.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493f1bd6-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259191, "uuid": "b66e35ab-1476-4782-9f07-6f6d6813cd5d", "comment": "Malware payload", "value": "7cc6eab309f5481bfab95b8a0a33ae48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259191, "uuid": "fb1952a6-463a-47b3-a55b-9e5ff4d2bdab", "comment": "Malware payload", "value": "0d860e537947d7a1a98e80177e0df5790b6d943033164843b4805d269d4841ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259191, "uuid": "1e286bcf-6baf-47ac-9d1d-90712521e388", "comment": "Malware payload", "value": "07e5c90f9a4252cbe658ff9a6a0fdca9edbfbea2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259191, "uuid": "82e00333-4f55-45ee-8fc7-05c19f23dc34", "comment": "Malware payload", "value": "e5e1aa84160bb1105e66ac48ba0cf5c8e8f0963b93fc0fda6d24b549f78b357a94a68bfb0efa8b334bb225f1cef40dbd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259191, "uuid": "383470f3-fe8c-4247-b985-ea8dcd53aae5", "value": "F433F155A518114D8F8FE1DB20F6FADCE6CE7E430EA9F4D0AA6E1745C1A70E0492E18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259191, "uuid": "8674ac96-1635-4bda-a875-bd74db1b5632", "value": "1536:g2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIps:Rfqhp+g5ru2kmUEt88ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259191, "uuid": "36d7ec9c-ea2b-4548-876a-937849ebd68d", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259191, "uuid": "09cd9931-9b47-4012-a4aa-890ccdd58b6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259191, "uuid": "c0de86e6-6a83-4c16-97e0-5ff7ef3fd616", "value": "catalog-847383415.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9381ce58-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260174, "uuid": "86b396a9-73df-40ef-bed9-a20dc9adf6be", "comment": "Malware payload", "value": "383893ce503938a29d209e7cd1301ce1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260174, "uuid": "4f8f2f22-1d1f-42c5-a9c6-4355668f1313", "comment": "Malware payload", "value": "0d8c49ff898896ae01203c9c7d9dbb33f1348192bc67d1614b759ca464a8a99c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260174, "uuid": "ab50848c-1e3e-4def-9300-e19ca694a7ad", "comment": "Malware payload", "value": "d48832f8be2fea166dfd0abee1e3487c2fb8ecb1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260174, "uuid": "bb1a894c-29f7-467b-96df-8f21ff276184", "comment": "Malware payload", "value": "2cf5b5a11b86eaa14b22ee958c9c029f8e63f148d086f0d4fc3271d94838e0a986aa8efca7496262392594e9c4c2d2ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260174, "uuid": "bae205de-0b6a-4bd3-9c8e-6a5b9eddae36", "value": "5333F1314BECDAF669B6D0BFC8C6F604FBB18495C4D7866249F8B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260174, "uuid": "77ef255a-d774-4262-96bd-1e68bfb88c8d", "value": "1536:SjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXs45:iB9wzbqtWb08UscYJhnpjyq9qBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260174, "uuid": "6ec313d1-b3c8-492e-b067-ae3820dbed51", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260174, "uuid": "7f31ad79-9f36-44c7-909a-513d82d5b569", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260174, "uuid": "2fabb538-bcab-47c5-b383-c7159d4fc326", "value": "diagram-1610337427.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484874fe-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262195, "uuid": "b3d6630d-3dd4-467d-91a3-18034896e000", "comment": "Malware payload", "value": "99188b83c6d00d0dfddce4f3b49fd13d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262195, "uuid": "23bedd50-351b-456a-ac15-29d8d3d49412", "comment": "Malware payload", "value": "0dbb1483e8d19b9a4f0aff5cbb22e63a335acc1d2d65431a424b90493a8ca66c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262195, "uuid": "d0d00939-26d1-4a5f-909d-c868fddc046d", "comment": "Malware payload", "value": "e966c68c99f30ff62a8e5fb1f18bc77940a120f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262195, "uuid": "6bf446fb-e50a-4285-8aaa-ad2517b01147", "comment": "Malware payload", "value": "f847777c754a0144d90f67597d549d8cc70d962b90b632a5988928ab80ce2ad890fc42ff321ab20562f144a2a6900a1b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262195, "uuid": "f60ca69b-2807-45b4-8525-d26a59808c95", "value": "3833F1311BACDAE66DB1D47FC486FA04FFF1C865C4AA871685F8B0C8B6D02519E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262195, "uuid": "2cd04df0-feba-409e-ab6a-8c7c8efbc83a", "value": "1536:NjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67t0b:JB9wzbqtWb08UscYJhnpjyq9qawK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262195, "uuid": "b840d55e-ef1a-4fd5-8c0c-9a214aacd0aa", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262195, "uuid": "9c93a837-d37e-48fd-afc7-425747971923", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262195, "uuid": "7672b16e-60ad-4bbc-8c44-b774f04946ca", "value": "diagram-973359882.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fecb6ff-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264007, "uuid": "23d761aa-74c9-455f-8244-2a611ada2fab", "comment": "Malware payload", "value": "d17e301d15cc16b1d36f6f549ddc9f23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264007, "uuid": "f52d11e0-fce0-4880-ad31-eef46101a7e9", "comment": "Malware payload", "value": "0dbc6b4561dfbdc18d6abbaad375881df6971f94e29e0b69e11367a67d5ed2ab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264007, "uuid": "d563fcb0-543e-432e-a1b8-11eadd428a21", "comment": "Malware payload", "value": "812c1b49878c2f5a42aa2bc6f683126bd14165ce", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264007, "uuid": "6d9e7652-fc4b-4456-85ac-e90f20841522", "comment": "Malware payload", "value": "5bad7bf2eef702beda5e1ee4258e131935955b661767b5844a5ace6964ebb509a90dd40d74168f51361927f84890f31a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264007, "uuid": "6d11b231-af38-4b24-84bf-64d0bad7e95a", "value": "FD3302E49507E0479748B82DEC6A9D438F3DE91E033E78D2112BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264007, "uuid": "a784a0d8-d945-4da2-8fe0-74aea93d9802", "value": "1536:0XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZI:AXma7774mfCyWMB/4GpWvZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264007, "uuid": "90b8e78b-49dc-47a1-8cff-8d0f8d36b405", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264007, "uuid": "3b89909d-771f-4fd9-a83c-d564a8428ec8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264007, "uuid": "5e67b0c3-663e-46b2-b9b2-3fe64d973866", "value": "statistic-433778649.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffb5d79-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258236, "uuid": "a4cea130-bd92-466f-ad2c-3d39029cd286", "comment": "Malware payload", "value": "279957bbf150713f969a701bfd06e25b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258236, "uuid": "c01e4d16-dd48-45ec-bc97-45aa16e060af", "comment": "Malware payload", "value": "0dcc71f2f0a62c1ff95527c5f15b957e3acfdc01f64b666a95f7d88d2c287734", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258236, "uuid": "3d325d27-645f-4a10-8af8-e421e9279fa1", "comment": "Malware payload", "value": "c9f07454ea238be55c72aa605ecbb706c51d0242", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258236, "uuid": "ed78093c-0140-43c4-93c3-a21b4fc2eb5d", "comment": "Malware payload", "value": "ef59f9361cfccb1fe91c697e7a43610ce09d1ac0c208fbfad11db5884a056405c7d04586ee6aa321f462720451644e27", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258236, "uuid": "7bf72bcf-389b-45f7-b48e-4b9bd7fb4f0a", "value": "0433F146D614018DCE4FE2EBB0B5F9D8F1DE7E430EADB4D09E6E2B0591520F1492E58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258236, "uuid": "674b45d8-9015-486c-a12d-004b8b211964", "value": "1536:O2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIQW:zfqhp+g5ru2kmUEt88QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258236, "uuid": "6ed56eef-5cf4-4b9a-9760-d4f4b1176d78", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258236, "uuid": "a07dea05-5dca-4a70-a15d-29b998cfab42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258236, "uuid": "a368eb09-ad9e-4ffa-84dd-7f4557eb36a4", "value": "catalog-274270243.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40e7be1-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264631, "uuid": "4bd0b6ac-a9e5-4dea-9b13-51f8a6706cd0", "comment": "Malware payload", "value": "af193c60d0ee85c6e2ed999dfb47bbc9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264631, "uuid": "f570e175-7b0d-4b5a-86d8-d2a7d8a644ca", "comment": "Malware payload", "value": "0dfdab53e9e0692ec71e1944c56ccc1a2abd2bdf3123c4b43a92225411c21b2f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264631, "uuid": "eba5ab5d-0220-4e2f-b2b9-6acb20a1c318", "comment": "Malware payload", "value": "7d6cd20215adcc41d64b32cd579d4ff0db110d54", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264631, "uuid": "34443f0b-8165-49e4-b2ad-5824bb642f4a", "comment": "Malware payload", "value": "ca6e25caef3f06e2df1c9f5b00ab817ce862f60d91de0cff466d83c03b48e73f20481830b5071c6e538cfd82779c0827", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264631, "uuid": "c8409226-1472-483a-93e4-6aab0cc99c06", "value": "E23302E0A806A047F758BC4DECB79D028F3ED91B077D7893116AC0875D61AF5A709D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264631, "uuid": "cc98f9c9-6c7f-4d88-aba9-bbc0ec04a51e", "value": "1536:9XXtg3K7774iXfEz5lnm/hQMOEYus1GpjIdgHV:pXma7774mfCyWMB/4GpjIdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264631, "uuid": "9948fd17-f863-4331-b2e1-970f80dda7f6", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264631, "uuid": "6ec37e3f-f641-4ea8-a640-5ce9652a39b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264631, "uuid": "c6e92c15-e962-4367-b675-efe4f474397e", "value": "statistic-866849227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e642316-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261320, "uuid": "561509aa-5e28-4e58-80ad-f9509e38f4b0", "comment": "Malware payload", "value": "cb162ed07983aa4683c8f4589dcd3844", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261320, "uuid": "cd6e6506-7fb2-475b-82d2-d575d12f2c43", "comment": "Malware payload", "value": "0e15e12035fe21bcb5074bf11cd0b699d05ef4cd1df370c1547da70836862a13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261320, "uuid": "47362311-0457-447c-a35f-b705abd7d2ce", "comment": "Malware payload", "value": "175124d9cc400d0d39594e6219368257e7163e48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261320, "uuid": "96594901-574f-4811-980b-0148ba67b488", "comment": "Malware payload", "value": "a88dfb76a0ba12e7a4e909b65b90fb11feb45fb19b8912073f5f9f831fd5a84f2fa2b7b2a36c076eceb791f366e70e43", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261320, "uuid": "940e3efd-97e6-4424-832d-b2d9965c8bc4", "value": "5A33F13647ECDAF62976D0AFC4CBF905FBB18465C4D68A2249F8B2C8B6D01955E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261320, "uuid": "683f6d3f-d32e-4629-9d3e-7f6a5f94e794", "value": "1536:VjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXgS:xB9wzbqtWb08UscYJhnpjyq9qBgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261320, "uuid": "a38b12c9-a2a5-4f9e-b5ef-8e66895b0091", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261320, "uuid": "ee483a5f-e425-4dfe-a55c-6fd1cd1e2358", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261320, "uuid": "4524c89f-7bb5-4f55-a0fb-36cf27e9517c", "value": "diagram-461481804.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e87632-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260146, "uuid": "ded7a744-5f17-4c86-8905-f7a833c6a917", "comment": "Malware payload", "value": "2a1e5f63c1cc42a7423029c65d0a9716", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260146, "uuid": "7acc8865-ada3-4629-b974-efc038e15562", "comment": "Malware payload", "value": "0e30d413d43ed94d38f3edb19723d111c3fe18377720fb60e600805f631beb0c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260146, "uuid": "9bab9471-82c0-494b-845f-5c6b8f03d10b", "comment": "Malware payload", "value": "75156ac3240d2e5541f0afff9e322074b4ec3306", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260146, "uuid": "4000a4b3-8f8d-4e6c-bd1d-9aac70692643", "comment": "Malware payload", "value": "487c3e2158fe7dd3de00b41051f65101cf8ac0e910057abf1efb196bec4944b35cd579d96f9c0ec21075a532308ce681", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260146, "uuid": "83484fb9-b3fe-44a9-b8a2-0abd81fea432", "value": "1533F13547ECDAB62DB1D0AFC4C6F604FFB1C4A5C8C78A2249F8B1C8B6901959A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260146, "uuid": "203e651d-3850-409e-aafb-4d70caf638b5", "value": "1536:gjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX9BK:AB9wzbqtWb08UscYJhnpjyq9qB9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260146, "uuid": "8e1765e5-f7a7-4ab3-9f4f-6449b0c56de5", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260146, "uuid": "13ba5850-9860-456c-a184-8ee0c7f2e86b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260146, "uuid": "11da85d1-1965-44c3-8564-94df7e09e1ab", "value": "diagram-1595759093.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39156eb-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261087, "uuid": "d7b0bd9f-6603-46c4-8a36-49aabec5353f", "comment": "Malware payload", "value": "7511ec9a3324ce015bdd1922a00d4c08", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261087, "uuid": "4264a334-cb43-4106-9a86-eaecfbe1d673", "comment": "Malware payload", "value": "0e30d48458aa911730eada4e702615f66b971deb04af1a68e61e6568ed68fe05", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261087, "uuid": "6e5bcb35-678f-49ae-9660-1fa4eee09968", "comment": "Malware payload", "value": "bbc15edad2ee277149c9f6905419ccabbca2faef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261087, "uuid": "b54f8bdf-0691-46f0-bbf2-d7e5bd128c15", "comment": "Malware payload", "value": "866f7d901a08f3616317ae57d021b6f1764cfd1811965a0c0180660386607f37debb0297b0195f0842e91ead4e59afb4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261087, "uuid": "e0bc692e-931b-4c05-b82f-2504cf4d16e2", "value": "2433F17547DCCAA76C72E1BFC4C6F845BFF28821C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261087, "uuid": "5ac65d81-54a7-47a0-92e7-26fdc7ad19c6", "value": "1536:JkjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0waO:OB9wzbqtWb08UscYJhnpjyq9qEK0wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261087, "uuid": "ee474dc3-90eb-45ca-b38c-0ef2f6d39a1b", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261087, "uuid": "a7f594e7-ef62-4fb2-a195-85d8f3cb09c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261087, "uuid": "f395c6d8-02b9-419f-8493-feae086db5ea", "value": "diagram-300399902.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a3870e-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260684, "uuid": "34658ad7-3e19-4d32-8efd-85853d949b11", "comment": "Malware payload", "value": "14d0eda16472372bd02bc3378fe7261e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260684, "uuid": "58701981-acfa-40f2-9cdd-38709b682f45", "comment": "Malware payload", "value": "0e344e08a8e6d2463dac0ac5c3bbfc1a9890a8d34ec321d676c379abefe96ee4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260684, "uuid": "909e4ae9-55a6-4617-bf01-26e5b5feab97", "comment": "Malware payload", "value": "bad7266204fd5ecf495b2633516996c2dbf9bd2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260684, "uuid": "0e8a9054-c6ae-4f06-b5fe-9ce218257ff1", "comment": "Malware payload", "value": "b7a94de6f4dc8104bc13eab4a5e71c38b80810b7be9060637052d1708d8e9db5767e44d373eb1a7b337a1799a8fdee5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260684, "uuid": "4fdb37c0-b840-481e-bd9f-56679173d5b4", "value": "6633F1314BECDAF629B6E0AFC8C6F604FBB1D495C4D3862249F9B1C8B6D01855E32E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260684, "uuid": "a26234cb-4def-44d6-9b0d-ba3fcdfe6ac7", "value": "1536:WjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXys:OB9wzbqtWb08UscYJhnpjyq9qBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260684, "uuid": "628ab503-b23c-45be-ad53-05365e1cf0a6", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260684, "uuid": "e4439417-cd48-40e6-a636-aabfe69a3ae4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260684, "uuid": "425bdd80-73a9-476f-861f-66735bbfddb3", "value": "diagram-1970787874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c35df3-b725-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621265600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265600, "uuid": "bea3a840-13eb-4845-9b56-b2fdddffc9c0", "comment": "Malware payload (AgentTesla)", "value": "2b0d30bbe2355ceae6f19c53c1f5f050", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265600, "uuid": "360ebd43-1891-480e-8c38-d363507f2cc7", "comment": "Malware payload (AgentTesla)", "value": "0e3b95f77003ed810f3f9332199144d84519d055036f05016f6fcc0b8e85a157", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265600, "uuid": "e7931bb9-ccfa-4caf-86e7-384ca2c00e70", "comment": "Malware payload (AgentTesla)", "value": "1814cb99d87b3df8a469d1bb87389d8f476259fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265600, "uuid": "f0bcc06e-2720-4ce4-b618-b95c94b5472c", "comment": "Malware payload (AgentTesla)", "value": "5f5a0ffbdb8c5f5d9f93bbd3a086d05b77dbaa0d2c249fd10a0965921671872bbc08bed02bd211b2b8a52de2cc2bad41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265600, "uuid": "5adb3468-4ffd-4219-bddf-6e97fdccbfdf", "value": "13F4D0A427E8DB65D03D43384934E5219BF06C93D726E709BEDD31A67FB2B425923702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265600, "uuid": "681a00ef-4ac6-4b77-aec5-d09dd433f445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265600, "uuid": "1896d1bc-e3dd-4c28-b389-e022e7607a0b", "value": "12288:g3VRzd/PpFe7niGUg7JAZGA8f629PEn8CcTTHclltkt+SHdxHpMTZ9Lryy0CmpKi:gCiGUGAT2h97T8lGMadxH+ryyDmkzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621265600, "uuid": "bac585c4-d34c-4d11-9c54-fce16f4da348", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621265600, "uuid": "795e0dd3-ad79-4847-9771-77d09d89a19b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265600, "uuid": "439cee92-0fa1-4c9e-a306-e65732a3f303", "value": "AWB#8001187 SHIPPING DOCUMENTS PL+BL+CI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c290104-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264430, "uuid": "8612a185-33be-4fd6-92a5-3dab8a344f3b", "comment": "Malware payload", "value": "d1e20380910ce8b0f91304d393f6cce3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264430, "uuid": "44c43966-9a6c-4113-86d9-d41cc5978b6e", "comment": "Malware payload", "value": "0e4909ecc100b13c783c9a1ab1194ef42774271ce9a087452bc6e2ab8ab118fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264430, "uuid": "ac1f61ba-3b4d-4932-b544-d981eb6386dc", "comment": "Malware payload", "value": "61f7f9500cdeedc250c3f4d67e999e25eeed9344", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264430, "uuid": "84780fc1-304f-4d49-81ef-546173a946a3", "comment": "Malware payload", "value": "488cbbaa0c5baafdb587020da0b59412bad2711f7e7731fbef90b3fcb07889c6bc8df6175173fdd8b2416e628e90f48c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264430, "uuid": "bf290a0a-d73b-4633-a680-2d63efb2a36f", "value": "BD3302E49507E0879748BC2DEC9B9D038F3CE91E033E78D2122BC1975E61AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264430, "uuid": "2378b6c4-279b-4365-b980-b63c6bcc03da", "value": "1536:6XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZC:aXma7774mfCyWMB/4GpWvZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264430, "uuid": "dd9a89cf-4c44-4c4a-8dee-d02cff787fc8", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264430, "uuid": "2c5921b1-d322-4718-aa4f-9ec52b3e93ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264430, "uuid": "a3c0bba0-756d-4c5e-af85-0be50a5aa87c", "value": "statistic-716558410.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f54aeae-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259630, "uuid": "0543ad56-ffe4-44ec-8911-54aa269e2c92", "comment": "Malware payload", "value": "9836a34e2a0c6d384aa7bc0632ac5686", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259630, "uuid": "5a98056f-46fd-4fca-a12a-fb624160f9a1", "comment": "Malware payload", "value": "0e567a780f36db9232d12993302218ba511180c91cd4718c51f8cc7747b18d54", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259630, "uuid": "e2d534b3-95b7-4ec9-bdea-3f463bae631b", "comment": "Malware payload", "value": "2db14cf631642833844533d305ac38abcb82f3a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259630, "uuid": "65b5552f-219f-42c4-a12f-8841612b2605", "comment": "Malware payload", "value": "b575a16ce7bf48005c46fef60be33f8aa80254e508f20f8499a89f05f8c4770382b11f5d5ecf17e3a9e870e0b5e013c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259630, "uuid": "205ee351-15f2-415c-9c00-b673189864b3", "value": "E233F17547DCCAA76C32E0BFC4C6F845BFF28861C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259630, "uuid": "c2aeaf21-8f31-4d33-a8b6-34dfbf5ecff5", "value": "1536:vjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wf:LB9wzbqtWb08UscYJhnpjyq9qEK0wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259630, "uuid": "f8f40332-a98f-4c61-a71e-449634ff3846", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259630, "uuid": "1e271900-8372-4923-a140-6ca79c30275c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259630, "uuid": "02e10a89-bcd9-4946-81db-4c7557a1764a", "value": "diagram-1200852945.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2c7555-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256884, "uuid": "05b56aab-f44a-42ca-a3d2-dc6687c7ed84", "comment": "Malware payload", "value": "7b10bccc4268161fec84b143fdf8f670", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256884, "uuid": "6d0dd508-17b5-4bfb-9f33-07a11cea68e2", "comment": "Malware payload", "value": "0e6a1e5bd21a83aae9089d23d90c51d4aaf42f2b457d72263debb0bfa09fd4cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256884, "uuid": "8d88cafd-62e8-4ba7-ae76-95d77d4bd8ba", "comment": "Malware payload", "value": "cad7dc0eed465e2324b0cac4e94ffc2b912a2b09", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256884, "uuid": "c8307ed3-2034-4642-9d57-31a7e1ccfb8e", "comment": "Malware payload", "value": "90c2d2f61fffe36c745c93243a26294af2d34417eb15bb20b134d016dcf8c0ac8523ec369f9663f640e0c641e354dabf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256884, "uuid": "056be5b7-1946-4247-8510-5aabfd8a7029", "value": "6433F1A2E545018DCF4FD2EB20F6F9DCF69D7E530A68A4D09A7E2B4581530F1182E29E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256884, "uuid": "fb35f929-a7dc-4c98-a116-16d18d9c7774", "value": "1536:V2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIqdXBYk:Qfqhp+g5ru2kmUEt88qdX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256884, "uuid": "23406860-4afc-436f-a0bd-6c1299980309", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256884, "uuid": "83cc72e4-6907-4b23-b93d-88ab0fc921d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256884, "uuid": "19a1d168-457e-4dea-8b81-b27d38d75653", "value": "catalog-1166186720.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f7e8ac-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258672, "uuid": "00fe29f4-7f16-41d2-aede-b2d1a86abd93", "comment": "Malware payload", "value": "03e5b670f411c6e54c384eed4c580348", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258672, "uuid": "8bb9f0ad-56ca-408c-b090-21f88727444c", "comment": "Malware payload", "value": "0e8241b9aae7d48bd51850dbfe4ba551ead1e9c03838d3cd3d33771a3c1eee21", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258672, "uuid": "ae66ed25-0b44-47ac-8ddc-7d7e2605a0da", "comment": "Malware payload", "value": "fa13c2828b2d19e8a09c67ba7ca55dac813a6108", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258672, "uuid": "931d11de-884b-458a-bfaf-2abf034a08f9", "comment": "Malware payload", "value": "35ea49b9f5009665dec4b11e7e8aff7c46bb3d42c93695956b1c72fe3f00f50852c9ab1e317ae058a25af24bf92f1bb0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258672, "uuid": "a37e136d-670e-4f9b-b4cf-28f30ce9f1d9", "value": "E5330282E658018DCE4FE29770B5FAE8E67D7A530D9DB8D05A7E2B0591934F1082F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258672, "uuid": "d1c2ee27-4029-4caf-9340-5d76c9eea7fa", "value": "1536:F2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI2Mm:gfqhp+g5ru2kmUEt88/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258672, "uuid": "6adbc3cf-616d-4979-9d13-743fe0ecdc68", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258672, "uuid": "2c54f6ce-789f-409f-8fc3-e3acb907c6e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258672, "uuid": "b1d24687-9302-41e7-aa5b-8a892f95987a", "value": "catalog-479741962.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cc4baf-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259378, "uuid": "6e9229a8-f770-4298-966c-936e2828bbc4", "comment": "Malware payload", "value": "aa3a9bb9136de000d182f87090dbda8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259378, "uuid": "48430f92-c642-4481-af27-52afd49d03c3", "comment": "Malware payload", "value": "0e94be01ab2f625319e7dbb686ee41a909b57ca6c970bc435b582c54e36da8cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259378, "uuid": "9e427473-4a66-43a7-ba0c-026a714a0c08", "comment": "Malware payload", "value": "a84f37fde108f0bea10d25c2e6b0c45c6d3c2d4b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259378, "uuid": "54df503b-7a44-4e35-8c84-e0cbd4cd5106", "comment": "Malware payload", "value": "42535816050fa3a361039160617f0fec2eb0edeaa4b293c23422d5563cf28549cfb96aba1f7ae25874e7af46e889d0bf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259378, "uuid": "352b62b1-0dec-452e-bd55-6369149d51a2", "value": "A633F17147DCCAF66C76E0BF84C2F808FFF28951C987862645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259378, "uuid": "8ff9d844-86b0-492f-804a-b17e12f79022", "value": "1536:NjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wIK:JB9wzbqtWb08UscYJhnpjyq9qEK0wZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259378, "uuid": "24776fab-df7e-4613-ad8c-1d114b19419f", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259378, "uuid": "3f061357-e092-4c55-b043-6a1ab5100440", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259378, "uuid": "f3080806-3759-4d75-8903-6f9caf40d3c3", "value": "diagram-1012007255.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7747f96a-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264851, "uuid": "7612123d-af19-49c7-9549-a3c35a8284cb", "comment": "Malware payload", "value": "c2065856fe9064a81156a3837449372d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264851, "uuid": "1a8192c7-02f0-497e-8097-8091c9e0f59c", "comment": "Malware payload", "value": "0ea7bde189bb37e6de89e692aa39f4268cb5953910321e82bcfcadc3b8d01ec4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264851, "uuid": "5b66de56-88d9-41ff-8dbc-8e114e4b6769", "comment": "Malware payload", "value": "31e3bc647c9c7b92b4a8666299fe938288467a2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264851, "uuid": "b71a7eb4-c708-45a9-8c67-f838b84c69f9", "comment": "Malware payload", "value": "52120b05180cd5cb0935ca646a8d07e39a2f4443ad25b24d820f89840a22f8dafe2eb94989790be761b0a8f73c1313fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264851, "uuid": "d9dd1d89-00ef-4317-a3c3-d6968380a9ea", "value": "6333F2E0D901E08AA754FC5CDCAB9D038F39DD5A073DB852027EC0C75E72AB5B646D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264851, "uuid": "89ead340-cdfa-43ed-ac9e-b42b6256aea5", "value": "1536:0XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOfD:AXma7774mfCyWMB/4GpCOfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264851, "uuid": "e1392b24-0fbe-45eb-9e9c-835d9030fa23", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264851, "uuid": "99f3d98b-fc66-41ac-a354-bad1b70c13c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264851, "uuid": "15daa436-24b6-4eca-a3fa-56dda89d4ac4", "value": "statistic-996882455.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a9f0be-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256829, "uuid": "a8f40903-7320-40a4-a357-39ae76cd17bc", "comment": "Malware payload", "value": "f03975c8102fd7d2588e67fe2ef09c4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256829, "uuid": "24a70c92-8f84-49f2-a9da-c92a811e5346", "comment": "Malware payload", "value": "0ed516110fb4e6dc8c85102fe294d091931c48ea28ab9897729cc90402f4e2ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256829, "uuid": "62c6348d-3a59-4cf4-9fa4-cdfa19167424", "comment": "Malware payload", "value": "7b082b7d390919243090261b9874374da9097d45", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256829, "uuid": "d83b7f53-d57f-42a0-8e6b-0108a9e3f038", "comment": "Malware payload", "value": "9fa9995fadf498b9ec1184904f5ad5bf9d88bb7e1e89ba5920e0017c17ae705f65b32a18382fa596b28dd73d1c705c80", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256829, "uuid": "f0d33247-bc8c-4784-83c8-450f52038050", "value": "AB33F1469218118CCE4BE1EB30F6FAD8E6DD6A430EA9B4D09B7D2745C1A30F1482F65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256829, "uuid": "3556d37a-fb69-48a2-ae5c-eb969eb52ca5", "value": "1536:l2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuZSr:Afqhp+g5ru2kmUEt88AmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256829, "uuid": "dd81885f-de9c-4782-8adb-6ab53a581afb", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256829, "uuid": "a3aaad17-36a4-40ec-a8d4-36f936cd9795", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256829, "uuid": "cee79143-1a79-4bd3-8a04-9a0a89bc9511", "value": "catalog-1123040966.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0ef8dd-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259569, "uuid": "1c416a96-0156-418c-918c-e94340b31e3e", "comment": "Malware payload", "value": "c736113e0f36d5c9579ac6fbbbd753ea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259569, "uuid": "ed5570e6-bdce-44d9-ba27-28febead6808", "comment": "Malware payload", "value": "0ed9635f146f8180ccbdb3cd36641308b3c85f16af9bbcb77dba6aa4e6c3f19e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259569, "uuid": "ecbaa9a2-af93-44c4-adf4-49d7736d6046", "comment": "Malware payload", "value": "33d5e89c081ce2a1eb09d2912622f805404e106e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259569, "uuid": "c8e16f21-f46c-4738-9204-5963cbe8f163", "comment": "Malware payload", "value": "42ec3582ae5d2029cbeb6a5c516267f3b6be2bbee1d867dd0d1e24e145b6aa16875a47354852ebc6fa2c0262b6a05dc3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259569, "uuid": "630e20f1-2eb4-4ab4-94e7-27057c837031", "value": "F933F1715BACDAE66DB1D47FC486FA04FFF1C4A5D4AA861385F8B0C8B6D02519E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259569, "uuid": "1eb6084b-e962-4f6d-9407-98f328b9aeb1", "value": "1536:pjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67s0l:tB9wzbqtWb08UscYJhnpjyq9qawT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259569, "uuid": "f1c0b55e-fe39-4618-bb52-e00d92018b70", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259569, "uuid": "4c46c096-e76e-431a-b7ac-f5684089d995", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259569, "uuid": "296702fd-7b03-49f2-8668-9b747b5d86d0", "value": "diagram-1150805422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694feae5-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263110, "uuid": "0496af1c-6031-424d-8180-e4d7cacc3275", "comment": "Malware payload", "value": "0755091e108e802ac5386b3f7fc18db1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263110, "uuid": "57e16d6a-e314-459b-9a35-066140a220ff", "comment": "Malware payload", "value": "0efe76215ed8ef503646f833d35b00899bd804871d8ea687ea4108e730d65bf9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263110, "uuid": "a2891041-34b6-467c-8678-089419869086", "comment": "Malware payload", "value": "9fa2d3907acd7032bb4bd8329419b6e91505659c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263110, "uuid": "ef13d83b-26ec-481a-977d-d69d6cd2873a", "comment": "Malware payload", "value": "973118b7398f569675a2d91c69d161e7f64e8cd4767094e72f3d3c4ad03228da8b36d5d46a628fa7bf648063e60abb9d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263110, "uuid": "cfa4aaf6-f207-4ab5-9005-6ca4ce8c0099", "value": "B733F1D0A905F08BE349BC4CDCAEAD174F7EED1E463EB892013AC0875E61AB56605D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263110, "uuid": "26a80f6b-b048-442f-9f5a-c2a398b5d9da", "value": "1536:4XXtg3K7774iXfEz5lnm/hQMOEYus1GplItXp:sXma7774mfCyWMB/4Gpl2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263110, "uuid": "e3ffbc3a-8e8d-41f9-bbd3-348eb8d3f736", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263110, "uuid": "5ba2779b-6db5-4f8b-83e0-dfd5265c4452", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263110, "uuid": "7c240c10-19e3-400b-82cf-e9331365adf5", "value": "statistic-1643933400.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68242cdf-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263967, "uuid": "3c620d53-f418-43d1-af62-48d8a6c3a80a", "comment": "Malware payload", "value": "7f843d0e11db6dc99477cc59b7935ffd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263967, "uuid": "8a4f5044-5c26-479c-88bd-c88cd5576d2e", "comment": "Malware payload", "value": "0effb9c551aa40059970d4eaf685e8bb73b5aa1ad9b6e2fdf5b80dcb6adafef9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263967, "uuid": "ec177ff3-48b3-4b6c-bf82-1b20d069fc08", "comment": "Malware payload", "value": "99854b3418cf8cab8b6b454f45838a6cf9c47568", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263967, "uuid": "3744108e-9dcb-4947-9878-2b4d92c07e70", "comment": "Malware payload", "value": "eba49c42b5ba415527ca3f24a639afae061d3ae928f7bba61138340701925273b2bcf49707e8ba8cd77a81fa95139a86", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263967, "uuid": "b3a2ba57-4190-4734-9da3-b78693d40e8d", "value": "A933F1E09902F08E9745BC58DCAB9D07CF3AC91E037D3883016BD1474EA1AB5A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263967, "uuid": "1cba9e8d-29de-410f-ac6c-195dfd40ac44", "value": "1536:4XXtg3K7774iXfEz5lnm/hQMOEYus1GppLB:sXma7774mfCyWMB/4GppF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263967, "uuid": "906135fc-455d-4815-8cb0-0444fc0923a4", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263967, "uuid": "2d2871c5-984e-4c71-86af-fe5c844aae56", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263967, "uuid": "b9ada0e1-f60b-4079-b242-f5c1f43f8001", "value": "statistic-393343803.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed66191-b70f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621256489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256489, "uuid": "95c8ede4-3020-4fa6-ae1e-4641067581bd", "comment": "Malware payload (SnakeKeylogger)", "value": "e29a834a5d6a7b0dc34422dccca7b769", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256489, "uuid": "3e3d8103-2210-4a7b-a1f6-f0b1fc857926", "comment": "Malware payload (SnakeKeylogger)", "value": "0f1be755acdb612ec76934b749fede12106d32ea219db9632f115bdacfe40213", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256489, "uuid": "abee3bf9-5b80-42d8-8efe-c0695d7a59b5", "comment": "Malware payload (SnakeKeylogger)", "value": "5ccd7d141d7283b54d47c2d409692c297a2da0b9", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256489, "uuid": "ba3c273a-ad4f-4ae1-8d6b-5d7ff85d575b", "comment": "Malware payload (SnakeKeylogger)", "value": "e63594174d5d3aa1ec10ee5a69db3d2da0dd24741f348988f43d959ec4dd07593720f951af3c90df76db40165bfd2262", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256489, "uuid": "f7df1a5b-8527-4808-bf46-ac53a8ef2608", "value": "97F4E0A207F8CF63E16E20788514E1569BF09C9B1115EA44BEFD32EAEFB57C12B12116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256489, "uuid": "60f87285-9fdb-4f82-a6fb-bf7411febf7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256489, "uuid": "5dcb2e6b-79a4-4cba-8158-dc7094375b00", "value": "12288:NOMdFAByDHJ07SwAz8TeRil5k7Q0GF5CZ+52Gr4KzUvSez7haJIO81M4:NOMFAByhwWYRH0GyU52iz8Swl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256489, "uuid": "52e3dc08-aacf-4090-99ab-ff6440a12b95", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256489, "uuid": "6d65310a-6efb-41b5-ac4d-4bb3e1c19a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256489, "uuid": "b204fc5c-3694-4304-8263-a6b63b4070cc", "value": "New Order 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37948fa-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263315, "uuid": "7e59dd70-4732-42e4-9109-e15f553deb72", "comment": "Malware payload", "value": "56f9dece8c4f76b7994b73bc22138359", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263315, "uuid": "19f71e98-6d86-46c5-a3e1-497766d996f2", "comment": "Malware payload", "value": "0f2fc75834e729088017b1ca62bc92a3fdbf44098825e2088f32d4b4dbdc817a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263315, "uuid": "2120451c-3472-4073-9efe-9e0a08a7afc3", "comment": "Malware payload", "value": "27e01743b1cb2fecf3685abd80921462d29e8662", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263315, "uuid": "994e594e-d880-4ba9-93a3-f768840143b0", "comment": "Malware payload", "value": "ac5dcac3f943d68437c7ad3f0a598e11d05762231b23f38fe0bc6b6eeeb8f123de13e6f43ae19eeacb59de212f5e2d25", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263315, "uuid": "2842e565-c403-4bd8-8d68-30bbfd595458", "value": "A03302D09505F04BE7597C1DECAAAD038F3DEE0E433D78520279C08769616B5AA49D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263315, "uuid": "db451c45-df89-459d-a269-67e6ae78c561", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1Gp3ZJ:6Xma7774mfCyWMB/4GppJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263315, "uuid": "21e9dc5a-02f7-4e22-ae2d-e582b7e06d99", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263315, "uuid": "41de8e1a-13f8-4a04-a4cd-c20a35e8929d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263315, "uuid": "55b14143-047b-410b-964d-4b0364c568fb", "value": "statistic-1819032665.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd2cab5-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260597, "uuid": "1755423f-d975-465a-9645-814c1799934e", "comment": "Malware payload", "value": "9e2449febf9603bb84e7fbe5cc12cdde", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260597, "uuid": "918695f3-36ac-467f-8e38-c1d3030a2209", "comment": "Malware payload", "value": "0f88f22b42ef99d340c1ea23bb269f9b4ee9196d271e0ffdf9fbe0d86cbbaa5d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260597, "uuid": "a07cbdc5-a0c0-4df1-af30-b9aafc3ece97", "comment": "Malware payload", "value": "76985f4144cecfc069f1264f933aa0b00361db60", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260597, "uuid": "fbfde168-d4c4-4385-9bc3-3cfe50fb7ceb", "comment": "Malware payload", "value": "d0ccd8de30287ae01b0516532789a9a5043fe2d3ec4d594d5f7a80672d675fb1c69f6dbcc6fcb21a4971555adda817ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260597, "uuid": "a678c000-48b4-4950-8ff4-6503e2b04607", "value": "E133F13647ECDAF62872D0BFC4CBF505FFB19465C4D68A2249F8B1C8B6D01855A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260597, "uuid": "d73750d2-db3d-4a14-aca3-56a92766e1e3", "value": "1536:xjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXBg6:1B9wzbqtWb08UscYJhnpjyq9qBBg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260597, "uuid": "6f1e1e5f-bad2-4393-a9ac-16ea10c69dba", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260597, "uuid": "6f08efb6-39a4-4c06-9885-11a513e6751b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260597, "uuid": "21f9bdf4-32a0-4ca5-a4cf-3bd91d5573c7", "value": "diagram-1916037046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92dd5e5-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261177, "uuid": "ca0f495e-f0e1-48db-8f18-d242e530a873", "comment": "Malware payload", "value": "8177cb5e92834077eafe37034a07a7a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261177, "uuid": "8fdc5a33-39a8-4fef-b0ef-bbd64f1bf697", "comment": "Malware payload", "value": "0fa04a820afe1913a79bd51d4ddd0e2c7a3d70da5faa816c58a987f187672bff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261177, "uuid": "3a557e09-8ca6-4d54-93b9-693ce06613ab", "comment": "Malware payload", "value": "6c38caf75bc9119a4bf11a22a62f9cfe66bdbe0d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261177, "uuid": "0568ca07-f02f-45bd-82c5-2fda11494502", "comment": "Malware payload", "value": "a344ff7d553a501743e3c09a33420e15cecfe2cbd9d49b254c371f7d53324d820ae528a06fb8fd464acd25bf6fed519d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261177, "uuid": "1807b7fd-c55b-4769-854c-dcd236e33095", "value": "AE33F17157FCCAF629B2D0AFC8CBF504FFB2C465C4C78A6189F871C8B6901555A22E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261177, "uuid": "e1c7347b-51b7-4a95-be36-de23ebb73b05", "value": "1536:sjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXE:UB9wzbqtWb08UscYJhnpjyq9qBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261177, "uuid": "05d7d704-9b55-4831-aa18-d1d48268abe0", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261177, "uuid": "3a388866-493c-419c-82ef-ec90213a42cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261177, "uuid": "794915cf-3292-4dd7-8f24-e900b6fe8318", "value": "diagram-367597944.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5490179-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262915, "uuid": "3fe2ab86-5323-4fe0-9588-3a30596d1b32", "comment": "Malware payload", "value": "0eadd168fbc431cef3ded96bb3491365", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262915, "uuid": "dd4c9495-53d5-454e-9413-aa3e105ad3c1", "comment": "Malware payload", "value": "0fb8f9735fcd4835b3141a45a76816fb5c51b6b03e1f7041ca82bde690f70907", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262915, "uuid": "18f156ac-cd7f-4ddb-b17f-f28adb6bce92", "comment": "Malware payload", "value": "9437c532ab70ee86443fc63a0bf15a8c6b1fe648", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262915, "uuid": "61f79210-5966-4fb6-b61d-02efa9c30364", "comment": "Malware payload", "value": "c3d2d08d935b9f4cee942202b43f63cc080b9948b69d54ea42f71cd4c80c155259eed06bc0e448756ccd59eea98eb68b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262915, "uuid": "f10e9562-d847-4f85-ba17-1f7d44009c83", "value": "F43302E49507E0479748B82DEC9E9D438F3CE91E433E78D2122BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262915, "uuid": "7f804d71-657c-4c9f-8b32-9859f7a1832c", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZM:cXma7774mfCyWMB/4GpWvZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262915, "uuid": "6268dce4-8e33-4176-a081-ef679900cb99", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262915, "uuid": "c12f2678-af09-4e39-8f3e-c6ae23309438", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262915, "uuid": "188c9dc5-c6bf-4b8c-97d7-df7b28532b6f", "value": "statistic-1493339582.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c3de1f-b74f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621283822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621283822, "uuid": "4337e2d9-5fe9-4cef-8b97-e1a391b17ba5", "comment": "Malware payload", "value": "400785f03acbd1962cd183f38fa7ba54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621283822, "uuid": "0fecbd7e-088c-4567-ad0b-d4bb45773f58", "comment": "Malware payload", "value": "0fbdef0f7e6541b934a371d33435d26c5719397aaaeefaae4b6d1ee99dfa14b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621283822, "uuid": "3d3111f7-24ab-4769-980e-c1c417211035", "comment": "Malware payload", "value": "e0ff7880a3ea3799f3088dcb7e26a43955b4bcaa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621283822, "uuid": "2dc7822f-2dbf-4ea4-94ae-57157304a55e", "comment": "Malware payload", "value": "2dd6e535c0ca52bc2beb869012e9bcf8c960a57b9c8431ff781523a4a1a1dd5af9ccaafdb9641f1aaf9c2ef964e54687", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621283822, "uuid": "3458c183-4a64-42c5-b3e9-f1d485a5b2e7", "value": "0472730433A5C133E055AAB58EE2D6DB6734BC61AE52471731CCB70F1E3A9A0D913B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621283822, "uuid": "43e9ceca-27ac-417a-9e6f-d4fbe0e2204a", "value": "96:Iwt098W31Y/sgbLO9YnvhUWPS3UpeOSZjzzppV1v1i+fdNnExnrGR40jcbyBgynb:IQ+lY1Lu7FDX/ioc4g2lrr5e0pGpAVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621283822, "uuid": "238c2ac2-f9f5-4b90-a3cc-c988eb20079c", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621283822, "uuid": "f895820e-f961-482b-bbf9-671dff013608", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621283822, "uuid": "0151bf60-cb7e-4b52-9440-0547b19fbdb4", "value": "SecuriteInfo.com.VHO.Trojan.MSOffice.SAgent.gen.22239.27551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5bfa31-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261152, "uuid": "1b24df66-2f2d-457d-88c0-1fe8622e8228", "comment": "Malware payload", "value": "a3f6a76bd0652190096a7ce68ffed29f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261152, "uuid": "9cfff88d-009b-48a5-a939-cd915e4b4179", "comment": "Malware payload", "value": "0fbead5ba09cb5d18e5618c03f70618d9986b8c998cc45ee7bd0c645e4521303", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261152, "uuid": "77a554e4-7684-4035-aa61-8020b44de475", "comment": "Malware payload", "value": "654f3dcf5fdc54bf4b251677fb0604b6ec4522b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261152, "uuid": "039a25a2-331f-4c35-8bc4-f2dfe20684fe", "comment": "Malware payload", "value": "238e78f0a04abef27532ee661712aed1897c092bbeb4d995115c9605e637e7637353b873e57e88be430035d9751cab73", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261152, "uuid": "e0cea663-0ff7-4a1b-91ea-a3b49cb4039e", "value": "9133F1314BACC6F66DB6D0BFC8CAF604FBB194A5C4D7862249F8B1C8B6D01945E32E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261152, "uuid": "2e9e3fb1-cf27-47c2-857c-69b9582286a7", "value": "1536:5jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXD4h:dB9wzbqtWb08UscYJhnpjyq9qBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261152, "uuid": "d0e594d5-2a28-4bf8-b8d2-8d2de30c5b1b", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261152, "uuid": "7f3f6417-b5c8-4128-8b9f-e202025384fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261152, "uuid": "3b5b659b-8036-4efa-b0f1-572b2b6be275", "value": "diagram-344367764.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d85342-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262537, "uuid": "ea44ef5d-018e-46fd-929b-5a6f69ac6087", "comment": "Malware payload", "value": "bd9ec59f774d028d29f851b7180782a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262537, "uuid": "b5e414c4-8811-4126-9676-b943ef151ff6", "comment": "Malware payload", "value": "0fc95b170761524ff2510e778663ebca14695ada9ff9e85cf6023628376944c9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262537, "uuid": "d046b901-3180-489a-92fc-c6c4de73381e", "comment": "Malware payload", "value": "cb84c292b00d5c987c8cf7640348cbaab20b55d6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262537, "uuid": "f2ad7c7e-d6e6-47e0-a556-31383376ec69", "comment": "Malware payload", "value": "4f81700fd8179aee822db223ead43b0f08a00db3271983d22a4218f5d994565ef616eb71103d94a592e9898197060b74", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262537, "uuid": "ed5924d1-7632-49d2-8e57-5a07041af7fe", "value": "4233F1E0A502F04B9718BC5CECAE9D038F7DDA1E433D7842457AC08B5E629B5B749D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262537, "uuid": "1f3cdc22-8fc3-4367-b48d-95ddc2ce4694", "value": "1536:cXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIrS:YXma7774mfCyWMB/4GpV5drS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262537, "uuid": "a34a5eb0-15af-4f4e-aa8f-bb2933131faa", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262537, "uuid": "b361f2c6-6c97-4057-841a-5ae29425e17e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262537, "uuid": "57b74dba-74ed-489c-bea5-c0957ba44ff6", "value": "statistic-1236951276.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1644eb5a-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256958, "uuid": "549b1750-74c4-43ed-a48a-2f529703b22d", "comment": "Malware payload", "value": "a23a6a75155837ba9d1de625c4f66ad8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256958, "uuid": "8569b74f-fe52-46c3-9920-eca83a2b8f74", "comment": "Malware payload", "value": "0fd75cb391f77a8f52247feca16516d200ff48cfc7dcd4d973c413d19a9f9722", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256958, "uuid": "39cdc930-85d2-4948-95a8-6a1319635d9b", "comment": "Malware payload", "value": "10d8ff7682890b30beace20e89fe281c970baa35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256958, "uuid": "54e3ba34-9d0b-4863-b7a3-8d858d3e10c4", "comment": "Malware payload", "value": "3b77c51f322ff461469440c7d0e98f331d0cfd78f049291c9295235f20c1b1a47ff52d43179d66b4707b076083053da5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256958, "uuid": "a192bb23-182a-4ca6-b3f0-e8ae08d67054", "value": "4B33F191E669118DCE8BD3DB30F6FACCD6CEBA4309A9B4C05AAE1B0591920F0541F5CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256958, "uuid": "94ea6639-b198-4723-89ea-fd039aa7bf8a", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIThpe:Ffqhp+g5ru2kmUEt88Ths", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256958, "uuid": "86c041f3-0ee9-4d77-b517-5d4e0b909b9e", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256958, "uuid": "846978f3-ae66-46e2-a3eb-0b2119d6e4b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256958, "uuid": "2aee88ea-7c58-41d8-8790-b8c863df8520", "value": "catalog-1232997247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf5771e-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258121, "uuid": "38338748-267d-4684-92e3-ab186116c137", "comment": "Malware payload", "value": "d87bd7ab8a00d55f0a56c6754c181f09", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258121, "uuid": "071be809-4705-4698-be6f-d843bb226fe7", "comment": "Malware payload", "value": "0fd939bff9ec4b7c94a4edb87d1235002977d27977006330ae11615d2da7bb7a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258121, "uuid": "85e0d85f-9cc0-436e-bbcc-7d8e137cb60b", "comment": "Malware payload", "value": "f447e1148122a6a51520559b99e8ce7e9b42beaa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258121, "uuid": "4a2a5f6a-0e1b-4cd8-94a7-b9f6b8b19e67", "comment": "Malware payload", "value": "587098a7cc62a422b6727be9fb9eece8accb6dc1c1111a846656412ae5344ce89b86daa525e5965133e75edad4c1b101", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258121, "uuid": "60f93a6e-676c-4bd7-bc69-1396bd55c7da", "value": "27330281D694028DCE4BD2EF20F6A9DCE59EBE53099AA8D09B7D0B0191534F1583F68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258121, "uuid": "072f8e74-e878-4939-8b89-2f69eb1d3f6f", "value": "1536:p2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIB7bW:0fqhp+g5ru2kmUEt88B7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258121, "uuid": "ebd5c93e-764f-4477-8c4d-91558e3c76b8", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258121, "uuid": "97debfe7-aae1-4c90-9db2-a8b73e7a2dd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258121, "uuid": "6483ff0f-6f56-4445-91c8-48c741e77431", "value": "catalog-210750116.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0d7222-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264541, "uuid": "0e51ef17-7ad0-49bc-adb8-ab1c8dab3454", "comment": "Malware payload", "value": "b53c632dd09013278e3dea6d89a59098", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264541, "uuid": "ee22bfd4-d543-44d3-ab97-771394ae74df", "comment": "Malware payload", "value": "100b24bd53cf8ea5aac180d74cffce45691b593beee16bff404199755faa9223", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264541, "uuid": "48b09fae-f4dd-4519-95e0-34c5bbbc1353", "comment": "Malware payload", "value": "9f2610d1ab99545f1e042ddf97bf0cd8703b8e70", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264541, "uuid": "76b21146-8fe0-4d29-8c8b-ff56f583ad68", "comment": "Malware payload", "value": "464fa20a5563d647740a5629d2931104f6e915a3809e4aa1218ac8303026edebd6cd22bb2f38b18506c367d2152deaf0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264541, "uuid": "a5853706-4a3f-4cbc-b1eb-5389ca29da99", "value": "4733F2E09902E08B9749BC5DECAB5D478F39C91E037D2893017BC0879E617B9A645E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264541, "uuid": "7e96b6d9-2521-4747-baa1-735b2785ad52", "value": "1536:nXXtg3K7774iXfEz5lnm/hQMOEYus1GppCU:XXma7774mfCyWMB/4GppCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264541, "uuid": "32ad708a-5cbf-4580-8589-82823efc7427", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264541, "uuid": "1e392822-b48f-44b9-b82b-9194024108c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264541, "uuid": "203a13ef-2319-47b4-8f37-403903e8d592", "value": "statistic-795684088.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ecee08-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256908, "uuid": "5ad16a49-78f0-446b-bafe-15c50ce4a094", "comment": "Malware payload", "value": "3b1fa18436f7f07b6d2e2b03084d324e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256908, "uuid": "fd6887cc-aa79-426d-9c70-ca2b47039180", "comment": "Malware payload", "value": "1028f20891d6d0f4eb37a38740e2ae656ea8381904d2b2a8e6362a0ead296df8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256908, "uuid": "b5abaea2-e7d1-4d3f-934b-c95f1c4f828a", "comment": "Malware payload", "value": "9a8bddd9d47f4b6de464b4a01071f2238a13243e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256908, "uuid": "34d0b956-edbd-4a3c-8eda-f2cd1b0f9e62", "comment": "Malware payload", "value": "c07e7b06f7b88de98908ed91a6c1fbb9c728b2124bf8be0aef1402461dab84970efebffb64b166324d4ce5ecc4750ad3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256908, "uuid": "21283b18-e0a8-41e0-9925-f486651456fe", "value": "9F33F195A564114DCE8BE1DB20F6F9DCE6DEAA470E9AF4D0AE2D1705C0A70F04D2E18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256908, "uuid": "8d47b1b2-6c06-4971-b436-93c144af8173", "value": "1536:Q2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIpw3:hfqhp+g5ru2kmUEt88pw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256908, "uuid": "c2285db7-38f3-44d3-a92e-532e6c88f7df", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256908, "uuid": "8ef3ce17-755b-48b5-a7d8-28f25a023f72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256908, "uuid": "157c5cf9-116a-4998-a05a-b7965efa9276", "value": "catalog-1188789005.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b797ab-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261577, "uuid": "6ac7cc6b-c329-4e6a-8fbd-37ed92fc43b5", "comment": "Malware payload", "value": "2824b84d22ab3a6a3de35de3fcf9bc46", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261577, "uuid": "13834943-b916-472a-962f-f9eaa21c52c8", "comment": "Malware payload", "value": "103791a848009640fde1c0177c708e5d89b171d5ab5526ebcd76adce179e7d67", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261577, "uuid": "2f7fe0ba-b9a5-4676-9a56-0793936732cb", "comment": "Malware payload", "value": "69ff2c0bbda009efbba1158e70f8851c14e863b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261577, "uuid": "76267ff8-c468-41ba-a1f4-c5e49beb2f4c", "comment": "Malware payload", "value": "d65f2efe6543566ea5747b507bf05b9fabd1db261cb0f588e7002036ce82d291d7d1f29682b377eadb7e7f6757d6c097", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261577, "uuid": "17f0d4a7-6851-4ea8-baad-d9698385b679", "value": "7933F17117ACDAA62DB1D47FC0C7F904FFF1C865C99B861689F860C8BAD12559E31E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261577, "uuid": "280c2ad7-0a97-4a32-ab0c-3033f3c8f1bb", "value": "1536:FjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q677Ie:BB9wzbqtWb08UscYJhnpjyq9qaw79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261577, "uuid": "aac8a78e-7aad-421c-89b8-2b2bd37f913f", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261577, "uuid": "b71a8ccf-315d-443f-a1aa-aad95a132c84", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261577, "uuid": "a3490b1f-f236-4c8d-8706-ecbf2d1b266d", "value": "diagram-64454800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fdb640-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260984, "uuid": "a91eca71-1f06-490d-bed1-6f4ff26c1dba", "comment": "Malware payload", "value": "7afe14e7860a36f129d5c62a720c1d90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260984, "uuid": "ef32cf86-8885-4740-bdc8-ac79b282d8dc", "comment": "Malware payload", "value": "104e23082e72dda778fddb2b088a7078b5feebe77e8b41a7cafe14459893a984", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260984, "uuid": "85686056-8000-42e7-acc4-8b2a699826ab", "comment": "Malware payload", "value": "f5886cfacbcb548dad7cf6745a0a2544b4bf8c12", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260984, "uuid": "c4f42c34-f9f6-4d17-a2f3-5117aba0cd1b", "comment": "Malware payload", "value": "df3fbb2792a1b908512f2e33bab122428595730b15a8ad6263851e3280a1cfaf809b4898953af5f1e6a3ccdf232828b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260984, "uuid": "0bc6cf42-dd6f-4318-93b8-635aba2b5a54", "value": "3B33F1311BACDAE66DB1D47FC486FA04FFF1C865D5AA861685F8B0C8B6D02515E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260984, "uuid": "088bc821-428b-4b26-be78-9cbc516059d7", "value": "1536:vjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67t00:LB9wzbqtWb08UscYJhnpjyq9qawh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260984, "uuid": "41f3e8e1-c76d-48be-a6ba-19bf7e478893", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260984, "uuid": "d13b7ff4-322e-4f68-a1a7-8b2c03a7f708", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260984, "uuid": "b3642bb0-1135-4ffd-bf6a-0e975ffd666a", "value": "diagram-245646522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56e4b74-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258943, "uuid": "8a160afe-7dd7-4973-9d2d-9b6f0ed8e7f5", "comment": "Malware payload", "value": "44d6941f1357495c31582c06861ba3d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258943, "uuid": "554413da-ea28-47ee-a84e-3c2765b67b0e", "comment": "Malware payload", "value": "105856d3d07b35042f5a2f58a104adacc6ec6d71bfa45c185c7002d481215870", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258943, "uuid": "4e2bfc6e-e871-41ff-aea4-9fb537a337f4", "comment": "Malware payload", "value": "998c9e4d2cbb97ba5f6b43a372bc82b1cbfce135", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258943, "uuid": "93516941-28fe-4567-952a-5f47afd2a853", "comment": "Malware payload", "value": "b57cf7fc3c03a2009bf724d5b4aa0e5cd38fa01e2c52d4d40878a37d6e8c61edea05df15f58ac3ad02ce05e1b38e3518", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258943, "uuid": "e8398177-03bc-4379-a8fc-5719c1082a6b", "value": "8D33F146D664018ECF4BD1EB20F6EAC8E59EBE47099E74D0977E270586534F04C2A2DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258943, "uuid": "932c94e7-9e21-49fa-9e2e-baf1a715e7e9", "value": "1536:U2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI6iyQ:lfqhp+g5ru2kmUEt886O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258943, "uuid": "238707b4-ee29-43e8-bea0-a78f3000a042", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258943, "uuid": "803ae249-23da-47b4-893c-b4f0eb8d0750", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258943, "uuid": "8875f781-f9ae-49e5-86b3-45485f1bfa39", "value": "catalog-697491011.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cd92c2-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260950, "uuid": "d56b38ef-e092-444b-a8da-b38370b60663", "comment": "Malware payload", "value": "422f9679705db7c38e0b72b44efd3f38", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260950, "uuid": "89021d17-6ba2-433e-8c44-8a0a23354f75", "comment": "Malware payload", "value": "105e503957bcdf581c901ff823f0234ea0ce00306e6cfc765b86c6fc148054bb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260950, "uuid": "afd8e5f8-ebf8-45ed-99a8-7cc70f022ad2", "comment": "Malware payload", "value": "37c2f4ab122ebe6bcc54fe30edbe5a2f0476cf5a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260950, "uuid": "bfc56c1e-ff31-4df1-815f-6dc8d6b88ee8", "comment": "Malware payload", "value": "a81c553b1f447d9c9d345a6c5c619f40c538b88c774fa04bc4807553d7dc3fc87dd34c1f6cdb079d83b7420859b4f334", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260950, "uuid": "c6bb50d9-a0db-41f6-8f0b-186aef1e31fd", "value": "1833F1314BACC9B62C72E0BFC8CBF504FBB1D495C4DB8A624AF871C8B6941559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260950, "uuid": "fee2b1b8-424f-4007-9cbb-2264289723f2", "value": "1536:pjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXjj:tB9wzbqtWb08UscYJhnpjyq9qB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260950, "uuid": "f065800a-3c70-41bb-b345-42defb9e34ef", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260950, "uuid": "474dcaf2-0b2f-403f-8767-6dc6a2d95588", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260950, "uuid": "bdd21dfc-a472-4ee4-a974-d861d36c167a", "value": "diagram-23082083.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2f4fc7-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260971, "uuid": "cf37e873-e3b6-4243-acb6-7e337ec4abd4", "comment": "Malware payload", "value": "d7632e41ff9231536d33995474916dca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260971, "uuid": "eb683201-834b-4cb7-a572-ff3abbad8a2a", "comment": "Malware payload", "value": "1071ae099e4e7e855aeb92e9d7a9b13775c74b88c4afbe40737185d3081660fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260971, "uuid": "4e1f0888-a864-4e26-96fd-7ed8ce2a1e19", "comment": "Malware payload", "value": "ae7cd2320c6458ee6410f52c414ea71076ec62a6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260971, "uuid": "938d0e66-afe3-454e-aaec-30989d9cfccb", "comment": "Malware payload", "value": "165058af34102a12d5881983084133d2e5f221d49bd13110ce7f6d8e12940f7516ba930564fb407adaf1e23cbef74249", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260971, "uuid": "056fb4a2-4966-4184-a576-99bab67768a2", "value": "E333F17147FCCAF669B2D0AFC8CBF504FFB2C469C4C7866149F871C8B6902555A22E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260971, "uuid": "80d795a4-d1c3-4e4e-bfb1-8a51d18e8691", "value": "1536:sjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXe:UB9wzbqtWb08UscYJhnpjyq9qBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260971, "uuid": "ce595630-2121-4c5a-a0b4-ab8a4998ee27", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260971, "uuid": "8dc34383-26e3-40d9-bda8-ab0962bd10a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260971, "uuid": "fd6d7557-a0cf-429f-b15c-bb4b6225cb4f", "value": "diagram-241571693.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7b4080-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262691, "uuid": "681fecbe-c9f2-48da-8171-6e2a1a6d5a00", "comment": "Malware payload", "value": "f9f2a4765b1a36a36b1b411f4d434cd6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262691, "uuid": "8283692f-f13f-455e-9f65-e9fde0526453", "comment": "Malware payload", "value": "10a24e8965a6f1680a84c00761f2e0727c66a448d53f1222218651dcc6c0d0da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262691, "uuid": "e3c1a0fb-b2e2-48da-81cf-0093ec8d1bb5", "comment": "Malware payload", "value": "9cbcc772cbfd10a6caa070228161e9bda3853d99", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262691, "uuid": "6caeb046-d2fd-45d5-a54e-aa48270f4d57", "comment": "Malware payload", "value": "c22b41da1b79581093d07d3dfd7a552885f84954b7ee37dc8852a0401f2c31992d3833bb1e36a1ca6d19850c71f56563", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262691, "uuid": "c9a5e0a1-071b-4feb-b240-079a33de11b3", "value": "D433F1D09906F08B9B45BC18ECAF5A038F39DD19427D78C2117ED0C79EA1AB4A749E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262691, "uuid": "dc92f2a2-72d3-4ab7-b9d7-762582fed624", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1Gpyuii:bXma7774mfCyWMB/4Gpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262691, "uuid": "9b1bc039-822a-490d-91b5-77c8ef6d563b", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262691, "uuid": "d2ad8ebb-c1cf-4a62-8dc9-2f9d319ebd06", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262691, "uuid": "5eeb39a3-0764-4295-b7fd-0a6b0277aae9", "value": "statistic-1336645216.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2858abaa-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258706, "uuid": "9f2fb528-852b-4b8e-80a2-0964ad131721", "comment": "Malware payload", "value": "3474d784a0da7d6c7709175a232d2f70", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258706, "uuid": "4e7b1d80-4c0a-4e1f-8ad6-aeab1aaeefeb", "comment": "Malware payload", "value": "10a8c4fec89ebb586d8c299907e59da8c9ecac5b59c819941f3a03d3d62e04b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258706, "uuid": "12bde199-1751-4a03-96d5-030f04110080", "comment": "Malware payload", "value": "574349d004aec7dd2e462d9fe62d652cd58d19d2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258706, "uuid": "5325858d-88ca-4f53-a800-d5aab3eeb84c", "comment": "Malware payload", "value": "ef1b9249f0c8fb31a95f537d4dbe3777be514fb5a7896a01fc580ac086a76450b56fe5da6568208a6508ad2194327d13", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258706, "uuid": "78c41b23-e52f-4b41-8974-355a5f11860b", "value": "A033F196D614018DCE4FD2DB30F5EADCE69EAE530C9978D09F9E2B4895A30F0081E58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258706, "uuid": "b3487cb0-635d-4034-94f9-6e599026eed2", "value": "1536:N2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIQLtlfT:ofqhp+g5ru2kmUEt88ST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258706, "uuid": "7e2457f8-9bb3-4409-a0a2-6aa4124de0dc", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258706, "uuid": "80ff6054-345b-4dfe-b708-9a424e2c46ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258706, "uuid": "0e444f34-1a9e-41f4-b280-b5c9eeb5c7f4", "value": "catalog-500780734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ead70ce-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258314, "uuid": "a8f29771-5387-4747-9324-4f665fd0525e", "comment": "Malware payload", "value": "985047282687f17363717769e603b198", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258314, "uuid": "fbcd72b7-9659-480f-a390-6fe8c8b930f9", "comment": "Malware payload", "value": "10a97a33bc9cc0a0d5b201883017ada7daab6d8ce7ead46e81cd89c5235cb707", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258314, "uuid": "8cf0d77a-0c63-441e-b433-b3c96a89fd07", "comment": "Malware payload", "value": "eaa9347ffc351101003b69524468608c0d28bd5a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258314, "uuid": "74125aed-6838-473e-a1d3-aaa066595b86", "comment": "Malware payload", "value": "067c8a4872a1e63edfc261369d468a1b0b9da748c20eeafd03fe3f7375ab76ccf820f5e2483018d37007f0aa76bdb95d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258314, "uuid": "76f23258-d83a-41b0-b75c-faf5c765f908", "value": "2633F285D64412CCCE8BE2DA20F6F9DCD6DDBA430DA974C05A6E2B01C6970F1442E5CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258314, "uuid": "bfa3cd3c-755c-4045-a378-80bdf782db82", "value": "1536:22fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jInwd34Ek:bfqhp+g5ru2kmUEt88mIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258314, "uuid": "54bade94-3796-40d5-a2a0-34c6077df859", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258314, "uuid": "0c7397e1-e7c1-4c7d-b1f3-87a58afb775d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258314, "uuid": "4cad7e2a-2e42-417c-8912-23485548f5fa", "value": "catalog-315483408.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47056988-b707-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621252744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252744, "uuid": "58edfcda-4d66-422f-bce0-e459b8ed5829", "comment": "Malware payload (AgentTesla)", "value": "3ad1f0a625db4e4d82f0d755fad6b6b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252744, "uuid": "154a17d8-fcb6-4f29-92f7-f5ac41c32aaf", "comment": "Malware payload (AgentTesla)", "value": "10ba7bcd8173e72414b3bfd9799fb9d3a64f27cf64eb66ec739fac27db8c9f49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252744, "uuid": "5031d04e-4221-4c7a-acf9-2776691cd4be", "comment": "Malware payload (AgentTesla)", "value": "3f1624bda68177300601ba189b79fb4be2a0b630", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252744, "uuid": "1fa25a94-9062-42f0-b350-e5a54268fa0a", "comment": "Malware payload (AgentTesla)", "value": "0896f99e5aac64b560c48f9826df119275a1a13b4bf8fe36cb72a8bb559b0dd04bedb403f370e000eab0e9f6e2490297", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252744, "uuid": "ce543cfe-a210-478c-9fac-033e288fb12d", "value": "4DF4E05127F8CF65E03C83798874E5258BF0AC47D72AEA05BDDE32AA6F76B404627305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252744, "uuid": "c97172cf-2d55-4102-a6d4-5898030f2acb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252744, "uuid": "7e971fa1-e73c-4ecd-80ad-01dd5d1ad2bb", "value": "12288:9UC71xgvgwQ+Em4IoduR5D1JSWolDW7hyLxlFqViqiLAOjrKzQaJIy81M:Dt+EdIAu75oWo9WwLxP6icHzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621252744, "uuid": "762cbff5-b7cf-4f79-a665-a17ef09a82dd", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621252744, "uuid": "897e8865-9274-422d-b1d3-40663024d32b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252744, "uuid": "45727b94-71a9-404f-ac6e-a610c8233b6d", "value": "new purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f9fbca-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259511, "uuid": "9af39043-b1b7-4fdc-9cbf-65a4ae866a4d", "comment": "Malware payload", "value": "1c1687d0a131a07197bd6a5dcf67f9af", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259511, "uuid": "505b9a38-5d98-4d92-bf83-9c25f77585ea", "comment": "Malware payload", "value": "10d54e5559f50ce5d90383e5b8481eb0bec9c34ce9401d4ed646da63ab43b63c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259511, "uuid": "01483bf3-fb67-490c-81c0-c9ff66692110", "comment": "Malware payload", "value": "cfbc3675ac48107b79ec947580af7953b6ff4779", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259511, "uuid": "99cfe62e-84f6-4faf-b37e-fbf1b363086d", "comment": "Malware payload", "value": "5ab089d7ef4c6c9d21147fbfd47dc80eb6c37c381219b4d96f37f573561565854bb00f33e837d04d2b26f97399f5678c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259511, "uuid": "6b0b9f1d-79a8-4657-acfa-2859c528a7a2", "value": "3533F1714BFCCAF229B2D4AFC8CBF504FFB2C465C4D78A624AF871C9B6901455A22E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259511, "uuid": "c75e8134-d12d-4428-8851-021d99dad228", "value": "1536:WjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXV:OB9wzbqtWb08UscYJhnpjyq9qBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259511, "uuid": "4f1c268c-8cb9-4a82-8aa6-122f92515faa", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259511, "uuid": "3a438d51-7501-433f-84b9-93d16d482711", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259511, "uuid": "d4ca205a-1b17-4fb3-b109-c29405bfdaf8", "value": "diagram-1110866547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567e9c62-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264367, "uuid": "91e9cea9-7033-470a-9f84-413c43105f19", "comment": "Malware payload", "value": "139b12cd90c7c797761f10a2b3f9ffdc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264367, "uuid": "e54ff18c-26c7-499a-b6af-4561a4b4a9e8", "comment": "Malware payload", "value": "10d6399c47702656778a442243a47f46c76c31d6d8847aed5ca2c696becc5017", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264367, "uuid": "b3709d73-5649-472d-8f3d-50497356f510", "comment": "Malware payload", "value": "f4c2eac7eb6734e7cc19f30fde071938b0706784", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264367, "uuid": "6944f446-c7cb-4ca6-b84f-3ed8c1fcee68", "comment": "Malware payload", "value": "5e5a3f71abe91b876bd58c46ca6ae8627d0b7973633bbdfa6156740bff005882df201bb6fd77c71007f5ebd8fe66eeb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264367, "uuid": "121a1ba9-5ff8-4233-a2ff-99a62e5b919a", "value": "AF33F2E0AD07F08BE745BC58DC2AAE475E3EDA0E037D78C2013BC0875DA19B99645E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264367, "uuid": "efc822de-bada-4036-b9e3-e7e7e3a7d810", "value": "1536:iXXtg3K7774iXfEz5lnm/hQMOEYus1GpVRcaz:yXma7774mfCyWMB/4GpVRcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264367, "uuid": "f5d79e13-3d44-43a4-883d-e30598a250ec", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264367, "uuid": "ac72951d-e841-4b63-9bc1-1ed5fd19139a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264367, "uuid": "a77f9209-7550-427c-a756-5fb338d16a27", "value": "statistic-683163396.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d77ad0-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216848, "uuid": "22a05b37-a0cf-4e5d-bf00-88f04a8895ae", "comment": "Malware payload (Dridex)", "value": "74e2f1da2b678671409b532e5e94115d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216848, "uuid": "877f9c71-3c4f-46bd-9b90-94db952b85a4", "comment": "Malware payload (Dridex)", "value": "10f5ee327ee7c607c848ce61087fe71c090d479db689732b8140ea026b02c121", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216848, "uuid": "be55f205-c19d-4774-8ae3-597e87c9489d", "comment": "Malware payload (Dridex)", "value": "972650a22d17755e95949b8b58c9252df251aee1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216848, "uuid": "4e920f00-b198-4d1b-877c-0624dcd65bc8", "comment": "Malware payload (Dridex)", "value": "75296e05f3ba22cdc9b21027e6b9d8558cb206b404bd25492da888dcefd861a679012e132f4c391e2e726be7f358b98d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216848, "uuid": "3094ea99-609d-474c-bd56-38fe840a2911", "value": "8CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216848, "uuid": "65fb99cf-59f5-4abb-9a12-fb0f55739722", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216848, "uuid": "67dbc812-4194-41ef-8754-3d461c9a0a6c", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216848, "uuid": "3610ff69-b20b-4816-98b4-855d71faebf8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216848, "uuid": "c70a2eb0-8f42-483c-b00c-72ade3ec112c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216848, "uuid": "9382ce0d-7162-4dd4-adf7-f313b7a2e7f2", "value": "74e2f1da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae0db9b-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262898, "uuid": "7cca32d2-180d-4a3d-9843-2d016d720598", "comment": "Malware payload", "value": "12a18e364239842a80c52b1e29137baf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262898, "uuid": "cadfed56-eb8b-4244-b5a0-bca14fb2b7f2", "comment": "Malware payload", "value": "11041dc0d91778ed3d72c21d3d58f0ee169456564368dd6c90a28d28c2983ff4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262898, "uuid": "5ac7ff09-30dc-4449-9d58-86fd6976e187", "comment": "Malware payload", "value": "3d36d903ebdd60cfd3314e62d10878e283c21484", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262898, "uuid": "565bcdef-b635-41b8-84b6-0e0245e110d7", "comment": "Malware payload", "value": "b7c0b5f7faf25af2e8cc5a9607d6948767f93edf295a1308b396d113e75080c3785147f5ea425f3a0dd3548d2da4138a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262898, "uuid": "e9605704-81d8-4837-92b5-6a8b8c519d4a", "value": "433302E0A805A04BF754BC4DECB79D028F3EE91A077D7893116AC0875D61AB5A709E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262898, "uuid": "71184e15-e9d5-4e3f-874e-35fc7e965e3d", "value": "1536:VXXtg3K7774iXfEz5lnm/hQMOEYus1GpjIdg3c:xXma7774mfCyWMB/4GpjIdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262898, "uuid": "e8505ffb-fce7-4dae-af65-c9a483a4f419", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262898, "uuid": "f6aa80d9-c39c-49f5-84bb-628e74d8acf5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262898, "uuid": "c1fb6167-74b0-4e39-ba77-0bbafcafdd93", "value": "statistic-1481180144.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7939b3f6-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262278, "uuid": "10900838-9144-4ffb-9ffa-9a28452ab3f0", "comment": "Malware payload", "value": "0537cd49641258ce2ce9e6488ff145f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262278, "uuid": "420f6c7d-5649-46c1-a958-7a620bb0dc97", "comment": "Malware payload", "value": "110eca92664a1a0c1e73954135e8d62dc908185e6792ef85bc72a3c1364e7d8f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262278, "uuid": "05df3cad-15fd-4e21-9692-0f2525fac308", "comment": "Malware payload", "value": "689c65b869683f8ec8af9a84acf9de2972f13225", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262278, "uuid": "f1c268a8-97fe-442a-b5f0-a7b8e090b84d", "comment": "Malware payload", "value": "68ae5988d84a0efc0caab169d57be8b0831077b18440b80bf950d7dec4639af20b2b71cfdd36ec053e5e0a004bc99c1b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262278, "uuid": "9404d9b1-ce11-4d13-80b6-b2a6bf2e0c94", "value": "9233F2E4A507E087A349B85CDC6A5D038F3DE91E433E78D2022BC1D74E61AB6A645E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262278, "uuid": "34e3d6b1-c885-4c58-9d7c-c409d314616b", "value": "1536:QXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZoZ:UXma7774mfCyWMB/4GpWvZoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262278, "uuid": "ae5c0f07-4ed7-4bca-acba-a8c021717487", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262278, "uuid": "eb841106-1a8a-4fc5-96fe-863a8c68c445", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262278, "uuid": "31fb4e24-3f2f-4005-9875-0ab0d49a520a", "value": "statistic-1020816749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ab5d22-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256717, "uuid": "131eeb3a-7518-43db-9c42-5d16c1b9ea9e", "comment": "Malware payload", "value": "e131edd2af9e7d35707f273267571a13", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256717, "uuid": "84bf3f02-1474-490f-9c55-68c4d0ea49eb", "comment": "Malware payload", "value": "1121565ee3a3837f707da5f4d2bee963bf135a71058e7dfe9b7565c79092a61d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256717, "uuid": "7c04ba83-3079-4e00-8360-3df5620c4c5f", "comment": "Malware payload", "value": "85faaddd52942755ec2f37946eb7f6d484ac272f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256717, "uuid": "a0c2cf32-91f4-4f1c-baf5-ca3d8a5d182d", "comment": "Malware payload", "value": "73b210c21b6f4906b3c77f05d2458ddf41ba40e7027ef9126833885a2abd46d7f0542cb05aa672bc2b8f5272e7d42be6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256717, "uuid": "b9f99990-ad79-4d14-b732-ae076348d7d2", "value": "3C330182E658018DCE4FE29730B5FAE8E67D7A530D9DB8D05A7E1B4591934F1082F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256717, "uuid": "ca3e6168-0e4c-4573-b0ff-eb2574f21d2e", "value": "1536:52fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI2Xy:kfqhp+g5ru2kmUEt88Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256717, "uuid": "5dffadd3-9987-4617-956d-f8d16477adeb", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256717, "uuid": "b968a2d2-00d7-45e1-afe2-6fdb62492e0c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256717, "uuid": "97211cc3-db99-45d5-aef6-e13ddff3d267", "value": "catalog-1043007082.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ffb906-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258106, "uuid": "5b1565c5-53b9-49c0-a8cf-416cd31b641c", "comment": "Malware payload", "value": "9f37363e639d09d9bcab0bdc3f35f4d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258106, "uuid": "e9d20d08-4780-4290-bf7b-d7a07bcf678a", "comment": "Malware payload", "value": "112b797f800950d6a7866927cee079743c03d1e90d695a624756247fcde8ba17", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258106, "uuid": "7b44e56e-a10f-4a29-95df-714c66884e1a", "comment": "Malware payload", "value": "30a0230dd05a60a3d8ca0473cfd24061162f0fc2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258106, "uuid": "18abfdfe-9441-41b7-bceb-16f73169cb5d", "comment": "Malware payload", "value": "c06adf1bdf2b7243d4929fa23889bc798968641fe05b119a1b002ae70198ad1eabc6d987466537648cda80fc122cff28", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258106, "uuid": "293b10a8-9cfd-47d5-81eb-60f7308f1ed1", "value": "6433F181E554114ECA0ED29B20B6F9DCE2DDAB530E9AB4C09E7F1B44C5924F1482E64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258106, "uuid": "1b362de6-7bf8-4757-a785-c3b96c09e945", "value": "1536:r2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIFHT:Kfqhp+g5ru2kmUEt88Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258106, "uuid": "f370020f-d835-471c-ae27-71e61ea6d27e", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258106, "uuid": "b9231993-a29a-41aa-9bfc-527032c9f6d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258106, "uuid": "3ff5b4a0-5e12-4deb-b7cb-2c2f6917ada4", "value": "catalog-2101920354.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c299cc-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621260639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260639, "uuid": "f5d5ab28-3672-43ae-acf8-046c32899242", "comment": "Malware payload (AgentTesla)", "value": "e7e4f6ab87d70bfd3c603bd1e9694861", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260639, "uuid": "c5bdcd06-0725-4927-aafe-779abe814eae", "comment": "Malware payload (AgentTesla)", "value": "1137a5b1100685623a208af986d530c8f603f82e874721bdac8ce48488baf08e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260639, "uuid": "fea2d498-2755-4854-bbdd-0ee99f7e8a8d", "comment": "Malware payload (AgentTesla)", "value": "6ee8dbc84d3bf0c1a035bef15b6afab1a31076cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260639, "uuid": "95ec8e32-5ce0-415f-99d3-eb3136524fa7", "comment": "Malware payload (AgentTesla)", "value": "666a4b1c84c5b902efcdeceb4165329e9febe70de952788211d320dd3fb9f55d8e303efe0bb5d6f42f99ba4f51408eb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260639, "uuid": "05c2a713-1448-4431-8ff4-702eaed352b5", "value": "D0A4CF34FCDD602EC776EB7459B2924CE6A7957E6613D5390C2E12C14AB2B01EB81C3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260639, "uuid": "b9130e84-196e-46e1-bb64-62c9adf8a570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260639, "uuid": "ba619743-1d5a-475d-a8d0-84e0949d1168", "value": "12288:4h34d7TXiihieMGYj5riuQYcsZZIZg9z9cJ:4h3A7TRh0jpRZp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260639, "uuid": "52ff775e-ce76-42a9-99a7-97ece93a3883", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260639, "uuid": "3f6c237c-99fa-4cd3-85e7-63ee80eb2189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260639, "uuid": "f5dc3d04-590e-4e96-9b05-90bf96597a9d", "value": "Quotation 60563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e49e981-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258770, "uuid": "c9ecb758-87da-4f75-abbd-9813924003ce", "comment": "Malware payload", "value": "e69c153dacc16f7a0dedab90b47e2ed1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258770, "uuid": "9aa9cf95-5875-4c36-9828-42f867ce4605", "comment": "Malware payload", "value": "11945346bbe3362792b4e782f1d52278c5b135e0ad71859c95fbf9d5f97e043e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258770, "uuid": "552c307c-959f-42d4-8c2a-e89ea0bcb835", "comment": "Malware payload", "value": "398aec9db9ceb55080201bfacecb79493c35e28e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258770, "uuid": "b40047ca-0872-4ba4-aa08-894cc0e562ed", "comment": "Malware payload", "value": "56ca41b28248a01eb72b49ca12b1d3e8f1bd3ee14b11327343a535cd988475524480d4033d28aa64982a749329191fc8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258770, "uuid": "6c3b68be-cced-487f-8ba6-cff9ce1ecc06", "value": "8E33F141E658028DCE4FE29B70F5F9DCE1EE7E5309AA78C0962D3B4191430B1482BA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258770, "uuid": "b3a2b7dd-65f5-4ffe-8421-440e35d59a21", "value": "1536:j2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxg:ifqhp+g5ru2kmUEt88xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258770, "uuid": "ca41c0cb-3186-4658-aa2b-1c7cc8304a56", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258770, "uuid": "67b4351b-6c7a-45fb-918b-0bb09dd5f8be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258770, "uuid": "90e32c1e-7841-45bd-a169-fefac86060db", "value": "catalog-547263457.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7405bcf4-b73a-11eb-abe1-42010a9c0039", "comment": "Malware payload (TaurusStealer)", "timestamp": 1621274724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621274724, "uuid": "5530df32-24e3-421e-89a2-11dbbb48c92a", "comment": "Malware payload (TaurusStealer)", "value": "0be6ab4816802522b78b028573e9319a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621274724, "uuid": "1587c2ab-ec4b-4e03-aedd-96b9067ad434", "comment": "Malware payload (TaurusStealer)", "value": "11c493b1c2a4f8f2c9c61786ee882b63466fcb07126b0d98a2ed2a3836ba36e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621274724, "uuid": "eac2350d-3e62-4f9d-bac8-95bd0c43cb34", "comment": "Malware payload (TaurusStealer)", "value": "a237b8fe0d498a6db268e09122a362738505f134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621274724, "uuid": "64462a36-376a-45b6-a565-d18c6561e627", "comment": "Malware payload (TaurusStealer)", "value": "b5c12a91a78c36447693224bd505736ad5a63db7f134fe520765cee49305c1075b05eeed633dbdf8ac826a9f532e1dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621274724, "uuid": "abb2d34e-9387-48ed-9dd4-7ee0f8429f91", "value": "C0E4BEA27338FD32D85E4CBA5A15BB1041B5EF1430DC818CB0C5719EB6A6BC1B64ABD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621274724, "uuid": "46ee8391-9b54-40e3-8ca2-2f987f0467e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621274724, "uuid": "06a5ac0a-386f-4544-bc34-591d7805c619", "value": "12288:sIxe2iJl1ES33lNrCuQbJiNUed3up24zSq6rFj60wO8nlnJxtP11:Je2iJl1L32uyAueVupRSqeolJxJ11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621274724, "uuid": "23d23929-6deb-4a2f-b913-c38d71518c68", "value": 714096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621274724, "uuid": "90933550-ebc2-4f26-abbf-7ddae1671527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621274724, "uuid": "b5f35f91-5aa0-454e-b4fd-3ea40c3f030b", "value": "11C493B1C2A4F8F2C9C61786EE882B63466FCB07126B0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a7d215-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259530, "uuid": "439c9b52-4296-44f1-bdc5-72f8e4b9a80a", "comment": "Malware payload", "value": "521dd62abc9769a22d73badb3be37140", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259530, "uuid": "df6935e1-1fbb-4d98-9a88-4bd341fa144f", "comment": "Malware payload", "value": "11c64a11057cae21327a60f9802421145b93812904ad8af8c3ad59e559300b5d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259530, "uuid": "fdcb828c-2019-4dee-a9a7-9fc3fe4012d6", "comment": "Malware payload", "value": "c9ad248908d311ec7299dd832b0c38384d30c45d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259530, "uuid": "d3aaeeae-cd60-410c-86b7-b5cb7e484e15", "comment": "Malware payload", "value": "6f109213e58fb838430a8d8aebe9ddb067f86157c7d153c7e8c16df6a95d6c7014bfaa42b9bdcfe7b46851790bbd9bee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259530, "uuid": "6b9300d4-ff9c-41b1-929b-4949942952e0", "value": "D533F07147DCCAE66D76E0BF84C2F808FFF29952C987872645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259530, "uuid": "3c6c5204-63fb-4b83-af4c-69e455208fe8", "value": "1536:/jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wXK:7B9wzbqtWb08UscYJhnpjyq9qEK0wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259530, "uuid": "92cc3229-7445-4592-bd4b-e42fa5439c52", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259530, "uuid": "f8a14fbe-fd5f-4b2d-aa89-95cf698dc156", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259530, "uuid": "ffe7dcaf-fc99-48a4-978a-bbe6ca790f6f", "value": "diagram-1121689731.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8da730-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264538, "uuid": "73d9c07e-4ae8-4303-8a8a-183796252554", "comment": "Malware payload", "value": "d376d6778fce9e1578d5471d373eac03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264538, "uuid": "0e421d01-1ef0-4483-91d0-4855aa6c7b02", "comment": "Malware payload", "value": "11c80546c809154278b3d165554717dd1f5d2902f9963a88c97a62b5103fde7d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264538, "uuid": "68d77a51-d8d7-4526-b195-8ab3a218e2c4", "comment": "Malware payload", "value": "7f70edee40060c0593554d7305f9852e77bdcd5f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264538, "uuid": "2067be05-6d9b-4714-ad0e-b0af80bc273e", "comment": "Malware payload", "value": "59a7ba8d9a5c21fa780455335eacabc4e7c1f4df388dc08320ce51cafa6bdf72463c26dee881fe6a98bec1d08cf7db81", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264538, "uuid": "aff75f67-ff55-46ab-bf72-056cf66acf37", "value": "2733F2D09902F087DB45BC49ECBA9D124F79E94E47BD74D3027AC0834EB2AB5A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264538, "uuid": "83cbab42-323c-44dd-a2a5-b0cf3f41e3c7", "value": "1536:UXXtg3K7774iXfEz5lnm/hQMOEYus1GpDkIq:gXma7774mfCyWMB/4GpDkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264538, "uuid": "89b63f93-15eb-406b-aa09-af0f9fbd3e12", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264538, "uuid": "a730e379-20da-4b4d-8c58-fd6f900c891a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264538, "uuid": "17f40a96-e03d-4ca6-bb1f-25c436584e26", "value": "statistic-795070748.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85d62b-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262500, "uuid": "5ad6fb69-7782-4f11-9eae-3eac1e795cff", "comment": "Malware payload", "value": "1217d033606c8f9698b721edacd57288", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262500, "uuid": "2cc6bbb4-41a4-4795-a13e-9c774286794f", "comment": "Malware payload", "value": "11cb5c65bbf19de950b78882b574fdda7a14b552064b51bde7a207f6bcaca653", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262500, "uuid": "50bd8603-50c3-4052-b5f4-ccb225dbe4dd", "comment": "Malware payload", "value": "e026c69955c0db22041ce4880c471f3561203ab4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262500, "uuid": "7f895961-079f-4bfd-ba2f-c97e8756387b", "comment": "Malware payload", "value": "81d0923da90a4f0e0ad9e9ac539b20152b8fcff7ba5ecf35a3aea0195bcdf1a0e49b21394133a262ffa570471784a418", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262500, "uuid": "3ebdf5ae-ac42-483e-9834-52c5d73f8a6c", "value": "E23301E0A906F08BD744B84DDCBA9D135F3DED5E423C6892413AC0874D62AB5A715A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262500, "uuid": "a977b9f9-a5db-44dc-a590-e2b763b81b6c", "value": "1536:ZXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVBz:NXma7774mfCyWMB/4Gpu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262500, "uuid": "0e51b230-d6e3-4b32-9325-393799aad6fc", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262500, "uuid": "de7e6518-9648-41f6-8237-8edfed8996bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262500, "uuid": "cc438a50-47ff-4a2a-b5aa-a0382dee962a", "value": "statistic-1211487874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261c274d-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262568, "uuid": "9e25beea-2b3d-4a9f-a857-e553b51965d2", "comment": "Malware payload", "value": "1f6bb393c4e018135ed3bab12fa659cf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262568, "uuid": "fbe0b518-80fa-42dd-b9fa-c06132793ed8", "comment": "Malware payload", "value": "11d69f5ac89bca010f24bdc50b57ec55b958416e6f26096fc778fc918200b119", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262568, "uuid": "a2440f9d-0912-4582-908d-d0479f9d8be5", "comment": "Malware payload", "value": "03f5b907e42e044c1b5dbf0a381e58790ae65f0e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262568, "uuid": "14bd05ec-1e50-4e81-96f4-f3cc2986f057", "comment": "Malware payload", "value": "7a8024014a0f12633c3ef5af2662035dd18d41dca4a9b2d66e60e3b31c4c93f2e31d56979c03ef6feb1cadb35c2ee2a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262568, "uuid": "17c9d0b9-04a1-4175-9d02-0dcb137dfd4b", "value": "673302D0A502B08B9758B85DDCAE6D134F3DED5E433DB892413AC0C74D62AB5A709E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262568, "uuid": "8b65bac9-5962-4feb-99d0-b167e36bcb09", "value": "1536:EXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVGR:wXma7774mfCyWMB/4Gpu4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262568, "uuid": "e00c3e3c-41ef-4df7-bd5c-31e224ef334b", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262568, "uuid": "91cd61d1-6fd7-470b-8811-32dfa2d65dd2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262568, "uuid": "3217febd-b4f4-482a-9cc5-7a37ba26ff4e", "value": "statistic-1247741449.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59089ebf-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260076, "uuid": "ac014a3f-4776-4596-9e83-4aaf4246f5d4", "comment": "Malware payload", "value": "603a4836cec4fd4a965f70c6275c8c61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260076, "uuid": "45d3d0ed-7695-42cf-9edb-7612a477c01c", "comment": "Malware payload", "value": "125dba83701a45ccdb947be35ba44516e94ce7b097d8c766d17ba52398f1b85a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260076, "uuid": "d930278f-4930-4153-bdb0-835602361709", "comment": "Malware payload", "value": "5dab26194129748d346d9ea1457140bb5e6c7579", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260076, "uuid": "72d02184-d899-4c47-9781-aaa3ec578554", "comment": "Malware payload", "value": "a221e5d39033199899062444ed404e4ce2180c381fdd322a2ed88ff341ecc93475c13554a79b0d30f02cb32f2163de3c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260076, "uuid": "b09c8bce-e6e4-40a1-8303-3f63c41a1867", "value": "BE33F17187ACD9F668B2E4BFC8C7B504FFB2D499C4D786224AF871C9B6D11944E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260076, "uuid": "6e961678-ef94-4bce-8b67-463489008fb7", "value": "1536:EjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX3t:sB9wzbqtWb08UscYJhnpjyq9qB3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260076, "uuid": "1248e2cd-f5c1-43cd-983b-ed83e473c71c", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260076, "uuid": "e37f2343-3634-472e-9358-ea6c193d1430", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260076, "uuid": "f6c7a6b5-f936-48fb-8d5a-3b77944775d1", "value": "diagram-1556813094.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5d468c-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260214, "uuid": "7169c3cd-f7b6-4ed3-8bc2-84e71ca887a4", "comment": "Malware payload", "value": "321de8608202570ad6cb90055ce372cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260214, "uuid": "2f91f649-d020-4a15-a3a6-65b32b97f706", "comment": "Malware payload", "value": "1263268c6df051cb904ded21cc8663f2002f1b59c3f7eb34ba6c19dd75ab119c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260214, "uuid": "c6918b77-51b0-4260-98f8-7ecb350831f1", "comment": "Malware payload", "value": "70012d1f9ee809f3387ca3ba424b758ee42e7b20", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260214, "uuid": "b8a66183-9e8a-40ae-9406-37e102635048", "comment": "Malware payload", "value": "347f3aa2de65103d38ceebb2a5fbbfcb12754b482ee736fc7313cd11b64bdefd3d0c06fc02885e1c821b30eb2a2c5ff4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260214, "uuid": "5f8ca54c-5bb3-4bd1-bf36-466d003c4f2f", "value": "2333F1711BBCDAE62DB1D4AFC4C7F900FFB2C869C59B865285F870C8B6902159E72E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260214, "uuid": "6031f2c2-f08d-43b9-a20e-a7fc03834d77", "value": "1536:YjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67s:YB9wzbqtWb08UscYJhnpjyq9qaws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260214, "uuid": "c2a4859e-7b01-4e5d-ba36-5766ba0ce6a9", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260214, "uuid": "60f7cc68-d05a-4838-bbbe-f6623aba6819", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260214, "uuid": "4a79454b-8362-4ccc-8fc0-e37a216d6f2e", "value": "diagram-1644711596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5a938a-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262795, "uuid": "b6344786-b0dc-4d69-a0fa-58c723208de0", "comment": "Malware payload", "value": "df8777b06e3b407f93837b57a5ab267f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262795, "uuid": "7592b841-f9d4-415c-8c71-8317f717d7d9", "comment": "Malware payload", "value": "12721f95fef26a81b672c7e2aafbc661a47aa3357cdc01787e00ce139041fb4a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262795, "uuid": "28789152-edba-4e48-a710-8f1f6adb5e04", "comment": "Malware payload", "value": "da057249a7ed52af727b1a6693d4459a64184ac2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262795, "uuid": "4fc3e9b7-2842-4107-92c9-6025395a07a9", "comment": "Malware payload", "value": "9501ba4dfb16feaed1eaade65a4e16c9668c0d6b0f2dea36f85a4b9e20b9f3326afc7b5ec94b00a55ebf5cec479d8d37", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262795, "uuid": "e2ee7f3f-6a2d-4428-b297-88f629aa0660", "value": "F933F2E09902E08B9759BC59EC6B9D078F39C91E037D2893017BC0878E61AB5A645E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262795, "uuid": "69c1c1e0-baad-4180-968e-1471b64d5b36", "value": "1536:4OXXtg3K7774iXfEz5lnm/hQMOEYus1GppHXj:9Xma7774mfCyWMB/4GppHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262795, "uuid": "199e8d08-c905-43eb-bf53-01c614dbac2e", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262795, "uuid": "f3555930-13ef-4f7f-a4b9-eb4a67b89b3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262795, "uuid": "9e0db164-bbcb-4e84-b052-abf9bbb54301", "value": "statistic-1420519733.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec139353-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259893, "uuid": "7bc9f256-6f78-4acc-9970-6866c8f868a0", "comment": "Malware payload", "value": "b0d71df823b548c0deebdd4701e1723a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259893, "uuid": "9354e530-9a06-4359-be7e-9546524bd7a5", "comment": "Malware payload", "value": "129055891bf2136cc2f8784ba5f5fdb83c0f2d1ab8844e35e7775ccb302e5323", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259893, "uuid": "df63dc3b-327b-4dbc-9a95-87fbeb4fbff6", "comment": "Malware payload", "value": "8cdc674fb23b7d147894875b011a40122ef63053", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259893, "uuid": "64e32693-f278-45b8-bf92-fc67a35b4124", "comment": "Malware payload", "value": "09f7e53b4ede0fb6ff3739aabbc01fdd637d4927a402aca9ec1bfa18c6a303599f45dd3a3dc93d05c98d199a334c7145", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259893, "uuid": "d0b0e848-4294-46ec-a4d8-ed65d91c8713", "value": "2A33F13147ECCAF62DB6E0AFC8C6F604FBB19495C4D3862649F9B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259893, "uuid": "db8d9c25-90f5-420a-90e8-96aa84de7a0f", "value": "1536:sjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX0M:UB9wzbqtWb08UscYJhnpjyq9qBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259893, "uuid": "f01fb152-8d91-4cba-b2b0-c3258baab5f3", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259893, "uuid": "f1012152-e782-43b9-ae6e-5d2aa4275568", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259893, "uuid": "8b5c8658-4866-4f20-b65b-b3322ff2e02f", "value": "diagram-1439641974.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5c8db8-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263034, "uuid": "2b4f041f-13ec-4f1d-9754-eeb99e762efc", "comment": "Malware payload", "value": "610736617ead4835eac5c611771decac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263034, "uuid": "1acabe41-b08a-46ea-a588-a91b1e26adf7", "comment": "Malware payload", "value": "12be7252109ddc73dd49a54c631261b9f4ab434dccc2bb4df7a41df8095bc435", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263034, "uuid": "172b242d-a303-44c0-849c-1daea293ece5", "comment": "Malware payload", "value": "cf6ac013f1032df48ecf0ee3fe461954bd1e6a05", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263034, "uuid": "f55cc6d0-5c1f-4841-bdf8-a3a4236ea2a1", "comment": "Malware payload", "value": "d8c4ad13c9c837fef693c9de4562b1de64fe3800cd560985185eb85ee84b1f9117d707243315f34b9d9fc59c236aa8f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263034, "uuid": "1466fe49-8c5f-4d72-bccb-998b3ca03ed7", "value": "6A3302E49507E0479749BC2DECAB9D438F3CE91E033E78D2122BC1975E61AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263034, "uuid": "f01f4f0b-e06d-4517-971d-ca089fd95104", "value": "1536:AXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ2:kXma7774mfCyWMB/4GpWvZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263034, "uuid": "56ab914c-c767-4d9b-90d3-381c94ad52d7", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263034, "uuid": "e213f952-877a-429d-a877-9e512c8e5259", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263034, "uuid": "82063c23-df7c-4b14-bb8f-99b7b38a32cf", "value": "statistic-1575561804.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae3eb2c-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260026, "uuid": "759a9081-5892-478b-bf0e-8bbf5dcf1d68", "comment": "Malware payload", "value": "1c72e513d62cde843890b13f1f410684", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260026, "uuid": "d9fb4ac7-289e-4553-96f3-3216ac605175", "comment": "Malware payload", "value": "12c7036880a665fdd797ea8df0e3391f95275911e59933c5d81cadd7fdf6d3d7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260026, "uuid": "8dbc46ed-6fb1-4384-a650-0c4f6ebbca90", "comment": "Malware payload", "value": "28f295ca9e87c1cb933f87235402eb749384468a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260026, "uuid": "2fc81124-907f-424d-a486-b250657a088d", "comment": "Malware payload", "value": "6912f8245d73b0017588d16ec3003a063159f17314d9fbc4c1af8f2fba0fb9aa5461d279b8b3c69957d301feff9406cf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260026, "uuid": "f587b159-8af1-4955-9814-e0440a29c18a", "value": "5033F17547DCCAF66876E0BF84C2F808FFF29951C987872649F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260026, "uuid": "d8ec631a-22e4-4c78-9067-1ae8d6402384", "value": "1536:zjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wp5:HB9wzbqtWb08UscYJhnpjyq9qEK0wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260026, "uuid": "93ae3d52-d205-44d8-83a3-b8780c482a2c", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260026, "uuid": "9a0b5183-dc37-45ce-8950-efbcddf9140e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260026, "uuid": "3e91f8d8-ab2e-436d-a8f7-3d957e4887a3", "value": "diagram-1534972957.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091070bd-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256935, "uuid": "563fabdc-312b-4d39-be30-6b1efa7baef1", "comment": "Malware payload", "value": "095138da2989326d17588ca3411d48da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256935, "uuid": "f3e60c91-8135-4ebb-997c-fef43397d5c2", "comment": "Malware payload", "value": "12d320e4b16802afb2dd9660694de10f4b88f6afd0fba6ae4d3946e622994407", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256935, "uuid": "641487ca-5da1-4d8f-b4bb-ae46751a122a", "comment": "Malware payload", "value": "a8dcb947dd8d22003281a3d2ba01e3ce0fd0ee76", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256935, "uuid": "a060c613-1e68-44ce-a645-0198591b97b1", "comment": "Malware payload", "value": "0b0ad07491b7aaa7a0c47fcafb17eb7ccbd7c90bf00f33111e674ec57b9803b791903a65b4ef8a08192f9b4f7b01adc7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256935, "uuid": "85855167-4a7d-45a1-8b9a-8cc729c3f0f5", "value": "F6330182E658018DCE4FE29770B5FAE8E6BD7A53099DB8D05A7E1B0591934F1082F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256935, "uuid": "66063480-8ead-4246-964d-578d909cdbf5", "value": "1536:82fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI23C:Nfqhp+g5ru2kmUEt88UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256935, "uuid": "f9eec1fb-9559-49f3-b7e7-029833ea704f", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256935, "uuid": "5d92ea02-6cbb-49ee-9400-88e5346f51c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256935, "uuid": "06619176-2153-4b4f-b225-bd887d713359", "value": "catalog-1219840431.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d0005e-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256871, "uuid": "200ed672-8bba-4526-badc-59762192a4df", "comment": "Malware payload", "value": "c63e06eed27fceecb37c48f3de8e7ea9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256871, "uuid": "a67eb52b-890c-49c8-9256-4278a9f7d199", "comment": "Malware payload", "value": "12e8ec89cc75a02be1cd4ad142597ce200172e25f03acf15e652008e06489164", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256871, "uuid": "684a00dd-2aa9-46bf-80ab-2a11ae6c3e0e", "comment": "Malware payload", "value": "5f008582b31a85ec0482afe9c44e4bc12df627d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256871, "uuid": "2d8fa340-56c9-48a8-a364-618b32a0d351", "comment": "Malware payload", "value": "6b808359c22f6c35744f2a4809232adfbb4ae5589362ace12c7771759b2be2c1e6f9987f3a296a44316395d625ecf04b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256871, "uuid": "1cace5a8-5ee3-483d-9759-3d89dc2d4dd9", "value": "6533F1D6E664118DCE4BE2EF30BAEADCE29EBA430D5DB4C0963D160591534F4482F64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256871, "uuid": "43954017-088a-47b9-ae78-c2808905e2ed", "value": "1536:l2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI0Xa:Afqhp+g5ru2kmUEt880K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256871, "uuid": "a40f7f0d-9c42-4743-a6fa-de79d8390d4c", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256871, "uuid": "1ebf5a1f-9ac1-46ce-aa4b-8efa55a728d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256871, "uuid": "9c2348a2-927a-441b-8f00-cb7e0edf84af", "value": "catalog-1158683650.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb69800e-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261127, "uuid": "b4bf2c0f-b106-43b0-b8d7-4788b71f3423", "comment": "Malware payload", "value": "d210486cebcce21c4c591089a7ed23f3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261127, "uuid": "22ab0684-ee75-4dbe-b030-f118fd6baca7", "comment": "Malware payload", "value": "134dc16d70763b3f52368d11fa86fc445d6b0f129ee08023a3021994084f35b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261127, "uuid": "982892ef-3e65-4467-8421-b4235ef97987", "comment": "Malware payload", "value": "266e1f698c6a39d6608d709cb93afbdb59612829", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261127, "uuid": "b5e11b06-00a9-49f9-9bd8-136f27aa7871", "comment": "Malware payload", "value": "4cf30ac3999ad40e859d3ecd704a5bf23919ead226205e81f608fc039f1c8657643757e8246227455c06c443862eeab2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261127, "uuid": "6d7c08bb-b5b3-4bd2-be7d-3f7ee387c7af", "value": "8133F07147DCCAE66876E0BF84C2F809FFF29951C987862649F9B1C8B6E52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261127, "uuid": "fdda9d3a-ff43-44e3-b6d5-4282d8caecae", "value": "1536:ejfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0woT:WB9wzbqtWb08UscYJhnpjyq9qEK0wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261127, "uuid": "7b1486e0-d853-40e1-bfe9-b857f122a743", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261127, "uuid": "7c0aa594-fe3a-4346-bd19-2b837f335239", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261127, "uuid": "ca207049-778a-40f0-b118-c387db8463d7", "value": "diagram-328557078.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6169ac2a-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257513, "uuid": "627c2c1e-1574-4a5a-9e55-8b84b1b8cf41", "comment": "Malware payload", "value": "51d7d9ac068ebd8dfe9421742be00646", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257513, "uuid": "a320d563-db9f-424b-ae90-85d658580749", "comment": "Malware payload", "value": "135fa24a9861b222ce6082d9eebc2256669abf1ee956447c54a7ed8ac16be70f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257513, "uuid": "00a23ab8-9770-4e3b-9373-f8f8585d5870", "comment": "Malware payload", "value": "d85cb5ba4a0f1c55a5e5c684b853a6f1ddfd8784", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257513, "uuid": "14934629-f166-4c6e-bb88-402582f39045", "comment": "Malware payload", "value": "05c464421944f7432936115926249f07dbf85c179ce5d84b135907d69af3a7c989f4a0aca6caae724a195fedea9d9bb0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257513, "uuid": "a72ef103-52fe-405a-a0fc-03c7a6aec85a", "value": "9333F1919554118DCF4FE2AB70F6FAECD58E7E130DA978C0AF6E2B4981430B5092E58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257513, "uuid": "556d11ae-208f-4d34-9ac3-fa9f4725e2b8", "value": "1536:M2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIY1G:9fqhp+g5ru2kmUEt88Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257513, "uuid": "e51e3543-0b2a-4e93-8299-75d930af2f0f", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257513, "uuid": "16a4fb5c-2443-42c8-90b5-ae988115a82b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257513, "uuid": "185e8283-8317-4595-9a6e-24726d8435a5", "value": "catalog-1646892527.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30201a7-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260281, "uuid": "6e014ed2-4fc7-438a-a5b2-39976232c1ab", "comment": "Malware payload", "value": "38027432ae3451e4e8df6927e0f0c66e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260281, "uuid": "5fca89b8-6c70-47da-a4b2-33721b284f3b", "comment": "Malware payload", "value": "1364c3f0950b7fe517b4d3fe0b7d880c31d9526393728d4c0c67e26b3b6e5ae9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260281, "uuid": "1b5373dc-c547-4874-847b-2c2560c0fd5b", "comment": "Malware payload", "value": "a6b42aa27f07e0bd0b40973c064416beefc96f9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260281, "uuid": "859d72e6-a72b-4849-bd72-7135fec62e21", "comment": "Malware payload", "value": "15bb5a50bae67a76ad6ca67f8af8c24c336b7f71904bb97d673b93df4742f887bcd71893227f9a6756ed2fe783ffaaac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260281, "uuid": "c031ca3e-2534-4059-bf46-f2568b64b5b1", "value": "023302714BECDAF628B2E4AFC88BF504FFB1C455C4D7862649F8B1C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260281, "uuid": "b571e6f8-14f2-4195-aaa7-1914eb8408a1", "value": "1536:TjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXvK:nB9wzbqtWb08UscYJhnpjyq9qBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260281, "uuid": "5c321f08-12ee-4f67-b53f-862b23336bdb", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260281, "uuid": "4c3fae0a-4263-4f39-85c1-af34fb6781e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260281, "uuid": "4fe34fdc-c5f3-49df-bf8f-91943f828e61", "value": "diagram-1691105917.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6419dfe1-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264819, "uuid": "a64dc586-69f8-43a6-ab56-ca44949139b4", "comment": "Malware payload", "value": "165917cbcf316686d69af6a3cd0f8a9f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264819, "uuid": "ba2dc89b-393e-4946-8a24-89d4535e96ac", "comment": "Malware payload", "value": "136c5077e38ad11b59820592fce7524b7c94e896b87cbcff87bad7b624b41323", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264819, "uuid": "9c0d78f8-96f1-48a3-be7e-2002635d547b", "comment": "Malware payload", "value": "843517bbaca3513a5bae1704ed4fb6d7c6942bb6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264819, "uuid": "ee77065d-0f83-46ec-938e-c925ec0622a8", "comment": "Malware payload", "value": "65e460d7f807069143169074df0ad8a1b2ef6b7ea64f2926890a597a06a410e28cf0c4d9470995f4642a1fa7a114be6a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264819, "uuid": "8062b1a4-5e15-40a8-b41b-7eeda5a08f7c", "value": "703302D0A902E087A7557C68DC6E6D479F3CDD0A433D7853112ED0874EA15F8AB45E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264819, "uuid": "73bc4d2d-3b4e-4086-a589-d0b943787bd1", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qTs:cXma7774mfCyWMB/4Gp073", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264819, "uuid": "cd0bfe1e-3f7a-47d4-9784-1d6cb61c8cdf", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264819, "uuid": "be277491-bec5-4e5e-861e-36130b8a2e4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264819, "uuid": "44b69d19-d7e2-48ff-bb7f-04cc606198b6", "value": "statistic-97846526.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e958e1a-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264729, "uuid": "f1ca9db7-34b5-4ff6-bc7d-b98d18e29227", "comment": "Malware payload", "value": "2574b2337266f0abb37c6d631d91237e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264729, "uuid": "a99cc743-03ed-4cd3-a93d-92bdafbd152f", "comment": "Malware payload", "value": "137e7c94604ff1ca97db8a22f1c012e79401e8b374b8890f32ee0e4694c1537c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264729, "uuid": "5b837e58-88ed-4ce5-9a8a-1c3f234fda33", "comment": "Malware payload", "value": "69097fb830c799218617b7734b503b173e7a929e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264729, "uuid": "d8a5b577-fd4c-4f6b-81a3-d9131eb694c5", "comment": "Malware payload", "value": "75ce939bdbee02459792b244de04b8d38aef73840fac29d4fe5c490724a702a753e64c416cb159e9340c0cdbf2ea04f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264729, "uuid": "c456b951-4fa0-4e4d-ac0c-017aaeb0d166", "value": "B933F2E09402E047A354FC58DCAAAD038F7DEA5E477D7852027EC0879E72EB5B246D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264729, "uuid": "4ab2e08b-76a5-4527-a70c-0494808b0f1a", "value": "1536:4XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMON5X:sXma7774mfCyWMB/4GpCON9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264729, "uuid": "56b686a7-27e4-41a9-bfda-406566ae8b61", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264729, "uuid": "25951b5f-7412-49b8-955b-38969700c5f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264729, "uuid": "12b78e0a-a673-4b35-8d23-9a6ed1a90eda", "value": "statistic-919846778.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb67fab-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260463, "uuid": "7da652fa-b2bd-4e8e-abb1-63a627df987d", "comment": "Malware payload", "value": "f9aa528aa256ef46168d510abe12adf1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260463, "uuid": "126dbbae-0e32-4a56-813b-22434a687a48", "comment": "Malware payload", "value": "13a9a546b358e37c23bd53594394fadd4a5d9693b4563453e45364f76697f0a5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260463, "uuid": "4d8370e2-c74a-40b3-b9bc-ab44d68c71b6", "comment": "Malware payload", "value": "315c417b7a9cbb1d2e4192652461a218ffd87635", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260463, "uuid": "3df5eb83-0b71-46f9-af57-c1fcb12d024c", "comment": "Malware payload", "value": "51aa09a6bc565e332e8978de39971d461a9c77eccd5cb60584ec0af46dbc73fc2ec047191b5870a04a788a5aefb557c4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260463, "uuid": "59ff9b6c-b05b-479f-a7dc-10daac7e857e", "value": "A633F1314BACD9F62DB6D0BFC8C6F604FBB19495C4D786624AF8B1C8B6D02845E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260463, "uuid": "088fee13-fcc4-4917-9ed3-fd8c5109cb45", "value": "1536:OjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXj4L:mB9wzbqtWb08UscYJhnpjyq9qB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260463, "uuid": "b3497f7b-eab5-495a-8f4a-ef58a72456cc", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260463, "uuid": "8e88fd2d-8c86-4e41-b089-89a9b0551528", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260463, "uuid": "b5313d48-3425-4891-b192-2ec3e616449e", "value": "diagram-1792579362.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7231e12f-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260548, "uuid": "2f6ad9f5-5140-4f1b-86b5-696d70d18412", "comment": "Malware payload", "value": "88d277dde9ec406eba235c9de6eb36c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260548, "uuid": "d9411f47-3732-4ce5-b07c-061cecc2f11d", "comment": "Malware payload", "value": "13b6f21038356c5d0b77988755bb35b1d467adf1436e63141c8f7a024daad582", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260548, "uuid": "0edd4356-a5c9-4c8b-ad04-8efc330043dc", "comment": "Malware payload", "value": "65a5e1c86bb9458735f40f7343c52ecef2579d49", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260548, "uuid": "adce4c87-506f-4406-8e55-eba6aec6af79", "comment": "Malware payload", "value": "31bef4c5aa247e2b26920365efad7c54b6e3a5332eafdfe3956de64adbdf9e52314fa979ee20a91477728d3ed6850666", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260548, "uuid": "efd5a576-7e10-4a8b-87a4-6559c2e15026", "value": "A433F07147DCCAE66D76E0BF84C2F808FFF28952C987872645F9B1C9B6A42514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260548, "uuid": "0acd5d74-e503-42b9-8bb0-210012a10ef0", "value": "1536:zjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wD2:HB9wzbqtWb08UscYJhnpjyq9qEK0wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260548, "uuid": "4e79e7e0-502e-432f-ae38-848d2c63e5e0", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260548, "uuid": "83925331-bbbd-4cfa-956b-41dd64e28d03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260548, "uuid": "dc831312-f038-4cba-8b6f-466abe1c9bd2", "value": "diagram-1866296178.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e126734c-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257298, "uuid": "f14acbfe-9084-4927-80c0-0f9661550eb4", "comment": "Malware payload", "value": "c89e6291cc4215f092171263ddfe0281", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257298, "uuid": "e67046fc-430d-4dab-af84-4e7a6f4ad6a5", "comment": "Malware payload", "value": "13c027c207dc427b596f470c1d6a6a78fd0993c5b13f78e8f74a1927d3e1ea5a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257298, "uuid": "075df338-d681-4e38-a229-8077558774a2", "comment": "Malware payload", "value": "d7382b41257c304d170203229bfa30220840bc6f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257298, "uuid": "ca8fb9bb-247c-44c5-9591-346a7ebf4d79", "comment": "Malware payload", "value": "259bb94d79f19cd1dc89cd7487a92b01f6a2544996e88b9a895a23fa6d8845d380a3b1c95a00f3d0e5a34d48d6c48a11", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257298, "uuid": "c76c3a75-fe2a-41f6-8db8-fa243b73d96e", "value": "8133F286D614118DCE4FE2DB30F6FAD8E5DE7E030DA9B4C09B6E2B4481930E44D2A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257298, "uuid": "1f716cc9-ec30-4dd1-bbca-b96cb5c2759f", "value": "1536:t2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3YJ:Ifqhp+g5ru2kmUEt88IxYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257298, "uuid": "b9591b02-9478-4428-9f49-864956d7d5be", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257298, "uuid": "4fcd7832-f560-47ea-add2-e62d46053d54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257298, "uuid": "32ead6db-61e8-4582-bd02-5e64192f2753", "value": "catalog-1475511721.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd85529-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262178, "uuid": "954e618c-9014-4eff-8ddf-c421c1d21e1b", "comment": "Malware payload", "value": "aab47885fada52c8039c67dea14dec13", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262178, "uuid": "7467c850-69a9-4d5f-9cfc-c62bc1a33eed", "comment": "Malware payload", "value": "13c3e9a302bba3c4e29fba9ddea4a46a7918e383af30e4cb8070962889c125a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262178, "uuid": "6ea6be45-3756-480b-981a-2524a6ed2886", "comment": "Malware payload", "value": "ce7ffc6fde0482f95226c4cd608ad466208706d1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262178, "uuid": "0b7e4f4b-e343-454e-94a7-df3336d69e5f", "comment": "Malware payload", "value": "842790c9a0be8777bfd7a4cf5d4fe745084f8b999c6673c085e127d4e88ec6018419fec7477337032c7ebebfe216e851", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262178, "uuid": "b26a0bc7-87b5-4c14-80dc-b85a8c005413", "value": "903302354BECD9F629B6E0AFC8C6F604FBB1D455C8D3862249F8B2C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262178, "uuid": "37215182-d331-4537-8bb9-762d19b3d569", "value": "1536:gjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX2p:AB9wzbqtWb08UscYJhnpjyq9qBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262178, "uuid": "d11742fc-86dd-47e7-bd91-80382539d39c", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262178, "uuid": "540743bc-1dab-473e-93c3-61668d0f2c5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262178, "uuid": "6192f97e-91df-439f-8e84-9739ed8db88a", "value": "diagram-963523046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fdc46e-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262460, "uuid": "48837aa8-82e7-400f-a7cd-02841332048f", "comment": "Malware payload", "value": "01f455ec72ba7c52f5c3cd458c12b64e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262460, "uuid": "fb2463f0-49a3-4fce-95f4-ae22acf89948", "comment": "Malware payload", "value": "13dcadf3a939216fbc4490763ec5b971fd26682e32607a65e325670fd61d2a3a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262460, "uuid": "1285797a-403c-4938-9763-d47c4eeb1f88", "comment": "Malware payload", "value": "1eb8be9653d8c79977313a4a9e68551b3f506c5e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262460, "uuid": "079eaf76-4db0-46ff-9467-5dfeecbe5cb4", "comment": "Malware payload", "value": "61edb5a8122cfe6b606689de5adc174b1d6e209478a6418096303dcb988a428d01aa08f11a408f297a379c6679ec735d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262460, "uuid": "ed48fc0e-ca7e-4794-a22f-63222dd046b6", "value": "7833F1E0A502F04B971DBC5CECAE9D424F7DDA0A433D7492057AC0871EA2AB2B749D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262460, "uuid": "2e5a1096-0084-4962-9c9e-5f17504ab62a", "value": "1536:VXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIiqQu:xXma7774mfCyWMB/4GpV5diqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262460, "uuid": "c5692048-9827-437d-a241-a8e6f448150c", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262460, "uuid": "dc2da6a9-5012-46a1-bdc4-3d0e44138381", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262460, "uuid": "32e3a983-fe4a-4f5d-843c-a04ac568308f", "value": "statistic-1189841749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d889bd59-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257713, "uuid": "c5429500-acac-49a2-a48e-bedd18c755d7", "comment": "Malware payload", "value": "52a5968e29d3ec29a62c9ac18cbf88ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257713, "uuid": "3faa0b9a-cc58-4bab-9d30-42bcb4a766ac", "comment": "Malware payload", "value": "13dd4b61f3d6b9f51569a424db280aa79ceb315af76042c212262400e0f7cb65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257713, "uuid": "0e60b4f9-bba5-4138-b795-3ea25a0b7bb7", "comment": "Malware payload", "value": "1613fef0b5080f6447fb0e2b62a05e6add58bb5d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257713, "uuid": "a0a9ac48-c984-4c00-bb64-9d0682b684bb", "comment": "Malware payload", "value": "4adba98db8bdb5ad548c9350da5ada4bc6a88e99ebda65ba4a966c0872f8028c4c945af37804501a54dac5b24788c322", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257713, "uuid": "a51e8076-cfcc-4b59-91ea-d011609f0860", "value": "10330286D264214DCF4FD29730F1FACCE5DE7A430DA9B4D0A67E2B0481931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257713, "uuid": "382cd1fa-d646-44a8-af4e-943ed71f066e", "value": "1536:b2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3c:afqhp+g5ru2kmUEt88Ixc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257713, "uuid": "22c03c7c-aff3-4e19-b2fb-3a0a10000e00", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257713, "uuid": "c188c5a8-5a2b-49a3-9575-3f1b21a5ffde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257713, "uuid": "5ade9688-ddcb-476d-8039-f1a24b3fa102", "value": "catalog-1817183035.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d095e3-b6ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621242191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621242191, "uuid": "1bd3cc74-464b-4903-9920-6db605a4fd23", "comment": "Malware payload (Dridex)", "value": "ff1edc832a1d4876d01f15742b653032", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621242191, "uuid": "54edb7bb-5b05-4bbe-a362-fa45a73e3e47", "comment": "Malware payload (Dridex)", "value": "13f21bb3248d1635c5da80404f8e8048fdc4b63d50af885a237c67c12ffd4c4d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621242191, "uuid": "5af69996-e85c-4f40-bae4-008af7ac3953", "comment": "Malware payload (Dridex)", "value": "9384d82d91144dedc1171d4bd0585e6fb41dd30c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621242191, "uuid": "b3114af1-621c-4822-b2f8-128ed41c7d4d", "comment": "Malware payload (Dridex)", "value": "7e9ad40752497404a7ba142a3223535970dd0b78825899fbcda73560eac2100b9345f80450f9e2de49413f4b727e3e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621242191, "uuid": "22b9a8b6-c5a6-4959-9b13-d0484e135ead", "value": "23F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621242191, "uuid": "8d6551e1-eeaf-4b83-b09d-97218e6fe669", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621242191, "uuid": "1a6542b5-b4fd-4171-9081-cf4e86ec9ef8", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621242191, "uuid": "74499b5d-9864-4eff-afec-dca85a85975b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621242191, "uuid": "a4520d07-7516-4cfc-9baf-e840e2acfbb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621242191, "uuid": "572c2973-5fe7-4f63-bb7c-fa547dc42a71", "value": "ff1edc83_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2079b7-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260992, "uuid": "14f15322-10c2-47ee-b009-7f09c9d7ca00", "comment": "Malware payload", "value": "0e4cc3d12fb5114c11fba8b82e9628f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260992, "uuid": "4aba3835-8b35-40f6-8960-837d357ed19c", "comment": "Malware payload", "value": "13f6715893ea6ae907fc7662c8acf1d00fae2e74eab5f7cb689aaff977aff18d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260992, "uuid": "fb0610a4-3b62-4c00-8329-d95324c8557c", "comment": "Malware payload", "value": "69c4bf9528e8120275622b6bf295ee0b2e60fe47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260992, "uuid": "dc25b4fe-dd14-46a8-95f1-aaa1918d224c", "comment": "Malware payload", "value": "7cdbcd5b3038bbaace9e38ad184a0416f4dab4a653d992a234b6485be7326e02f712a58d841f4575bd7004731d68005a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260992, "uuid": "8bed9731-2c39-45a2-9e7a-d6b48714bb24", "value": "9D33F17187ACDAF628B2E4BFD8C7F904FBB1D499C4D38A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260992, "uuid": "7350291f-0148-4f4c-a19c-d681d64c720e", "value": "1536:1jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXaq:RB9wzbqtWb08UscYJhnpjyq9qBaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260992, "uuid": "3435d23e-4e80-4627-b7e6-32a1d447faed", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260992, "uuid": "81fbee1d-fd75-4880-a30b-fe6b4b08d9e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260992, "uuid": "0380952c-03d4-43dc-91b4-da550a8ac568", "value": "diagram-247512379.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b48f21-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264797, "uuid": "08b0f229-4d0c-4db4-b330-59044e65c286", "comment": "Malware payload", "value": "4566be53dc9e27d27bb954dc503f0d54", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264797, "uuid": "6e10481b-d1be-4488-b0ed-14633da428ba", "comment": "Malware payload", "value": "14142cc0a585ed1805c0aca4b6b0a22eb06eab3494d84e61f0da390d06728bf7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264797, "uuid": "ab213664-8652-407a-8053-17db94706412", "comment": "Malware payload", "value": "57e14ec8131702e9875ba5741588ed21fafcc423", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264797, "uuid": "b3db0f63-86bf-4b7a-8bb3-668a823e9249", "comment": "Malware payload", "value": "ad7282310674012d07fc8778bc8b905757f7ef8789d7607ead7de86f8958dfae691fd59c91a16277d536c32d40f5b9a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264797, "uuid": "8bfa5b4e-0962-40ba-bed8-83eea019e216", "value": "2F33F2E4A507E087A749B81CDC6A5D038F3DE91E433E78D2022BC1D74E61EB6A645E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264797, "uuid": "94105e52-201d-47c5-abb2-0a82be0205e5", "value": "1536:0XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZjCz:AXma7774mfCyWMB/4GpWvZjCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264797, "uuid": "50cfe071-8610-4e9e-a830-88994634d462", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264797, "uuid": "7bd9e7f4-e5a4-4708-aa46-f74741e22089", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264797, "uuid": "e597408e-35f3-41a7-b5ee-ec04a87f5579", "value": "statistic-963570784.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a639283c-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262353, "uuid": "925c79bf-9357-48ac-8168-d17ed61fba40", "comment": "Malware payload", "value": "9ba3fd95fe65b0044cf9123e2472c36c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262353, "uuid": "f40801c9-f0e0-422a-b60a-1a79ce0c01bc", "comment": "Malware payload", "value": "141fd41e72ca05050c401a28f1dff99f37a2e7e38272e409772814b8412e0d52", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262353, "uuid": "8e4cb8dd-738c-42c0-92c7-b1cc26d147ac", "comment": "Malware payload", "value": "e4fb226acff9e2619a27e274bc3be92d312f0af0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262353, "uuid": "f2326132-3515-4aad-97db-4fbbfca54ea9", "comment": "Malware payload", "value": "81d6bb103ffc005b7eb5e146601f164228a481b71145e2956a3442c1f04f1daef1d316efd59ae29d0e8294d53084abb1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262353, "uuid": "66aed786-7005-45b2-87d9-d73ebe54b021", "value": "B833F2E4A507E047A749B85CDC6A5D038F3DE91E433E78D2022BC1D74E61AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262353, "uuid": "8acc157e-52a2-4239-bf24-bc0aa517402c", "value": "1536:tXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZxZ:5Xma7774mfCyWMB/4GpWvZxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262353, "uuid": "d8f781d6-3538-4c7e-8852-c63eb3eaa02b", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262353, "uuid": "1bb9ef02-9428-4ecc-a7e0-b8e8540c9f3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262353, "uuid": "5e826ada-1536-4390-9260-763ddb8be005", "value": "statistic-1090894182.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9205555-b6f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1621245715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245715, "uuid": "56764e8f-fcfd-46a6-a6b7-095dc0c24c52", "comment": "Malware payload (CobaltStrike)", "value": "e1073932184ec1795579ba2d8edeb87c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245715, "uuid": "c16ffc91-0627-42e1-98a7-40478a5c4c57", "comment": "Malware payload (CobaltStrike)", "value": "1429190cf3b36dae7e439b4314fe160e435ea42c0f3e6f45f8a0a33e1e12258f", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245715, "uuid": "78c218fd-de59-4163-aa0a-0eb058bda24a", "comment": "Malware payload (CobaltStrike)", "value": "25b05cba40691b1f622e8fa4a1b748e52cd6057e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245715, "uuid": "3ef89c15-b69a-4691-bcc8-d66e59bf8c70", "comment": "Malware payload (CobaltStrike)", "value": "a7e328054abe1937d940f89ece5d8e6980afe102852954d1408ef104b9268fbca5121f353998c3a2642b1d59bc8b0910", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245715, "uuid": "4cfd3e21-360a-47eb-8df3-9eb9e58d82ae", "value": "5354AE39498D6E57E34CB33102C603B353AB31534FEAD6F801B593EA537A684EFA5894", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245715, "uuid": "1bca8e35-444f-4189-8dfd-f1516f00797c", "value": "793c30f628a8298f37f5826f3333c730", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245715, "uuid": "4686b147-b4cc-40a1-b9c6-e1b1e176ac70", "value": "6144:iIrdj/SjoSlGKd5Q5bIoQmX0J6pi97IdMn1uxf:iIrdFSlGK85bXi9bn1uxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621245715, "uuid": "4ffc61e0-8698-47be-9679-a04fe550bdba", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621245715, "uuid": "4c30fd67-da23-4d5e-8af0-cccf3275dd1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245715, "uuid": "6d8b8698-b488-4b19-9716-e465bf687f85", "value": "Conti_Cobalt_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44303329-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257035, "uuid": "ab796cbf-57f6-4dd9-8087-c75b9a2cb24b", "comment": "Malware payload", "value": "a5f0e78c9834e7bd4ac4f6e51177cbc2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257035, "uuid": "254b5b50-4213-40af-b212-67e74906e8a3", "comment": "Malware payload", "value": "142bc1b47226f98cc4cf0790f5c0d65ccd2a990621a578f304b519982cbb1f83", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257035, "uuid": "52acb94f-f21f-4787-baa1-529c6b4099b4", "comment": "Malware payload", "value": "20d865ffc3960170e5fb982db3986d24c3508aa6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257035, "uuid": "c82e9e16-b8e0-43e9-93c2-419d00f38e87", "comment": "Malware payload", "value": "4a34331908b3d5b100b740208a2651c41a552f237082fcc5c3ea0e8e31e6b3b5626bc3ff02c0a453cdbd872ff25854c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257035, "uuid": "3a1919bb-1bb7-4eb1-bddb-46acd38f6bf4", "value": "9C33F281E558114DCE0FD29B20B6F9DCE2DEAB530E9AB4C09B7F1B44C5924F1482E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257035, "uuid": "618dbd15-3811-4b57-b8de-1df69ecf8fb7", "value": "1536:V2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIFq:Qfqhp+g5ru2kmUEt88Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257035, "uuid": "6941aa0d-eaa9-4a70-94a8-2b8f3858d4f1", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257035, "uuid": "863c671a-8a90-4ea5-af25-3725056981aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257035, "uuid": "68881610-805b-4c2e-b31f-914a10c6d89b", "value": "catalog-1316874319.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de681d52-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256864, "uuid": "58b35e7f-903b-4ef6-a318-33a0359f0233", "comment": "Malware payload", "value": "5518909afd734443555e890ee94d910a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256864, "uuid": "0b718d4d-36c9-4422-a592-e6e3ed1289b5", "comment": "Malware payload", "value": "14542e33aa599aaf907d7cdda34bc6d76d1ee400e61c9212015c0d20fd92b6bb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256864, "uuid": "eb053324-bf62-4c6d-8fcb-6ba9364060b3", "comment": "Malware payload", "value": "c9a30e08b2b0eb327436876d202c89cdc79237e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256864, "uuid": "422b0c03-1982-4a9f-b357-8c5367f7e035", "comment": "Malware payload", "value": "b625d49258e0502e8e18ac6d60279144072a720a919cce17d3e0c193f4e810efd118d8237199ccaa48411b3ba68dcc53", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256864, "uuid": "6cbd523b-38e7-4949-88bd-1caa73d29292", "value": "9133F1C6E258018DCE8EE2AB30F2E9D8E6CE7E53099974D0A7AE5B4491530F1582F54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256864, "uuid": "d2f8fc58-25bc-4457-80b1-5277f79fb354", "value": "1536:62fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jILY:/fqhp+g5ru2kmUEt88LY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256864, "uuid": "6ad028fc-7f51-4692-aa32-e68e45957615", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256864, "uuid": "86b7db03-be5f-4f96-83ec-da82b93eb04e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256864, "uuid": "b409ca73-3520-4787-b2d9-849f52902dd7", "value": "catalog-1155678533.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54c7202-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258191, "uuid": "82d7a1d2-80f8-444a-83bd-d329ca85e0ee", "comment": "Malware payload", "value": "ef5be6fdd8350a88ed1dc5b907c8e409", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258191, "uuid": "0c55abca-4ce0-49d4-bc9b-b62f878ac77e", "comment": "Malware payload", "value": "1468a9e9505499742f67420f8a0fdc3e36815248472b987ec33af41b608f1123", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258191, "uuid": "72c2736f-b9ef-4cce-911c-fb4aee3dcd99", "comment": "Malware payload", "value": "ffcf66144812e479358af0d199d6c3dce0ba526f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258191, "uuid": "4afe9151-6cb4-4cba-8bca-a2cc293c2f02", "comment": "Malware payload", "value": "6ccd259c78ff1e353cf2ab68b865fb3aa2a53b0a91653e52ee839674d13f89d18a6ee064c15653cc754d8e087a88df35", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258191, "uuid": "a649b2b2-4b35-44d9-9718-57584bfda3ed", "value": "C933F241E655028DCE4EE1DB30F6F9DCE6DE7A030EA964E09A7F2B44C1560F4492E68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258191, "uuid": "166770bd-4bc5-47b7-b1f6-13c5dd177efe", "value": "1536:l2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI0U:Afqhp+g5ru2kmUEt880U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258191, "uuid": "a376e78d-0c7f-44c9-9c9b-5685d124e414", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258191, "uuid": "fc4384cf-a0f3-4569-980d-3c19c83b0fd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258191, "uuid": "b012c313-51cd-4b5b-a065-68da53216a0c", "value": "catalog-234840734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dd549f-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259557, "uuid": "2cf3ef15-c9fd-4550-80df-f86e05a77ee3", "comment": "Malware payload", "value": "7ae7c513a9a8d6d8813cedec0c82b4a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259557, "uuid": "80719241-9dfd-4364-bfef-4e6c72e99237", "comment": "Malware payload", "value": "1474f0c6d7c59369ff73121d2f16c5fdc9cd0fe04504d5aa6b11e655458bc284", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259557, "uuid": "c45ab4fb-55e0-455a-8930-7338798a0aa2", "comment": "Malware payload", "value": "3d8b6a486185e08fae1674b14cdda903daf26191", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259557, "uuid": "84e8650b-0b8c-4960-8a49-40146ff12f04", "comment": "Malware payload", "value": "7e0f2891ef0c74adc0fe03f5612b0666d0b8eee350516ff3eeb8406bb3abfdd79df4e783199a64e1bbf80ab223034041", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259557, "uuid": "ce214bec-d459-4aef-b42c-31d96f753cd9", "value": "2D33F17147ECCAA76C31E1BFC4C6F845BFB29461C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259557, "uuid": "55618e09-865d-4311-b091-457ef0417e84", "value": "1536:pjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wH:tB9wzbqtWb08UscYJhnpjyq9qEK0wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259557, "uuid": "a8dd8938-7abc-45d3-9e77-2ffd9dfe84cf", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259557, "uuid": "6e7ba7d4-bc12-4507-a260-2b69b71c9037", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259557, "uuid": "acc5dc0e-98ca-41ab-b98c-a9656eaa81b7", "value": "diagram-1140128370.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d935cc98-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261580, "uuid": "a14d6553-93fe-4130-a5d8-d38c676854d5", "comment": "Malware payload", "value": "4794aab63058c40cf26689ed8319bb63", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261580, "uuid": "8c548c3d-b20f-4974-bd1b-ab0ec371666a", "comment": "Malware payload", "value": "14761622c8478163f9576a4326f0f01e2834bfa809909d6e1a91488cc6956a6f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261580, "uuid": "e0b4e880-b624-4721-ae9b-29215dde7ede", "comment": "Malware payload", "value": "141d82ebc940b287804ee1cc06f9fa7c672749f9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261580, "uuid": "b424d18a-c34b-4bee-8b36-3df189523f87", "comment": "Malware payload", "value": "ccdbdb141eaa0b2c44a4d410dbc9256402a161c4e99d1bf539270911ef29a5d8664ae6229ac4889c8f1541d059481ecd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261580, "uuid": "e2284772-5046-49c7-9b21-b811b386717e", "value": "7C33F17187ACD9F668B2E4BFD8C6F904FFB1D49AC4D7862246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261580, "uuid": "979e1501-4210-47a9-9416-059d722ed158", "value": "1536:fjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXSL:bB9wzbqtWb08UscYJhnpjyq9qBSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261580, "uuid": "bf067e35-e131-425e-8833-4bf714df75e9", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261580, "uuid": "de3d49ad-1154-4582-b4ef-28d349c33fba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261580, "uuid": "2f6e2428-636d-42b4-97d5-7de0ee40f146", "value": "diagram-645735268.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d81492-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262923, "uuid": "e5502c5a-7871-46d7-a318-64cca49e17d3", "comment": "Malware payload", "value": "5693c7914d5d4d89f6ae78acf6161382", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262923, "uuid": "f1d16dbf-1aa2-46e6-a821-4da166a145bd", "comment": "Malware payload", "value": "14766c66b221bc2d2a0fd6363c15327c15b513e64fda459bb863888a5c5804ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262923, "uuid": "d09d3d9a-4289-4cb9-9fcf-ce7ef715fd7f", "comment": "Malware payload", "value": "8b50d76026ad56ed12ca7c59e3bc01a14d9b5091", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262923, "uuid": "bd826af0-312b-4a0e-9a8d-720f7b90fef1", "comment": "Malware payload", "value": "0754ec1f83fbda517be7f3fd40f9101d41a2f4f706699f90d7631f85599130b0252e1fd72ed9cc4694ed7e13bd908cb6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262923, "uuid": "35f0bbcd-7235-4631-a64a-34bdd39d0fd7", "value": "4433F2A09402E04BA758FC58DCAB9D038F79DA5E477D7843017EC0879E72EB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262923, "uuid": "65977d29-ab59-4c43-aa0d-eb88bdcb6e75", "value": "1536:WXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOi5t:+Xma7774mfCyWMB/4GpCOij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262923, "uuid": "74325392-4ced-4a76-bccd-1a11b1dbb38c", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262923, "uuid": "cf19c81c-83cd-4831-bfbd-c8b0e7f92b9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262923, "uuid": "ffa7baf8-7ae4-4884-8e30-36d4dd7e35c0", "value": "statistic-1497400477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289477cc-b6bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621220911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220911, "uuid": "c441193a-1d33-4e7d-81f5-d8e9856760d1", "comment": "Malware payload (Dridex)", "value": "8ea300b82ba7066bca54de477a3181b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220911, "uuid": "113d6f39-c518-429c-bd77-9f71bb0a204d", "comment": "Malware payload (Dridex)", "value": "147e07e8cac9f5181baf831d3b16db01031c207e8be080a3768d0d72e31fc14c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220911, "uuid": "9c83cc86-41a2-4e94-8ff1-997d921b02a3", "comment": "Malware payload (Dridex)", "value": "8cafd43d155efcdfc9a00bf6bece4dceb4e52e40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220911, "uuid": "f7c28e34-bcba-4c9d-91ad-3543da8a6d8c", "comment": "Malware payload (Dridex)", "value": "64121a866642f38a5763a18e2407aceb3e85076c8e2e2e0f0c26a7aedf8c1a828c21fce9b6f67e60eefecc833547d488", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220911, "uuid": "7cef24a5-27c5-4b78-802e-0c2d41fa42dc", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220911, "uuid": "4ad0c00c-2670-4188-b769-e524aaabe9d1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220911, "uuid": "82af5d33-bc0e-416f-a5ce-8436c8071710", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621220911, "uuid": "09573c28-54fb-47d5-9fbf-652ab161a423", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621220911, "uuid": "d8aa8224-60c2-458c-aae4-791311c796b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220911, "uuid": "77edad8c-1a5a-486c-84af-9fe059a5ac4f", "value": "8ea300b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79259fdf-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262707, "uuid": "8bc63dd3-0b89-4f7c-9754-dd10ce85936d", "comment": "Malware payload", "value": "cde888634189e73ce2dd42b0b12f1f56", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262707, "uuid": "854de46b-0e34-48a7-ade0-b39d3d7ef7c0", "comment": "Malware payload", "value": "148093ca06361998a43e25ed64cc9fe5b8f5db6060ebc3c4ae472d2158718777", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262707, "uuid": "dab4a1f3-b4e5-4e0e-9203-b5e8200c80e7", "comment": "Malware payload", "value": "4c21d73edc0b035c78e861115da408bb8d7287f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262707, "uuid": "3e8e6971-77d8-4dc6-ac28-d157cb2c9af1", "comment": "Malware payload", "value": "76d0e9f481591696edef0670caf81d98107ca1756cf0aa376d38f1f72428fdb66a7e799125137977e0948d04ecd59b20", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262707, "uuid": "c378e8b9-7b81-4b97-a60e-f470e98a96b0", "value": "0E3302A0A906D087A759BC1DDCBA6D038F3CE91A433D6C53013ED0874E629FC7649E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262707, "uuid": "cfcc684f-355d-40c8-982d-7ff0a506940d", "value": "1536:/XXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qGx4:/Xma7774mfCyWMB/4Gp079+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262707, "uuid": "e82dd592-3293-47c7-8591-f0cd21aa401f", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262707, "uuid": "39271591-aad7-41d5-a1c1-b5696c7bd790", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262707, "uuid": "bb0e4c9e-13bf-4a57-a300-39bfd66d3e80", "value": "statistic-1341611897.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c581be-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256876, "uuid": "a26b787f-c924-42db-9b0b-f85973521767", "comment": "Malware payload", "value": "a3bd245342f8b5ea5d367238fd9985c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256876, "uuid": "f75e5b69-6024-4183-bd1a-272d8e67c633", "comment": "Malware payload", "value": "14ae401eb424a027e3295ac13832a3b13be320b6051f098bbb2929c1871de921", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256876, "uuid": "9219f314-0fbf-4d74-beba-2a13f9bc1f71", "comment": "Malware payload", "value": "8b78de8659f89360be674e1a5999590277b15948", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256876, "uuid": "78182f04-0761-4579-935c-972714eb6c01", "comment": "Malware payload", "value": "a54aff60f31f5136649d8417b60283b266c935790494c1688922959a507e8c3a257491083bbf8fa15c8efedceff6bbe8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256876, "uuid": "a61e037f-2c99-4d5b-916c-5050c312723a", "value": "3E330186D264214DCE4FD2A630F1FACCF6DE7A430DAAB4D0A67D2B0581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256876, "uuid": "bbf54871-85fd-4f06-9cf3-05a188a9919c", "value": "1536:Q2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3e:hfqhp+g5ru2kmUEt88Ixe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256876, "uuid": "099e20cc-c089-47e5-b600-2bd0345783b8", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256876, "uuid": "88a5404a-f7a9-4a3b-9a56-a1ffd679b743", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256876, "uuid": "62564b7e-6c0b-4d60-b792-752859920d54", "value": "catalog-1162878462.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7240f306-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259259, "uuid": "90f557de-65cc-4abc-8788-0bfc54887be9", "comment": "Malware payload", "value": "21a0530f7c948d5de8357d9555add881", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259259, "uuid": "203a6509-4147-41e8-a38e-04cbe3e33efa", "comment": "Malware payload", "value": "14d629871623c29198c146bd74b24ffc67489d84086738c928bcd860729c2c67", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259259, "uuid": "79c31306-01fc-4ef8-b811-956558d7e528", "comment": "Malware payload", "value": "cc5eee947368ca7d29b0e1bc37c4414272ceba3c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259259, "uuid": "0a650f76-987f-4f81-b80e-dcc58d2e9a71", "comment": "Malware payload", "value": "e760271d689fe9857c1cf2fbf1b7a70ffd8d2c6513ef6fd828967c6d0205bc2fee204cab2fe259b912cd7495b4cb2c1f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259259, "uuid": "667ce039-0b40-4945-8c42-25483850af6a", "value": "0833F155E654115DCF8BD2DF20F6E9DCE2CEBA530EAAB8C0666E2B45D0530F0481F68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259259, "uuid": "575758cf-7014-4109-b304-088ec0af3e96", "value": "1536:e2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIThb:jfqhp+g5ru2kmUEt88Thb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259259, "uuid": "e7ca841d-fc37-4528-bad6-209f81cca0c5", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259259, "uuid": "2c5d2e9e-6df9-4627-9aca-b23bf343447f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259259, "uuid": "2ac968b9-e5fc-4bbe-9340-5fba6e0808c5", "value": "catalog-901350616.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a9339b-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257139, "uuid": "567a075a-8fef-486d-a1c5-825dc69c7533", "comment": "Malware payload", "value": "03c7da630ae29597d219738dd6956604", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257139, "uuid": "1a49389e-5397-48f5-b5c4-a3bd98a5987e", "comment": "Malware payload", "value": "14eadef01018fc1314f291503e1409c74d49c42e26fd5e35eeb8b836198277e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257139, "uuid": "3ca2f9af-1775-4b51-9280-8162dfd18ba4", "comment": "Malware payload", "value": "34f8e4fc9f722b48f50be49c16e1cd5cd8f4e4f5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257139, "uuid": "882a961f-e18b-4912-9141-07ba00b0d67a", "comment": "Malware payload", "value": "1f34bccd39309b671f846403d1bc1e29e0d38c4e810d96a20f02371a8f8be3fecddb716862c1bb59556a62fe3a280574", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257139, "uuid": "4596e7d0-ab28-4b3e-9ee9-d922b3298442", "value": "A033F191D645018DCE4BD3DB30B6F9DCE69EAE034A9D78D09A7D1B0490938F0892F19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257139, "uuid": "1b2b4c2a-29f5-4bd0-a46d-4a8eaf7cd09a", "value": "1536:y2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jId4Ru:Xfqhp+g5ru2kmUEt88Wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257139, "uuid": "25ba683f-60b4-4c62-9bef-2bc265257499", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257139, "uuid": "f73895bb-8492-4991-815a-7faf28ed4933", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257139, "uuid": "1501d2ce-94ec-4efb-8a1c-7801d689e96f", "value": "catalog-1390665020.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13954544-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263396, "uuid": "0d245e1a-098e-4f42-a41d-0eea05036896", "comment": "Malware payload", "value": "e4385dbd133ebe82a092729083e3fa82", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263396, "uuid": "846157b9-0e03-47e2-b308-433fe954fe05", "comment": "Malware payload", "value": "14f47c29925424c073d5ca0efecfddde77a4be2aea648658c7d8384dbff95265", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263396, "uuid": "39a8c4b7-4cac-4d05-8c72-9697b8feb14e", "comment": "Malware payload", "value": "74102efe905f86bb28c7905789d3d3b767fcc9bf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263396, "uuid": "00688d26-136f-4fa9-b9b2-73fc8f5e8b95", "comment": "Malware payload", "value": "c03cfdfda2b5622bea65d3e1134a75d1eb93d6613fcf675ff01f313a438d99b6d74c5693a96ee43d0e6ae1ed2b08efa4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263396, "uuid": "9c6eb5f4-c836-48ad-a405-3ea0c987f8e9", "value": "9633F1D09903F0879745AC49ECBA9D124F79E94A47BD74D3027AC0834EB2AB5A249E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263396, "uuid": "30a6f19a-4caa-4bbf-a1a3-52199c8a17ad", "value": "1536:rXXtg3K7774iXfEz5lnm/hQMOEYus1GpDkJJ:zXma7774mfCyWMB/4GpDkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263396, "uuid": "d8afa103-c136-4758-bbc2-ca67781c0a61", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263396, "uuid": "55fcc465-9d8e-416c-9d53-c1fbe18863ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263396, "uuid": "494ea48e-f276-453f-a85b-cf6fedcebdeb", "value": "statistic-1863664259.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d83d776-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263949, "uuid": "518fb984-8ceb-4418-a8d2-dc4d4ae18a0b", "comment": "Malware payload", "value": "60e1e72ebfebf482c32e218040a6a8ba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263949, "uuid": "8f791dcb-caff-4bf1-9635-a6db4ad901f5", "comment": "Malware payload", "value": "14f974199832404d4c5d2f0e8dea6cd98563f15cf86830697c881c9376e90ccc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263949, "uuid": "f23b7d04-10fb-4a3e-9ddc-cf9f046c37e9", "comment": "Malware payload", "value": "65ffd623d0c6691e1b846ee5f3766d3d995c1916", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263949, "uuid": "39fb892a-65d2-4856-8459-2852a135f3c2", "comment": "Malware payload", "value": "2301bd6b98b75049df605a66a43635d8d4327417ec2889508812901bdb0152aad1a8298aebc386ccccc0b039f0aabf4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263949, "uuid": "7659c87c-d0dc-4b40-a462-b2301f7d1249", "value": "1333F2D0A902F087D745BC49ECBA9D124F79E94A47BD74D3027AC0834EB2EB5A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263949, "uuid": "ff6b7e98-e8a3-46d6-9ce3-743d4c7faa65", "value": "1536:+XXtg3K7774iXfEz5lnm/hQMOEYus1GpDklQ:2Xma7774mfCyWMB/4GpDkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263949, "uuid": "3bbf6f5d-9047-4ed5-ba50-f5bc17a5561b", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263949, "uuid": "63050dd3-c5bb-4efb-a43c-2722735a584d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263949, "uuid": "4e445f44-91ba-43f0-aa70-381cc0539334", "value": "statistic-382000231.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abf3689-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262629, "uuid": "d27625c1-ca30-4000-9a54-f9539af9cb9b", "comment": "Malware payload", "value": "f9fa0526b019c414a3930bff66c671f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262629, "uuid": "d40a9686-330e-4c04-86a0-dc66f5eb3fb3", "comment": "Malware payload", "value": "1506797774a14b9bfa9472dae1433f56c77bb5dd7633c17a0150fb71693e57d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262629, "uuid": "7a4eb4a2-25df-48a0-924b-6941407b78e4", "comment": "Malware payload", "value": "dc53e5e8088c7b53a34bd2258fd4ca93b287cf98", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262629, "uuid": "0c120b12-aa5a-4f9d-a5e1-523a15f3696d", "comment": "Malware payload", "value": "646a35223ef70c1e2cb67ae74a17352c0e27efc99f05af647986f428b4c0eee640b9a35ee838bc74d8d6ba77f5f009e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262629, "uuid": "2d1fdca6-f030-4dca-a054-1acb8dfa90f3", "value": "563302E0E806A04BE754BC5CEC679D028F39D94A477D7893017BC0C65D61AF5B709E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262629, "uuid": "8fd4149c-c674-474e-8050-002f54da58dc", "value": "1536:8XXtg3K7774iXfEz5lnm/hQMOEYus1GpjIdgufd:4Xma7774mfCyWMB/4GpjIdPfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262629, "uuid": "a5ff6afd-4f39-4f3d-bfed-d0f70a50e85f", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262629, "uuid": "0efc660a-38fe-4f74-bc3c-b12e94718e7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262629, "uuid": "d557bcd2-d51a-490e-ba44-209ebeb0363b", "value": "statistic-1295727940.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a778c8a8-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264503, "uuid": "fdd2e670-19fc-4623-9985-e2beccd76e7e", "comment": "Malware payload", "value": "3466e56ac08930f9cd4d94121b4986f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264503, "uuid": "5af35ab9-b9e4-4ffb-a7da-aab81221907f", "comment": "Malware payload", "value": "152a2afd35d72b81d1f2cda3a84f30cc5a3e23405875cd28e13620383bd6abd0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264503, "uuid": "8e1b1404-d840-4f3e-9e2f-50149e2e058a", "comment": "Malware payload", "value": "43f2fa5ff54dd08e37b2be6c613b151bbe39317b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264503, "uuid": "571f3c16-d3d4-4464-8db6-25040aed6cba", "comment": "Malware payload", "value": "548a9d8e2cfc2b8a296effaae74b0cad39e2f7c25b756b0470f0f9beef1e56afd1cd68d0a4118cba57c7e7536ea1f71d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264503, "uuid": "238fed83-844e-4bc9-b159-909301df6e39", "value": "F133F1D0A906B087E349BC4CDCAE9D134B7EDD1E467EB893023AC0875E61AB57605D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264503, "uuid": "7511dc3c-b1fb-4ee5-a1d2-5b23aa7757d3", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1GplItr0:6Xma7774mfCyWMB/4Gplq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264503, "uuid": "2cea8eaf-68ad-4427-b07f-d538bb121d68", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264503, "uuid": "94166c68-e50c-4d09-a206-8c2698d0808d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264503, "uuid": "f12716e9-c623-4a94-8bb4-229ce93e3911", "value": "statistic-775428894.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b9a253-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257631, "uuid": "43f36330-5ca4-46ae-a4dd-4e57ce70cc37", "comment": "Malware payload", "value": "1d0a4f3d482e041d5152eca6912a9514", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257631, "uuid": "4e9f99f1-d915-43a9-8cd4-2ed48416f7d0", "comment": "Malware payload", "value": "15375d7f666b0a3a37cbf9b4573984dae869b67e054ae8782f5dbe653e3b2bb3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257631, "uuid": "2aa21240-ef9e-46d9-8b2c-ac863f3efe4f", "comment": "Malware payload", "value": "5ee91f6c1228e0ebc2ffe264a2b4ca4c05a01bfb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257631, "uuid": "1fc80cf5-daa2-4bc3-a56c-324ecd828568", "comment": "Malware payload", "value": "eedce342f7b4528ab616fc310a7c55a587e00840f3ebc1921183c91e552e16f3434709ef404dda82b887b5e6d18faf37", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257631, "uuid": "340a1f8e-c042-4964-9d05-c5564328d7ae", "value": "30330186D264214DCE4FD2A630F1FACCF5DE7E830DA9B4D0A63E2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257631, "uuid": "dbd572dc-8c9a-49a9-9b0b-59b4ba817492", "value": "1536:l2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3o:Afqhp+g5ru2kmUEt88Ixo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257631, "uuid": "e034603a-d183-4ed8-9cab-08a3aee7972f", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257631, "uuid": "41811941-7dd9-468d-9adf-1a6683c0b9e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257631, "uuid": "4da59598-ff21-465d-b4a8-f1881127bf5a", "value": "catalog-1741394502.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eb4207-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260316, "uuid": "4eec75c4-8241-4236-8ede-6463a4d93649", "comment": "Malware payload", "value": "8db9c08236c4205038d65ffb3cbca863", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260316, "uuid": "42650407-de2d-4887-ab57-632b39e13731", "comment": "Malware payload", "value": "158baac59cb2060905cd1d45b8a9a58d3d2ddaecd643b3058f1d90ec6d62e788", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260316, "uuid": "560a6236-2d90-4131-9704-49f60b8a6d4b", "comment": "Malware payload", "value": "93fb7bf36b1631847e71eb075949c9a6a26e2bd4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260316, "uuid": "56c6d7d6-41cc-441d-803d-13e13047c9cf", "comment": "Malware payload", "value": "8fac012d4cad74df1387f07498e405b5df3b125aec88ab4cd8916da59e7558d0ceddbc517ff91bcd78618f617ebf14f6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260316, "uuid": "64e539e9-d514-42ca-8cc9-b9e144949a92", "value": "DE33F1715BACD9F628B2E4BFC8C6F504FBF1D459C4D7862146F871C9B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260316, "uuid": "39374723-2e2f-4fe3-8e07-6afc2b875abd", "value": "1536:mjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXgf:+B9wzbqtWb08UscYJhnpjyq9qBgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260316, "uuid": "328457ef-8fe9-477a-b539-e7dd553e792e", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260316, "uuid": "826b08a0-a3bf-4fe6-b8d4-20fe489aae67", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260316, "uuid": "4c0bf644-cf27-4164-b0eb-61691cef5dec", "value": "diagram-1701693157.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502bd1e7-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257055, "uuid": "ad75e31d-7307-4964-96a6-a46e93685e7d", "comment": "Malware payload", "value": "decf7b0f05c6caace4de42106acf85e1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257055, "uuid": "773f4066-bf24-4f6e-8e35-bd35e781e2b7", "comment": "Malware payload", "value": "15d46168f28bdc6e12c5a4d0245ef0bcb40ccd53ebf72c639a13954a352d61d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257055, "uuid": "9a74f9d6-253b-4839-ab9f-27286dc8a70b", "comment": "Malware payload", "value": "062bb07ea2829db20696f74dffdca6801674794e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257055, "uuid": "f799daf3-997c-4d0c-8985-9ee44c2eeccf", "comment": "Malware payload", "value": "1a7de54ee3d5172e7397854186d75978b5510d7298a20e07956bd4a72ab541c27bb74c70106d0599af7da22742be8a6c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257055, "uuid": "ff37d896-9099-4409-b4f8-985236f6d12d", "value": "0C33F196D614118DCE4FD2DB30F5EADCE69EAE53089978D09F9E1B4895930F0081E58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257055, "uuid": "74edb45e-1c7f-4919-bcc9-ef1e6451df3e", "value": "1536:X2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIQLWlfB:Gfqhp+g5ru2kmUEt883B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257055, "uuid": "a1e48fb2-49ab-4977-9a2a-65a5010c01a3", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257055, "uuid": "b014cc85-feb7-4b44-8f5d-c8073661a0ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257055, "uuid": "37cf669e-4cf0-4cc8-ab21-f927ca897384", "value": "catalog-1326205630.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e29965-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259294, "uuid": "a554dac7-5c25-4917-8484-41ad258fe465", "comment": "Malware payload", "value": "6603f52965faee8b2cdd72de7d0ab401", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259294, "uuid": "c5f8e724-11c7-493a-a004-20dfd70fe518", "comment": "Malware payload", "value": "15fc11e3919bebee2b3745f1f96d56c66c8e0b7b9b9050932aff5d79928026db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259294, "uuid": "66b27b20-e73a-4045-b5e8-3da1d517beb6", "comment": "Malware payload", "value": "fffcfc01f474afce977781f31718275014a23b69", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259294, "uuid": "dcf88e81-7864-4430-88d3-213b833f1624", "comment": "Malware payload", "value": "288776a0afadc53cc38a5be9de40e51b5e6ebcfea1db71a98848f2542c14fce7df97daba48808fc7ffa749e31194b966", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259294, "uuid": "4b832609-7d7f-4085-84b1-366b8b8747a3", "value": "7B33F184D164108DCF4FD2EB70F6FAECE1DEBF43099A68C09A6E2644D2920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259294, "uuid": "901745ad-6249-4376-8b78-85a322ca5feb", "value": "1536:n2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbnm:2fqhp+g5ru2kmUEt88mAbnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259294, "uuid": "80e2a58b-30e9-49fc-900d-e5957221e87f", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259294, "uuid": "e76ee4bf-3d8f-4d69-9c20-c8da45d792bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259294, "uuid": "74856343-b324-48f6-b1e6-d205f43533a1", "value": "catalog-930132411.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f36ece-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258210, "uuid": "098f6ad1-90a6-42bd-a00b-5380ec380115", "comment": "Malware payload", "value": "fb36328d8aab3a3e38951bcfe5b11f10", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258210, "uuid": "16b81e50-aacf-40af-9c83-fa3e0035f119", "comment": "Malware payload", "value": "1603a48cd5096cd729400d878fed5f45c6c6163211bda43e6c5ffa05b81af0ea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258210, "uuid": "ba21422e-746e-4261-8e01-f426e7d7a79a", "comment": "Malware payload", "value": "d20f75739fd6b5b6222c3e6baf223b1acc1abe21", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258210, "uuid": "1ab2c159-291b-476c-8cd1-9adb9806fcbd", "comment": "Malware payload", "value": "3418bd399b256429bdf401868a383b08761ed6280f2b2668a80e2ed66cb2b2456a5572ca3aa3a0fe8758543000ebe310", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258210, "uuid": "5ec926eb-c6bf-4e51-a71b-3f7c448dbb8b", "value": "30330186D264214DCE4FD2A730F1FACCE5DE7E430DA9B4D0A63D2B0581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258210, "uuid": "c34942b7-f012-4f9e-ad50-84f121a2b5f3", "value": "1536:J2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3l:Ufqhp+g5ru2kmUEt88Ixl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258210, "uuid": "6d0ab35a-b4e8-4ecc-9e2a-1669ffbe8576", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258210, "uuid": "c72851c9-54a2-4e9a-ba1f-c90316272b96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258210, "uuid": "f38ccc7b-8753-428d-b8aa-1d885a092f8d", "value": "catalog-251577151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85883497-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259721, "uuid": "0c20d092-5180-43fc-8f59-b304221e8626", "comment": "Malware payload", "value": "223502ad07371e753a44af59672cd23b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259721, "uuid": "180bdd8e-5c5f-4912-af5a-6cb1504e497f", "comment": "Malware payload", "value": "160546c91652e8c76b9244bf211d918fcbfcceadd911f20655befa2940dd6eb0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259721, "uuid": "c4af877f-8340-491f-810b-0018c9fd03be", "comment": "Malware payload", "value": "3d3c6d15cecf3975328b985f390953fac44c732e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259721, "uuid": "d1f5f3ee-6f45-4de0-8fd6-b4504d7752fd", "comment": "Malware payload", "value": "7020272e05ffd3e97cbfb2a5d9be99129cceda3cbe402b06d70b16c7c8cb6b372155843abe431e62ebad5262c0612298", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259721, "uuid": "caa46c7b-f36e-4164-a7e0-61e0fb35fd67", "value": "E533F13647ECDAF62972D0AFC8CBF905FBB18465C4D78A6249E8B1C8B6D01855E32E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259721, "uuid": "0a92fedb-a77f-4e4c-87ad-41983fedfc59", "value": "1536:UjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXmX:cB9wzbqtWb08UscYJhnpjyq9qBmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259721, "uuid": "14abb93a-6990-4cb1-8127-cfe8863b260c", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259721, "uuid": "5e643f48-1a1d-45af-8a81-69f7b9ec9736", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259721, "uuid": "2bb53d54-5b55-4143-aefd-4698126d0ee7", "value": "diagram-1270245457.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a72a53-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259445, "uuid": "16be76dc-9208-413c-9487-0a69e8cc8267", "comment": "Malware payload", "value": "def27c50f3e67e5f3a2b6667da4cfc80", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259445, "uuid": "6f31f41c-65bc-4627-829d-a7743de62d09", "comment": "Malware payload", "value": "160b3c287e25041aa3304f6a868c534f18339cf6afe96003a38d389734af44c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259445, "uuid": "e1dd66f8-38ed-4546-ad38-553f75d5f846", "comment": "Malware payload", "value": "12a14fa5f467df15a60a178b942c07516ec9fc7c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259445, "uuid": "b1489bb0-ddc9-421a-a453-e27452f654da", "comment": "Malware payload", "value": "f59b56422dbfd7d9bec5798564b3e8be2bae15d07384f7494e86e0e1d9fdb8616f5be11bc73ade32d0391edce94c3de2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259445, "uuid": "99e103a8-cb90-4fa6-be0d-db77b5af4043", "value": "2933F1314BACD9B62DB2E0AFC8CBF504FBB1D495C4DB86624AF871C8B6941555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259445, "uuid": "f148eff0-7de4-4fbf-b204-65454010be90", "value": "1536:YjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX9Y:YB9wzbqtWb08UscYJhnpjyq9qBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259445, "uuid": "092bab79-c666-45f2-8a1f-22f35768068f", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259445, "uuid": "e6411486-664b-4e4d-89c3-84b89ac96ac8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259445, "uuid": "e8489c1b-3508-4149-adbf-14cfd222799d", "value": "diagram-1065041664.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ee8ea3-b6ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621241515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621241515, "uuid": "af95cdd7-81a3-44c8-962f-bf57fc9cc1bb", "comment": "Malware payload (Formbook)", "value": "7d245d07eb07a71f3f82f137812b64d4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621241515, "uuid": "32104852-e1d7-4682-87d1-e33e668f5499", "comment": "Malware payload (Formbook)", "value": "160c99141a635337803c9f1ce56b6f8451601305228ef9348999ae96171e2546", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621241515, "uuid": "01866f7a-25fb-458e-a2ca-151db3f98a76", "comment": "Malware payload (Formbook)", "value": "adac1a203e6581b63ae69afd9b8a62f38307f006", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621241515, "uuid": "e444833a-3482-42c4-9adc-af4bc57dc3cf", "comment": "Malware payload (Formbook)", "value": "dc594ac3477ae421f7b0c58ee76c5d3846c50effc35a0b6a62e5b98fb32354baa0efeb6497b8e4a4e7cc5452b0b0733d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621241515, "uuid": "8c2e010c-43fd-4f69-9f4d-c4ec562bcf8d", "value": "2824121AB2C0C5FBEDD0293219B26B39F3F791ACE2611947CB591EFF2C208A38E45555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621241515, "uuid": "2b97750f-2586-4ca2-a1c3-85b9311b8d49", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621241515, "uuid": "dc141479-dcf0-49a3-b7f7-85162c8a544c", "value": "6144:VPB6YJFkrDpOTXLS4qeIBafSVSN7sHEeE1Nzpc7S3CWZ:JL3krwSrDkfSAxpc75WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621241515, "uuid": "ef8da02b-5506-4d83-8755-e5d8c1af0aac", "value": 213874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621241515, "uuid": "44098e15-2e3b-4061-a058-63a585c7b9f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621241515, "uuid": "180e90aa-a12a-4ad0-9e9f-b33c803c00d9", "value": "SecuriteInfo.com.W32.FamVT.GluptebaBTTc.Worm.13964.24390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2636a9c3-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257843, "uuid": "ad59d45c-7a32-46ae-ad70-7c0a20c72c9a", "comment": "Malware payload", "value": "02b1b4a2d189bde8beef5e9b4542662b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257843, "uuid": "3e064d0e-86b5-4c57-9049-2da1efea9310", "comment": "Malware payload", "value": "162059d1c53d24e706b50c863570f3a93c7c2b808c460e06e716ccdce209f624", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257843, "uuid": "4d4a3d0f-dab0-4189-8ab8-7d53649cad88", "comment": "Malware payload", "value": "8667b7e9e69afdfe6d525472907e35447a2f601f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257843, "uuid": "b9fc10ba-abcb-43da-96d1-ed116c5ac7d1", "comment": "Malware payload", "value": "37714a7379eb99d230020e42a4b45ab84341d2a2a0784a9701b53d5acaf02f2fe3f916c21c576514f328a22d58c80538", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257843, "uuid": "90deedbe-26f2-4d99-80cb-ed7529eefa5f", "value": "EA33F141E658128DCE4BE29B70F5F9DCE1EE7E530D9A74C0962D2B0191530F1482BA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257843, "uuid": "4454a28f-8699-4e46-bf73-5e9d35d90c76", "value": "1536:Y2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxK:pfqhp+g5ru2kmUEt88xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257843, "uuid": "b3d344e4-ddb8-4b9a-a629-4f70a035e5ce", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257843, "uuid": "7eba0dcf-f8e9-46b7-add3-551d74476598", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257843, "uuid": "8ac78bc8-0f3a-49fe-bd73-663bfb335eb5", "value": "catalog-1913569283.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3468d74-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257624, "uuid": "3e8193ab-d706-452d-bad2-9ede3858c241", "comment": "Malware payload", "value": "c4f0b0a46ee9f5d1e023b5f670c6767c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257624, "uuid": "bd8ccf69-c876-4b4d-8385-e68535f2078b", "comment": "Malware payload", "value": "1622c499ff85788fe988a9ac3b06207436ee41220f4a92459e6e357ef95aed11", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257624, "uuid": "9ae0d03d-31eb-4557-b997-e6aa77eecf86", "comment": "Malware payload", "value": "c67beb20dd36ef851ae7f65dbf735066bb50465f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257624, "uuid": "0e544e30-3f30-40dc-8945-a86b361d39f0", "comment": "Malware payload", "value": "15e959ee6ed742cbaa389c2e2089bc798a985cea4a97dc816b62f7e2557c885ad668bec83d96f1e6f891a436efaa0b08", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257624, "uuid": "0883daa1-8a5e-4df3-abc2-4d43c9281144", "value": "FC33F141E655028DCE4EE1CB30F6F9DCE6DE7A030EA974E09A7F2B44D1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257624, "uuid": "b3aa82ce-3164-44f1-beb2-24ac899b8c28", "value": "1536:m2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jICW:rfqhp+g5ru2kmUEt88CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257624, "uuid": "d60dc1ed-9d9c-482e-894b-0e44140af522", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257624, "uuid": "1c3a1736-8182-442e-840c-e719c5db887c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257624, "uuid": "b40b39d4-cb07-40f0-8c03-c3114199375b", "value": "catalog-1739465579.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46fef4b-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259397, "uuid": "9a4f3df4-f90b-44c3-a6a2-59d4f1205246", "comment": "Malware payload", "value": "63eba01abcf94e16b7be34601d130051", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259397, "uuid": "787b4517-75bb-47ca-b028-5ea1aa0ce377", "comment": "Malware payload", "value": "162b5a7ca769748883a5d75b0d88373a8c7b4964951061740080cfd9ccea484c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259397, "uuid": "7ed022a0-4f3c-4164-95b8-4577e4b4b547", "comment": "Malware payload", "value": "498f8582866943c6206a2d5bd5b463c99758a0eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259397, "uuid": "69657e78-341c-43e7-b330-0c1010244a7d", "comment": "Malware payload", "value": "a3a00ec18e1a54cc9f6f52717b1bf4704823552141d8fae347e3077e5346538986968f8a38e389019d33c0e9bce93529", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259397, "uuid": "0eaa1236-e1c4-4f36-8188-336898919bab", "value": "3433F2314BACDAF628B2E4AFC88BF504FFF1D455C4D7862649F8B1C8B6941955E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259397, "uuid": "0e86fa47-a87f-44be-8f7b-ccae0943c5b0", "value": "1536:GjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXAj:eB9wzbqtWb08UscYJhnpjyq9qBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259397, "uuid": "96ad59eb-de8a-4edf-8c1f-5a2326c40907", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259397, "uuid": "7fc1be35-6f20-424f-a004-677e467f28c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259397, "uuid": "d1814b94-6072-4fec-a532-330fc542766c", "value": "diagram-102925071.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54e3f95-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263774, "uuid": "1769ba57-3b79-4875-846e-9526b8176540", "comment": "Malware payload", "value": "a2018d89f1b1d5ad806e80c9922416a5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263774, "uuid": "bc12af0f-64b2-4def-987f-ea7090a6fc13", "comment": "Malware payload", "value": "1641259ad9171b6cc2d692081ab041a012d939699ad9368be44fb9af7fe99bcb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263774, "uuid": "512bb0ee-9681-417a-ba69-b550edc4b915", "comment": "Malware payload", "value": "bdd3e8840e00c364fef831af4b2591bedb8a201e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263774, "uuid": "7a469421-69dc-471f-9546-7282e2f78127", "comment": "Malware payload", "value": "92a1fd7f802db345d6621fc1a341c7965b3babd397092c25b9908e28d9c9e6fe6e50fa4b08223cbeabb48a84ebcc60b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263774, "uuid": "71106a9e-e896-4e1e-ae24-b92d4cacd81b", "value": "EC3301D09505F04BA759B81DDCAAAD038F3DEE0E473D78820179C0876A61AF59B49D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263774, "uuid": "f3084bf0-d294-43b1-b6a7-4afaba165b16", "value": "1536:MXXtg3K7774iXfEz5lnm/hQMOEYus1Gp3Lkp:oXma7774mfCyWMB/4GpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263774, "uuid": "67bc5202-db26-43a2-898a-4d67da96bd4f", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263774, "uuid": "7d890f9c-d07f-43a1-877f-5bde04c4ebab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263774, "uuid": "d558c802-e940-40d1-813c-8f5a31a6f450", "value": "statistic-230757184.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbf6c88-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258151, "uuid": "cdcce77d-c4ad-4e28-ade0-5e0e1c2cec87", "comment": "Malware payload", "value": "cdd40b9a86ffee1b8bb91e1f26c37eca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258151, "uuid": "42c60cf9-5f1a-4d8d-b875-52f52e9483d0", "comment": "Malware payload", "value": "165713ede63369b0b1a351bf9698eea2a6edbae476d2746d2035705736d33545", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258151, "uuid": "765e5b02-9345-4070-aeda-1fff1fc1fbbc", "comment": "Malware payload", "value": "84712aeedc8e075189cac74f443c470d62f604b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258151, "uuid": "6c27ab6f-305a-4b22-840d-4afcdf24c4bf", "comment": "Malware payload", "value": "c8d26a15a6a071b504e2fdca7e3e97d37cf3fcaf6e751c765affb2f0e6f9060f744ffa6f1a66c82645c8a0a84f2bc109", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258151, "uuid": "6f2db43e-6ab0-44d3-9fc9-1a0cdcbe385a", "value": "7933F1959518114CCE4EE2DB30F6B9CCE6CEAE470EA9B4D0AA3E1705D1A70F4493E18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258151, "uuid": "ad70f5bb-7565-481a-b4bb-fb4c1d60a6b5", "value": "1536:F2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIpU:gfqhp+g5ru2kmUEt88pU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258151, "uuid": "2bb71178-7f46-4a72-9d8c-7545cd979d42", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258151, "uuid": "1138a27c-7b16-4b90-a8f3-9c3e97d5b6b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258151, "uuid": "df87c8e7-c28d-486f-8f2a-1fe96b4d4132", "value": "catalog-2129888312.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8814b7-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262686, "uuid": "18a89e0a-bfb3-4e6c-a5dc-42a5611ce38d", "comment": "Malware payload", "value": "1b0fdd1ca04819f500a662504d42b369", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262686, "uuid": "644971a8-f96a-4fd1-8753-c3d03217ae4a", "comment": "Malware payload", "value": "166c2661b140ad3eb02681836afa2b01d2836320fbd74fa3acedfe0ea72c3a9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262686, "uuid": "e5cb1077-8d9b-45b5-848b-2b51fc879505", "comment": "Malware payload", "value": "ec7d476900ec7bf17d6e730962ab8b513b585fb4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262686, "uuid": "9f208cff-2662-4a80-8459-d7ac41ae6a7e", "comment": "Malware payload", "value": "f5cc91f6529f7b658b87666e16d8935b5e0db432d20f4cd0543025e68899d9f25d112c590f4c18161ecaaff609ce1bad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262686, "uuid": "ff5530ac-5e32-4e4c-9e5c-96ee40ae138e", "value": "C833F2D09902F087D745EC49ECBA9D124F79E94E47BD74D3027AC0834E72AB5A249E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262686, "uuid": "97cbc760-9835-4e93-8481-b4ddee04bec3", "value": "1536:GXXtg3K7774iXfEz5lnm/hQMOEYus1GpDkZE:OXma7774mfCyWMB/4GpDkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262686, "uuid": "18dd8a8a-e0a2-4700-bdc4-c06dac5bf700", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262686, "uuid": "23a87bd3-e0da-4c45-acdd-c4e7226fd6ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262686, "uuid": "3067018d-3d52-41b3-bbda-92dbd0c80bcd", "value": "statistic-1335210333.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9673898-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259916, "uuid": "7cf4f363-35be-45c3-a4c9-c69c33e8c945", "comment": "Malware payload", "value": "eb85a4233c2fddf939a15787a70af38b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259916, "uuid": "1844e60f-9a58-4459-9f72-66d62f978343", "comment": "Malware payload", "value": "16dd6521b290c45d77ea2cec2c0050ac8d05b51c87d49501043f99aa9b15ae79", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259916, "uuid": "5cd3cf93-7b73-4a42-8432-77fae5c6e0bc", "comment": "Malware payload", "value": "d071a9190c4d405742fad3934aafb715309ee5cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259916, "uuid": "2f036175-2e8f-4197-8615-76405549d091", "comment": "Malware payload", "value": "a1c8d6ee289be93107ba06f9cf33007eb0bdcd54a43c55027e0eb90bba52c167b044716d378d5fffc83228c3b2229d82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259916, "uuid": "c2537546-5be5-496c-904d-5203e3c4fc91", "value": "A133F17147DCCAF66D76E0AF84C2F408FFF29952C987872645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259916, "uuid": "38670f37-afd6-4088-82fa-39964ac9667d", "value": "1536:RjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wgS:VB9wzbqtWb08UscYJhnpjyq9qEK0w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259916, "uuid": "f79c7cef-b49f-432e-83d3-cd257e30b663", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259916, "uuid": "0de689ad-bb07-44dd-b5f4-82f5d963b2ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259916, "uuid": "ec193aac-c1bb-4896-bfed-fbfa520f5dc3", "value": "diagram-1448752069.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b2dedc-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258299, "uuid": "985ce7b0-6985-4664-9f10-1d6db2858b66", "comment": "Malware payload", "value": "deb842184d8aeab0bdb363e3bc17ae63", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258299, "uuid": "d4eb33da-59bb-4238-874c-61504a38e604", "comment": "Malware payload", "value": "16de2a4e4b998fee6ae2c7dfa288259881bb2178e1ed8945a98738e31ad22175", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258299, "uuid": "b09e7361-fcbf-4c59-9289-2692cf1de1eb", "comment": "Malware payload", "value": "b050ff41e7b8ad5bcf8bbc26c807df48c9be5656", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258299, "uuid": "7e7983fc-5861-4e41-b288-b7ebd5fffc38", "comment": "Malware payload", "value": "0d9aab026e23f2277a654c2045a19f62a66506f5abba02fab93232349a107a6b50ccf99635937245f5fc645371589c1e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258299, "uuid": "8d2c06ca-45e9-45c6-a702-57b98c98cc15", "value": "1033F241E655028DCE4EE1DB30F5F9DCF6DE7A030EA9A4E09A7F2A44C1560F4492A68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258299, "uuid": "60df020d-a94a-41e9-ac68-25a39639c8d9", "value": "1536:f2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIEh:ufqhp+g5ru2kmUEt88Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258299, "uuid": "89e96138-ac5a-4d12-83e2-b21a7b2c8e2b", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258299, "uuid": "a0bb5806-fa02-4694-885a-6520ceac98c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258299, "uuid": "97a96261-e1b9-4c38-a935-5d137e93b502", "value": "catalog-30882968.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9761421d-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257174, "uuid": "6fa34fce-4cde-4a39-91c9-145d7adb0012", "comment": "Malware payload", "value": "7e97532091767c01d5b426c4d0726fff", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257174, "uuid": "b61cae0f-654f-448a-88c4-443e4ef31917", "comment": "Malware payload", "value": "16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257174, "uuid": "637df709-931c-4b53-aa58-73a96bd54cad", "comment": "Malware payload", "value": "99828b200a44302507ed272c3fad84cc9747924d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257174, "uuid": "72ad09b2-8d7d-4d57-bae0-3798a3b58cda", "comment": "Malware payload", "value": "7c2c1637e11f5be305a9c6b8661938d87d1734d2cdb265832a7e0530b7d7790e0193c66dc0f9b6bbebdcc11e5edb13b8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257174, "uuid": "2fb6a914-3309-402e-bca8-39b44a872dac", "value": "EFF5222AFCADF00ED107D136E961894BEA46008E681CF9672772894C4EF6D44BB47EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257174, "uuid": "d952e1c2-2899-463e-9edf-3b4f80f409d4", "value": "98304:+1Yg6KjW5BJcfAWod/ZvrbgMB4HrpolkUOlwz:ES+WPSEd/FrbgMAylAwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257174, "uuid": "b682ec8c-bed7-46a1-853a-3c4c11f9503c", "value": 3512278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257174, "uuid": "6e685cff-244f-4c0c-8a39-e2d304fefb7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257174, "uuid": "3f960ac1-53c1-408e-9698-52285bd98002", "value": "16ff2005a5edf5796cadb56258fdbd1e34f7e9a850bfb6f23a5ab5b969d47f19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bfb489-b708-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621253326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253326, "uuid": "a1ff5c79-ff1f-41f8-9f16-b6b8b6ec1a28", "comment": "Malware payload (Dridex)", "value": "853735f2e7e13296a349492873269d3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253326, "uuid": "d785784b-0c16-42a3-9599-8ced9be794ec", "comment": "Malware payload (Dridex)", "value": "171b57ba157be602d4f910e07a6f1acc03ec3b95c3407f0ff9c8046893a16d6f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253326, "uuid": "f5e44e25-7a37-4c3a-b2cb-374e7af89b43", "comment": "Malware payload (Dridex)", "value": "5e6a7b0617e7c7579b99b483456961667b3e2952", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621253326, "uuid": "e737f27c-7cbb-4bb6-b24d-bee975aed9e6", "comment": "Malware payload (Dridex)", "value": "a3f0cd7de8dc92ae89d9afdb2b2fb329f9e50ba369470188e4f0b756de08c8a02432b7fecccd8ad408179e909b486bb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253326, "uuid": "f162e210-189c-4d0b-8a0d-173cb027c816", "value": "04F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253326, "uuid": "e8419de5-800e-4003-9770-489ac6ae0239", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253326, "uuid": "438936d6-8875-4fb1-b5c7-2fb6a590bb4d", "value": "3072:4WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:442IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621253326, "uuid": "91e6f3af-c48f-49cd-8a4c-b8cdc5c6a147", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621253326, "uuid": "3a011210-0415-42a6-a322-19ff613f5da7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621253326, "uuid": "90fc3e1d-62f4-4a99-ab6e-df8052117912", "value": "853735f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbba104b-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259383, "uuid": "07a02d5f-473e-4155-be74-a26f10701a6f", "comment": "Malware payload", "value": "03f350e7257242dbadaac1e74d69b33d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259383, "uuid": "43639e13-b781-4bf5-a9ba-abbcfd0c567c", "comment": "Malware payload", "value": "171e1038dd89af4806cd38cb967bb2dd9ebd521b148b37288cea6a2d3879a394", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259383, "uuid": "2cee2957-8785-40df-8f8b-82d04f557520", "comment": "Malware payload", "value": "2d5369cd49e19a1c06231ce6ff4105273dbdbd9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259383, "uuid": "ea1a0445-b13f-436f-8b0f-83b44ba74061", "comment": "Malware payload", "value": "0abde4c5cb45d50ebf6289ec0768e70cc8f6d771ef8bb127515441c3dd7fdd527cf7d6f68d6478e6eb75a00dd7e23798", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259383, "uuid": "64b3cc65-1afe-49aa-8704-c7640f341ffd", "value": "A533F17547DCCAF66876E0BF84C2F408FFF28951C987862645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259383, "uuid": "6284dacb-f34f-436d-bbd5-4a16800513ff", "value": "1536:WjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wc8:OB9wzbqtWb08UscYJhnpjyq9qEK0wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259383, "uuid": "f6c2b195-ba36-4041-9a4f-60c70ec5ff12", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259383, "uuid": "0e01c9de-7361-426f-a094-5ffbda523573", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259383, "uuid": "c653730c-422c-4d49-9c51-6b9e9b1d4c23", "value": "diagram-101342488.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66bcea6-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264528, "uuid": "c9b0dad9-d96f-4ca2-8678-f1174159ffb7", "comment": "Malware payload", "value": "a9f5cd26108c61c7913666cbcebbc755", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264528, "uuid": "7322bcbf-aef3-456b-bdb8-278e197ec848", "comment": "Malware payload", "value": "1730012487963d3c0e47c2003e46eebd1d03dea4b419beacc4de319a3d2e9a93", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264528, "uuid": "33db03fb-044e-4286-b99c-fab7d24837a5", "comment": "Malware payload", "value": "52907de8c2a3d443e1e56ee83d2d5bed7afb180f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264528, "uuid": "c91fdad8-0a52-4858-a7bb-dd5704e255b0", "comment": "Malware payload", "value": "4507a4871a97a8796c14f7cb25ac29c9383d7f1d5f026b348be28ce9ff894f45cf6f9fae4d9b73bea02d0c9379a02767", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264528, "uuid": "11a970da-fe60-4b6f-bd76-b0de6dbea851", "value": "C133F1D09903F087D745BC49ECBA9D124F79E94A47BD74D3027AC0834EB2AB5A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264528, "uuid": "aa0aa99e-636c-4b0c-acb0-8cb88c8d69bd", "value": "1536:gXXtg3K7774iXfEz5lnm/hQMOEYus1GpDkoM0:EXma7774mfCyWMB/4GpDkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264528, "uuid": "6521c57a-ad73-45c9-9916-6a4d71e15e80", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264528, "uuid": "2eac32da-a0c0-41ec-830a-8cfa796a5257", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264528, "uuid": "d99ea22f-5672-4d47-9f11-fd182970ab59", "value": "statistic-789538483.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87e0bad-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257283, "uuid": "61dcad27-f112-45c6-a814-a48b843c6238", "comment": "Malware payload", "value": "18888b151f4ed25eb6b5af536708cad0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257283, "uuid": "ce5c1a9f-5542-40f2-a136-bbb1013173c5", "comment": "Malware payload", "value": "1730fb00e8542761952ba7c5fd0ea1e8a6f7b9f40d8c35a4c4e3ed4ebe7233df", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257283, "uuid": "5b4d6af2-d24a-4c98-8c6d-510d1be4e484", "comment": "Malware payload", "value": "f56926371c0a2505d75deb67c9e0fb2d416fe4bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257283, "uuid": "80d6ada6-c468-4ce9-9701-7b46efb2548e", "comment": "Malware payload", "value": "b25b25a6e1504fcfe88e30396fbde255d4bad95c2a7bb899a15741e2f1256889c8eed9101eb5904edf4c900b0ad6b1e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257283, "uuid": "f6523cc1-2f6d-48e6-a985-106aea50b991", "value": "2233F251E655028DCE4EE1DB30F6F9DCE6DE7A030EA964E09A7F2B44C1560F4482E68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257283, "uuid": "94ecf2ff-0696-48b9-a45f-25ef2f5f7167", "value": "1536:o2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI42:Zfqhp+g5ru2kmUEt8842", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257283, "uuid": "20ba1b3e-b3eb-4e08-a7f2-0b18c5d16592", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257283, "uuid": "e16607c9-1452-499e-a4b8-50329f89b6b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257283, "uuid": "e411bbf5-9129-4d76-b79c-63f71b7ae1bc", "value": "catalog-146594636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da302d1d-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216914, "uuid": "311158c2-9e12-4d32-8794-e8c51f17eb07", "comment": "Malware payload (Dridex)", "value": "ee89e82b1b17482812922d1d9c66c910", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216914, "uuid": "879fde69-5247-4a72-b34f-ef0a73e75c13", "comment": "Malware payload (Dridex)", "value": "1734ea5ff042ee70c88bab35fcbde57291e60c87846923bf984412b1fa2d821a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216914, "uuid": "162b2f0e-006e-4cf6-b196-6ad0d148d7ae", "comment": "Malware payload (Dridex)", "value": "ec8346bab57aca578dc95f271540cd2fb377752b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216914, "uuid": "834e97cf-24fd-4ac2-8219-540716db2295", "comment": "Malware payload (Dridex)", "value": "55b3bbccedea3d1e64d94b9ae538f0aa7661d073f3d04b435ca22ef385d687108f41013ee41ae6737a1c65137a9abf53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216914, "uuid": "fad1db40-6a15-4046-8ad1-50b57690f858", "value": "5BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216914, "uuid": "81642867-04f1-4cc5-97d3-4778c32d7d4e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216914, "uuid": "2e7d7a40-088e-4d73-b7d4-b88081230571", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216914, "uuid": "834f579d-8a0b-43e4-b7b1-cb57e675bb59", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216914, "uuid": "f28150d6-1c51-4110-8b07-a8b1cc8ec77a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216914, "uuid": "0d0d78ca-bbec-4642-a3d9-4f5c8a84f3f7", "value": "ee89e82b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cef9f8-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263607, "uuid": "474ef3ab-729b-4288-81e7-ccf78e1f31bc", "comment": "Malware payload", "value": "b0bf642e59c83670c33c409924524ba1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263607, "uuid": "b70feac7-1e6f-4c6c-acfa-6ebc8be8bf2e", "comment": "Malware payload", "value": "1746cd20a1bde7519f07fac84fc8e6dce0a88dbb99cb2179c1c7172768e7e934", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263607, "uuid": "433ef56e-5d91-4967-b980-cf20f52456a9", "comment": "Malware payload", "value": "025f7543746a91a4b8fe243caee8a342a6d9c16f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263607, "uuid": "9dc1033f-daac-4acf-b362-d1cd8dbda0f8", "comment": "Malware payload", "value": "139c7fa9a40eab8ed5110750ca825c55004c9b45f8d168c67d25dc4e065cc2fdcefdd85e1913fd6734094ce84612a255", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263607, "uuid": "2bc0b03f-e63c-4764-ae59-09e01861a025", "value": "0B33F2E09502E047A754FC58DCAB9D038F7DDA1E477D7842027AC0879E72E75B246D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263607, "uuid": "c17d009f-c787-41e6-9463-e5d068654323", "value": "1536:4XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOP5S:sXma7774mfCyWMB/4GpCOP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263607, "uuid": "6a35c87f-9f9d-424f-a5cc-c83863cfb6a4", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263607, "uuid": "ef9407d6-691b-4157-b7ca-933fbf3f9d43", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263607, "uuid": "ef64371d-d192-48c5-bfc9-828312a477c9", "value": "statistic-2036712169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef5222d-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264515, "uuid": "33d76184-2213-4c10-8821-97c2c95d19d4", "comment": "Malware payload", "value": "8b6e2e9dbf814aa0235de91ff655c8ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264515, "uuid": "888146de-813b-4cb9-ac2a-9bba5838075a", "comment": "Malware payload", "value": "176479de793660d73fa19c4a1f6cf29bcf96075dc13252c14036ac5e501386ab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264515, "uuid": "bf856038-bd1e-4df4-ad09-d391dc298e76", "comment": "Malware payload", "value": "007e125b15129f57a82eb92b65299669352a8b35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264515, "uuid": "1e51e659-3be2-4cc8-ba61-9acb6a971084", "comment": "Malware payload", "value": "87ee4d0210a1a591625a12dc08e8e335e400f0dd691a9683c7b6c79ddb97a78fc6fb53d7e316015c4068ae17b1059b02", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264515, "uuid": "60b135e8-46b4-46f8-b76c-84108a5d7979", "value": "5C33F1D09906F08B9B45BC18ECAB5A038F39DD19027D78D2117ED0D39EA1AB4A749E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264515, "uuid": "a8061fe9-2a4d-4054-8c57-46bdd9287b3c", "value": "1536:2XXtg3K7774iXfEz5lnm/hQMOEYus1GpyuBH:eXma7774mfCyWMB/4Gpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264515, "uuid": "70c0c92b-8b98-48ca-8924-699ceb78cc22", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264515, "uuid": "1c4c0650-b27e-4e48-b728-8eafeaf73a92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264515, "uuid": "88a4559d-08c9-446b-9d0c-8c58c6edb0b2", "value": "statistic-783769132.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6356d0-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260776, "uuid": "7556273d-9761-47b3-a3e7-0ba1306ade80", "comment": "Malware payload", "value": "95f4d07b5431b07eb191fdda830e75ea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260776, "uuid": "7cad8ae8-3b19-416a-a91e-ac55cd03b5e4", "comment": "Malware payload", "value": "176bd54b91ec0d4b9d31c59fc74e3fcf6f7594e7d5cec1f49295ae0737a2607c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260776, "uuid": "6059c63d-9e38-49a8-acd8-03700b052f25", "comment": "Malware payload", "value": "b3f4ea4b66c1a00b325e688d1aa6fc7e39d0b0cb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260776, "uuid": "9df4d01f-f92e-48c0-9bea-36ac9fa5d277", "comment": "Malware payload", "value": "9c7fdf573cbc6404944c82a78570f6ba3608da010e1b0c52f9ac5c2d736229cdd5dfc9ebba4ea125dfed0d5e9a5d8983", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260776, "uuid": "94c889ca-80bc-4bef-babf-5f8dd755e967", "value": "B433F1314BECC9B62DB2E0AFC8CBF504FBB1D094C4DB86224AF871C8B6942555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260776, "uuid": "ad1a0b6d-832b-4ead-b5cd-2ccdad5f59b1", "value": "1536:7jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXiP:PB9wzbqtWb08UscYJhnpjyq9qBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260776, "uuid": "001215e7-adc9-4954-8277-b92b0294f99b", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260776, "uuid": "ab190f15-ee15-41b4-b11c-a7f3e7d18f4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260776, "uuid": "a4e5dfce-eb55-4a62-887b-4e1a7aac7c1c", "value": "diagram-2026870878.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8175d250-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260144, "uuid": "32babe6c-8942-4279-bf6f-28e65e744226", "comment": "Malware payload", "value": "5e5dc59dd011024513caeb043f38718c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260144, "uuid": "c72ed3cc-0016-4235-807f-dfd44225e339", "comment": "Malware payload", "value": "1776471c9dfc3523c6e8481816582807cb93260e2e511853bd4b3b1b976e818d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260144, "uuid": "f33e3998-4e7a-414b-8bfd-e68c95e9bf20", "comment": "Malware payload", "value": "0f559189a0ec202886c3133d1b2d6cc52bd33311", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260144, "uuid": "22441d36-7e2f-48ff-949f-bd3cc16c7aa3", "comment": "Malware payload", "value": "99d2eec3d5d2f834d97a4ac4e954de65fdb693a3facdf593d76374995771e6f79c462c2f00d60131fe4173a29505a1ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260144, "uuid": "f5b564b3-96a5-4633-8550-c8653ea66ae7", "value": "F73302354BECDAF62DB6E0AFC8C6F604FBB1D455C8D3862649F9B1C8B6D01855E22E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260144, "uuid": "d872cc9f-cdc6-4902-a97c-769ee18ccf0a", "value": "1536:PjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXmZ:rB9wzbqtWb08UscYJhnpjyq9qBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260144, "uuid": "6a932007-74a5-4c0f-bac1-30b1ffd34726", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260144, "uuid": "fbad77a0-42d8-4f11-887b-25445328a794", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260144, "uuid": "748facf3-b06c-43df-a029-2cf8fa608413", "value": "diagram-1594300607.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a50664-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256819, "uuid": "bc3d3d5c-14ab-4b81-9460-a9c6dece9561", "comment": "Malware payload", "value": "6e0f4dba10ea8a93ff48cef36ab487be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256819, "uuid": "bf075010-5038-4433-929c-25befd2f68ca", "comment": "Malware payload", "value": "178e670e8eb6883ac845939ebfe8e21c411254591deb415fa7dccc8cdd3b2c50", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256819, "uuid": "47c1b6a4-3470-43bc-9306-a419b2ed341d", "comment": "Malware payload", "value": "1a2cd71ac19621f529029b039301a8a7bc6238d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256819, "uuid": "f93a13a1-6917-4c4f-9a8b-d46a54c246d6", "comment": "Malware payload", "value": "b39b90d268b409fc5bbd21769e651929a439ecb4162f87847ba465a3cdc2132526bea458bf25996205a552c460399c23", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256819, "uuid": "74690129-876a-43dc-9253-a5a30bb5de60", "value": "F833F241E655028DCE4EE1CB30F5F9DCF6DD7A030EA974E09A7F2A45C1560F4492A68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256819, "uuid": "1de207f2-5faa-4638-a5ec-df37c6517ab8", "value": "1536:62fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIKn:/fqhp+g5ru2kmUEt88Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256819, "uuid": "bd8aa5bc-c1d5-4e39-9a72-2412f6d6f28f", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256819, "uuid": "8301db12-c868-4e47-9125-04aab0166704", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256819, "uuid": "1f2dd6cb-1d23-43f7-b308-201096c63d52", "value": "catalog-1119662699.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c8afab-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257841, "uuid": "63e7c98d-8173-4051-9afa-6e6f2e0f6e58", "comment": "Malware payload", "value": "e8a23887144f4c72f7e52e8feaa46e87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257841, "uuid": "d2bda9a9-cdf6-49dd-8a9a-0a6560fe939c", "comment": "Malware payload", "value": "1795d3566d8eab9fcf88d2debf75943ba428a79c9b2082dcf3ada0f7c3194703", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257841, "uuid": "8192c7c8-b07b-485a-ab39-1b611e6602fc", "comment": "Malware payload", "value": "76af604f05946822dc0df05c2e431b9350493e10", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257841, "uuid": "359fde8a-d67c-4579-8705-3cb74aa259c2", "comment": "Malware payload", "value": "8f5b0d20b1e9d8fdc9b690bf074fefc2f99eac5c9e70f892d6df5c1243db7d01c41ed088219dd8c17c65bd461b06804f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257841, "uuid": "4255357e-767e-40f7-9a96-04a66c6b1f92", "value": "FE33F186E754018DCF8FE1EB24BAA9DCE19EBE43099A74D0DA6E5A05C1930E0182E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257841, "uuid": "44d64cfc-e074-4c4a-ac2e-0a4da50d797e", "value": "1536:i2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxJoc:nfqhp+g5ru2kmUEt88xX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257841, "uuid": "c380b653-24ea-4880-957b-021fbb6a1dcf", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257841, "uuid": "49dc9c33-d108-4c0b-a028-7f19d82d38a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257841, "uuid": "512f3e6f-c94c-4e02-a93b-f6a434f20b15", "value": "catalog-1913403164.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e6b4ab-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261900, "uuid": "baa124ed-5f09-4bf9-8277-50d4e263a1ec", "comment": "Malware payload", "value": "b9be8b3d8d74168e939023aefe2ab543", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261900, "uuid": "ecb9579e-43d4-4e73-9111-7fcc13ab9613", "comment": "Malware payload", "value": "179d31be4220e6e3e85644675cb7245dc9f68b72744ff94892d46b15e3666466", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261900, "uuid": "6b9f92b4-8151-4384-9d2b-bf5bf431a09e", "comment": "Malware payload", "value": "3d25708dbf452a57e9f5cdb1b4b0c20dcdb5ed18", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261900, "uuid": "8e217fb5-0e0c-4816-9513-f4d85be9df91", "comment": "Malware payload", "value": "29a000ba9eeb0150afc2e24cb4cc69593698a9d44b6a7bbdee75cd18dead1a330fb04084ee59c09c42ff8d42e75ca01a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261900, "uuid": "87550866-1e3b-4095-a2b9-00161930c206", "value": "2C33F17147DCCAA76C72E1BFC4C6F845BFF29821C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261900, "uuid": "1a1fd90d-4829-4535-844e-29498d398920", "value": "1536:cjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wH:kB9wzbqtWb08UscYJhnpjyq9qEK0wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261900, "uuid": "de983a02-e1d7-437a-8711-1ed9d05504a7", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261900, "uuid": "7ff7668e-1dd2-4caa-a27e-4ad606b3d815", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261900, "uuid": "c92ca1ce-f6f2-44a9-bc9f-2bb61f08bb76", "value": "diagram-865195901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8030b7a-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263322, "uuid": "b6f74eeb-f758-40cf-ab86-13fa27b8058a", "comment": "Malware payload", "value": "1d72b39bcf8eb40bcc439f47baf8e544", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263322, "uuid": "4fde0746-a24c-4116-8a64-cb20033f91f5", "comment": "Malware payload", "value": "17a0607854b0f8ff8a51d45af716eacfd66262d009b358e2e1165be118c515b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263322, "uuid": "7a425157-0300-478f-859c-4b2662237efb", "comment": "Malware payload", "value": "fa68978ca072c596fe45553e850d2ae5a3cacf39", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263322, "uuid": "f11bbd02-e84f-4368-acc5-af757fe2656d", "comment": "Malware payload", "value": "b1021bcd8f175135010df0dfdde1b9d79a198fd2217c90f173edda4f2f4eaa48a631490970bad0328a8bfea14ebe2bc5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263322, "uuid": "6f2b3be5-b09f-43e2-8c89-b2b4112e9a42", "value": "B933F2A09502E047A358FC58DCAB9D038F79EA5E477D7842017EC0879E72E75B246D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263322, "uuid": "a831dd3c-1474-4e4c-8cd6-2e1b6ab38f60", "value": "1536:UXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOZ5p:gXma7774mfCyWMB/4GpCOZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263322, "uuid": "2ed42f2c-a4c6-4ea5-b2c7-f0d172638f4c", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263322, "uuid": "4ffc6be3-46dd-4ae5-8da7-9b9658e62084", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263322, "uuid": "da30721e-afb5-46cb-86e8-8760f44e8a61", "value": "statistic-1823063303.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1cfb8d-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260724, "uuid": "05fa6866-519a-4685-9a36-6a87987daf26", "comment": "Malware payload", "value": "14b0266902378c1110996cff78bb962d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260724, "uuid": "59dc4730-d6a8-428d-b6f0-ebb4bdacb716", "comment": "Malware payload", "value": "17bcac685c33da590737b6105e3aea0aaae6b2917ea04e2fa58473640ba809e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260724, "uuid": "daba0e88-2e02-42d2-a54a-9605273d0732", "comment": "Malware payload", "value": "0d6c9c75cc00ad1b9bac3d78b0bd77e0130d946b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260724, "uuid": "74756b64-ac42-42aa-8f4a-ca1c7ca5f850", "comment": "Malware payload", "value": "83653cfc005d8c855df068421635a1c39fb4c29117221b805e203e25419647ea012a0534a95cc1a23cc5ee81d2d9535c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260724, "uuid": "f564960c-8e3a-41a5-b830-cdb6e0ac6ef8", "value": "D033F1710BACDAA62CB1D47FC587F900FFF1C8A4D5DA861645F870C8B6D42558E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260724, "uuid": "6146e41d-f473-47aa-bb5c-365a04b8b9b8", "value": "1536:6jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67dM:qB9wzbqtWb08UscYJhnpjyq9qawi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260724, "uuid": "66ebf831-996c-4963-92c5-8c7918aeeb72", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260724, "uuid": "963bce0f-37e7-452d-a0fe-765a242bffbb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260724, "uuid": "26d36580-9ce0-4d10-a61d-1b2ca5add6c6", "value": "diagram-1989255784.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1bf370-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263922, "uuid": "8f9af660-1659-492d-bd65-6d1bb95dbadc", "comment": "Malware payload", "value": "848c061d645813e9dff4c06d50d33ff9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263922, "uuid": "47a9c178-cc74-4ecc-b5ef-f3812ddc3f1b", "comment": "Malware payload", "value": "17d0202ca4f3b24bfd8bea63b35905cea3d6d23e1907426c7a79d8e0b2c57c88", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263922, "uuid": "3257fe69-8173-4e82-ae87-75dedb086a58", "comment": "Malware payload", "value": "52fc78078e62276b13a892cdcf990c2456d3a6aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263922, "uuid": "31fe2f34-f938-46a9-85ac-a004ac0a9c9a", "comment": "Malware payload", "value": "3b9296161339be12d989d86a38163af935db0ce62e12acb8c88052896f18ece612a6bb178bd9f37d4a5e71973d6ffa5a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263922, "uuid": "d5a4add0-b25e-4f42-8481-fdc78645e1cc", "value": "F033F1E0A902F08BD744B84DDCBF9D135F3DDD5E423C6892413AC0864D62AF5B719A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263922, "uuid": "87ec64b2-a3f0-4b4a-8a00-2024c50bfefa", "value": "1536:FXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVxC:BXma7774mfCyWMB/4Gpua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263922, "uuid": "a867ce3a-2640-4b33-a2a8-92df076c69a7", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263922, "uuid": "254f8014-809a-47f2-9791-1f38404c23b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263922, "uuid": "5d964ccb-d386-4d71-a2b6-8b5aaa045688", "value": "statistic-36281890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201ba65d-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259122, "uuid": "c610c8f5-294f-4c16-8886-aa09046d1dcb", "comment": "Malware payload", "value": "4ecc6f4e048046d8cc560b2bc3a12db1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259122, "uuid": "650ddf73-f383-4537-9366-bf141f62745b", "comment": "Malware payload", "value": "17dd97762527e48f098f7902b37a6f7b27d6b62f43d487add8bc1d52f2c50e6d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259122, "uuid": "dd4e6b49-0e72-435b-b091-82ceb5128bbd", "comment": "Malware payload", "value": "d79a0711be43fe3ab3036cb679def070a0019d9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259122, "uuid": "cc686fc4-1811-4cab-bd37-3581f0346c6d", "comment": "Malware payload", "value": "1b6a9081cc50a3e54ae95a6447fbfec4ead9c420ffd920f0e086202cab353523f5b896a37d0aaa7d0e738f1af262cab0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259122, "uuid": "669147b6-a8fd-4cc3-8897-9b64c6e37a64", "value": "CC33F191A55D118DCF4FE29F30B6F9ECE6DDBE830D99A4D09A6E1B0184530F4483E68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259122, "uuid": "39f9ad82-dc56-4d4a-9e0d-be4ef0d6236a", "value": "1536:F2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIRC3b:gfqhp+g5ru2kmUEt88k3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259122, "uuid": "06979de4-b8fd-43c4-b781-17edbf59a559", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259122, "uuid": "e7217f26-c749-428c-bdc6-afbb680481ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259122, "uuid": "f302aaa5-24bd-47d6-9c60-4616f804126a", "value": "catalog-807401189.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a26aef-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261037, "uuid": "f01f0f7a-df45-400a-a9ec-b1c4295aed53", "comment": "Malware payload", "value": "c5eb5a05b8d9f8a3e656676a731847f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261037, "uuid": "e7b27729-ab7d-4e2a-a49b-d5135fa7fda7", "comment": "Malware payload", "value": "17e7beaf94e1a08ae2b440633f083e11b330b91640a9c9ef8ccc21da013463b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261037, "uuid": "0aa5b05d-8b22-40ee-9efa-42b1a954e708", "comment": "Malware payload", "value": "eeb033a915ba37be2b3cf9922ef48e0e8b16e6d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261037, "uuid": "54dd5e71-9114-4252-9554-5dead2caa611", "comment": "Malware payload", "value": "e99b38d8e095503e21d7f7567e7bea989a6eec1585f1f49ccd9b4c7f9394ae39cee8fde9563b505aca2620cd498e191b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261037, "uuid": "8727f7f2-8afe-47f2-9cef-bd8edf7ed0bc", "value": "7733F13647ECDAF62972D0AFC8CBF505FFB19465C4D78A2249E8B2C8B6D01955A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261037, "uuid": "07932b7b-7b5b-4094-af7b-5300f3e6fe4f", "value": "1536:LjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXOq:/B9wzbqtWb08UscYJhnpjyq9qBOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261037, "uuid": "82d696fb-7704-402b-8762-42ba2064562b", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261037, "uuid": "e70e3ad5-43ce-4144-87d1-9abd8bc64996", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261037, "uuid": "0a567646-9e84-41c0-bdb0-c7cc08d95988", "value": "diagram-276530205.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c22c693-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258363, "uuid": "44edb076-a2ed-4c95-b9a3-4af7616e5f27", "comment": "Malware payload", "value": "eaa03be9ca071dcce3e79e385334ccb2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258363, "uuid": "45ee4344-981f-44bd-8807-ee63261a98cc", "comment": "Malware payload", "value": "17fd06906af8b4ac2c129b5984f9320da7290da151059ecb1d86b849a364bac9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258363, "uuid": "d96067da-a32a-4d4b-84fa-2353ca1af5d2", "comment": "Malware payload", "value": "aff55df8bdb9bed0f017334755f17dce5c9e39e8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258363, "uuid": "fca43087-1bb4-4eef-9e87-c7c2ff411e5c", "comment": "Malware payload", "value": "09ff1860e14fc930a55718ce1fe41e74a4850c3b6fd4407bd29744996ab9cb8e3317eb240fb597aa6608d6e3b79410b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258363, "uuid": "de544d81-f460-4589-ab12-f884f05455e3", "value": "3F330291D694028DCE4BD3EF20F6B9DCE59EBE53099AA4D09B7E0B0191534F1482F68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258363, "uuid": "fbe3ab6d-07d5-451e-b1d2-c40cffd8da0c", "value": "1536:X2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIB7bU:Gfqhp+g5ru2kmUEt88B7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258363, "uuid": "1e02ced2-1744-4138-b80d-26daf425dd3e", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258363, "uuid": "bd67b471-a68c-4984-9f2c-bd0a9c0929f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258363, "uuid": "831cd73a-0a32-4ef3-8981-8b4b9bf80af9", "value": "catalog-369758785.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee036a4-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257616, "uuid": "5b6634cf-fff4-407e-b0cf-0c40a00aa849", "comment": "Malware payload", "value": "0eca5ad0c59b29475c6cd9d6dfeb16a0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257616, "uuid": "c898788c-eff5-4de0-b5be-c073f34522b8", "comment": "Malware payload", "value": "1801210a3f88638ed97843c413fe3ee69847113ef37498f82b82232efa5eb2fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257616, "uuid": "8775f485-671b-4de9-a82e-355d0edb2204", "comment": "Malware payload", "value": "54e977976e2175309e56c71b6e7232b20a8a7303", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257616, "uuid": "5648e548-8ce9-4ba1-9d86-f584a8fc2728", "comment": "Malware payload", "value": "86a912e1997a5ac7a3ed55796b72fffcabf60822a8d4a5f3ce1917c6bef47f1593eef2e6967eac91d72a2c822bda0eeb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257616, "uuid": "21a03bd5-2e48-4a9b-b446-3a8247970f8f", "value": "D733F295D624018DCE4FD2DB30F5EADCE69EAE530C9978D09F9E2B4895930F0081E58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257616, "uuid": "cd754e63-f2af-4e8f-b285-b8795ca3eb37", "value": "1536:d2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIQLllfp:Yfqhp+g5ru2kmUEt882p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257616, "uuid": "b10d7a20-654d-494e-bc00-c592929d4213", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257616, "uuid": "5802a764-e1cb-4f69-8c54-6afd1c808340", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257616, "uuid": "1c39543a-ec3d-4632-8ac6-74c447c70ba3", "value": "catalog-173135229.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a203e31-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261474, "uuid": "a15c2590-8a49-49b6-877d-6d3d26a127d7", "comment": "Malware payload", "value": "6ae53f9150566a1e8d712676db191761", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261474, "uuid": "864bcf30-40d0-42a8-93d3-22511e0521e9", "comment": "Malware payload", "value": "18097da9d2de7a02522af631e0499682bb55c12288f5f5e20a1190a519836e94", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261474, "uuid": "f12aeec4-3a18-454d-b8a6-bd2a05234774", "comment": "Malware payload", "value": "786cae89ef4ae26262b91935ad1047bb9ff4b1b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261474, "uuid": "d6bf96b3-b8fa-4e2c-a01f-83e2bbb30427", "comment": "Malware payload", "value": "0b74cea6d2249af89dd5fe4336d973a0863bbfe0efefcf6560a070cd0c97be3fd3b043d01445cbc2a5341b43c3af4a11", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261474, "uuid": "42d4ffca-5b59-4ed4-936d-33bc81266b3c", "value": "8B33F1314BECC9A62CB2E0BFC8CBF504FBB1D495C4DB8A664AF871C8B6941555A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261474, "uuid": "94c32da9-490f-40e1-b9d7-e62822383246", "value": "1536:XjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXab:zB9wzbqtWb08UscYJhnpjyq9qBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261474, "uuid": "74a26703-29da-4bd7-9fd9-59093cf66d08", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261474, "uuid": "1153804f-c278-40ae-92f9-470fedd641d6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261474, "uuid": "05f7dc11-10a3-4b76-abdc-13d82147027d", "value": "diagram-580379434.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f9bb57-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621216880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216880, "uuid": "a78c242c-daa1-4c77-b6ff-43717d56639b", "comment": "Malware payload (AgentTesla)", "value": "e31398408b6a7ca24d58b4a32a15efa5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216880, "uuid": "34af96ad-daf5-4f9b-ad6a-5ae906c64d88", "comment": "Malware payload (AgentTesla)", "value": "182a95e2f2bcd61c3dd6d47b060029c539cdfa265cd83090b3c8199e910e0769", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216880, "uuid": "8574dae9-d5a8-48cb-80d7-a0a65acfd77e", "comment": "Malware payload (AgentTesla)", "value": "f883559d1f99814e60bfff8263be34088f6452b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216880, "uuid": "bf292838-0afb-4d32-bfbd-2b137f36b853", "comment": "Malware payload (AgentTesla)", "value": "4d2d04b7f3405626220bc998f478046a30bc538c16c527c7ae88547840ed4d2faf5c1424ccc81f9238442c04340659d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216880, "uuid": "31c6b48b-5b2e-4d08-bc6e-12f780573b31", "value": "477423CD27D9D04628C8847161AB07FC66127056EE347603EBA8A82FD643D95BF7872F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216880, "uuid": "c4823460-6c2f-4e2d-987e-d44109f78342", "value": "6144:kfTxwTWRNydcpQBILJwKme41V0e6M97I4tdTsf4YtoNsaP2PRRWB5jATOmh4:kbxw6a0wJx1t9DpsouPfg5jA94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216880, "uuid": "4fd492c5-b261-4ae6-bbf2-4143e71feeae", "value": 366232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216880, "uuid": "651922e1-c686-4d3e-9288-de3d559911cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216880, "uuid": "3382bd89-8212-4503-a04a-f84c2bdac56a", "value": "e3139840_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c7f1c-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256774, "uuid": "4e101a50-a61c-42c0-b6f4-3fbc5e83adc8", "comment": "Malware payload", "value": "773ceddf7484aae7a4f0360f4e542b13", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256774, "uuid": "b9df14b1-fde4-4f8b-835c-eda5e22b09f8", "comment": "Malware payload", "value": "182bcb7ca13070f1b1128626e21e4fb97710f14e82c1ced3b331c802e2309ddc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256774, "uuid": "8e57eb9b-b7b6-4eb6-a06f-995469fcd511", "comment": "Malware payload", "value": "463656328a338a8be35b37ecdfab388d198e02aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256774, "uuid": "eba8eec3-6a41-466c-a29e-043e8ee2f5c5", "comment": "Malware payload", "value": "e08f7a3b2d47b0b20e8f61d829684e016c0825c386e90047cac72891737eaf97a28b3db5d24aa2d9aea29ed145b0b5c2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256774, "uuid": "bb590df1-739d-49f8-9649-984573f2173c", "value": "9E330186D264214DCF4FD2A630F1FACCE5DE7A430DAAB4D0A67D2B0581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256774, "uuid": "e096aa27-d08b-4e0b-8a78-19eac4dc21b9", "value": "1536:p2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3T:0fqhp+g5ru2kmUEt88IxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256774, "uuid": "588d645e-bfb1-4428-8c82-ac3ca7322c33", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256774, "uuid": "d2bac48b-be42-4698-a157-6e2ebdc6558e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256774, "uuid": "594dfe3a-b515-4e29-b8a6-269303a8389b", "value": "catalog-1090113340.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636dfe22-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260523, "uuid": "b3487eea-a5ff-480d-bba1-98f85b671ebb", "comment": "Malware payload", "value": "8f671e986bff6f02542b892297f99e10", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260523, "uuid": "64373308-d29a-4fa5-8b85-f6fbf389b7fb", "comment": "Malware payload", "value": "1846b752df5909f86ef6832a3cb482e8255efeb1d34f73e108cb2315f030a783", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260523, "uuid": "0a017fc8-1a42-4381-9853-472c0774a6a0", "comment": "Malware payload", "value": "447077a7018bd5a6a782c3de7bd957aba05f7ee9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260523, "uuid": "4b6c3d8d-4b47-44e4-90dc-82f0cf7d01ff", "comment": "Malware payload", "value": "95ebad7be105265e43210981c45d838deb7ff46f22ae339f14b66fc43c7cd844323543963d7e86a0004831dc3ba446d1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260523, "uuid": "87a602d8-cec5-452a-a03f-5ae616f9a3c6", "value": "7F33F17147DCCAF66D76E0BF84C2F808FFF28951C987862645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260523, "uuid": "cf7350ca-eac3-41a5-a6f8-718c2e36779e", "value": "1536:AjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w5g:gB9wzbqtWb08UscYJhnpjyq9qEK0w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260523, "uuid": "e075a380-0fc4-4772-81b5-01b7a5967e02", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260523, "uuid": "6065cda3-4b49-4073-8ac3-ddd5e1469c21", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260523, "uuid": "f89184dc-da54-4cf5-a3a4-0e197f3a0765", "value": "diagram-1834739864.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0493b9d7-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263370, "uuid": "4c5b2f2c-a77a-40be-a938-54a1ac592c10", "comment": "Malware payload", "value": "d870c8b08a3a442c1fc8b79787cbd513", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263370, "uuid": "c012f448-d397-4e9b-8961-321d157e6a00", "comment": "Malware payload", "value": "184d1d6f682a6d312678c419d464de2fe3102db06fe9513a2d711faab956e7dc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263370, "uuid": "5fa44f47-b2f7-4863-9833-0deeb7f06d59", "comment": "Malware payload", "value": "75c41e548e9cf1ae656b253c797e3319f2b92399", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263370, "uuid": "77cc003d-26bc-45db-843c-b26c02b1c218", "comment": "Malware payload", "value": "8adc8e905d3a54295d1d67644eef4a48e43a5fd0a9c16bb69ca347a01dd0de4101f0049ad82191962845728f0adcb997", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263370, "uuid": "8f1fa5f8-ec81-457d-9c97-d586de08abb2", "value": "1E33F2E4A507E047A349BC5CDC6A5D038F3DE91E433E78D2022BC1974E62AF6A645E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263370, "uuid": "e10343ad-6650-4576-b165-9e83bd9f3577", "value": "1536:vXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZbv:PXma7774mfCyWMB/4GpWvZbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263370, "uuid": "97f2e7b8-c452-4894-a7f1-617f2602ff0d", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263370, "uuid": "85b4a704-f519-4d99-8cd4-11915f3a46d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263370, "uuid": "189a0568-a115-48c3-9cbb-09c632bb705f", "value": "statistic-1846637088.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7d626f-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260406, "uuid": "84ec7280-254c-4be0-8f53-518f20422647", "comment": "Malware payload", "value": "affaf41ede29ba8a244a0a51cd3a9853", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260406, "uuid": "e3977f28-644c-4865-b688-7599621b4904", "comment": "Malware payload", "value": "186c497e9aa53aecef8b49a428703a55cb4ba8ed9143868fface7bc44b37b4e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260406, "uuid": "b2daf1f8-1434-4f0a-b1d6-6181734ad707", "comment": "Malware payload", "value": "3fef6b2b1efedfaff7a1fb46aa030528784c0971", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260406, "uuid": "c47c0595-4156-41ac-a5de-b59ff532c7ca", "comment": "Malware payload", "value": "4bcffaafbe404781380aff538c3420f667cd3efbc01cffd037c25a5dab521927bff408637e1195a530abe31817fce161", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260406, "uuid": "1a2b5798-c218-41df-b958-1462da77eef4", "value": "1933F13547ACD9F668B2D0BFC8CAF604FBB18495C4D786624AF8B1C8B6D02845E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260406, "uuid": "4f047849-b982-4c49-adf9-cd6234be881e", "value": "1536:EjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXO49:sB9wzbqtWb08UscYJhnpjyq9qBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260406, "uuid": "1908d6ae-a2e7-4777-95bb-5dbcab2a6795", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260406, "uuid": "73cba201-83bc-4ea9-9fa6-8b0c9ab58b55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260406, "uuid": "a124f3d0-cded-4826-bd03-0f2215028114", "value": "diagram-1756721686.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e615e4-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258566, "uuid": "9f7e070a-56ab-4bd8-a21e-0331d09e0da2", "comment": "Malware payload", "value": "807870e09c167870d2f9872a39d9be3f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258566, "uuid": "795c9953-e878-4e50-9caf-8e2a3f6107fc", "comment": "Malware payload", "value": "1895c1108f7e86f8f00535b466fcdde89e16b53c80e140a173311b9fc94c7d09", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258566, "uuid": "1ee402b9-3d9b-4782-ad69-92ea9576b7e9", "comment": "Malware payload", "value": "df7bb8e3c30bb9b0c28557bcf3ef35845951079d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258566, "uuid": "0ea9a43d-c4ae-4615-9081-e031ce74e9d8", "comment": "Malware payload", "value": "cd73fcc1c0defd32b7811644bed68420cef840f054bacbef2b5e3974460e883574e3eef5b2bd9e4b152bee11638e5190", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258566, "uuid": "329b86a2-fabe-42db-b08c-a7d7eae2111b", "value": "EB330186D264214DCE4FD2A630F1FACCF5DE7E430DAAB4D0A62D2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258566, "uuid": "cfe167f5-8c30-4c47-93a8-764e0a8a325e", "value": "1536:s2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3y:dfqhp+g5ru2kmUEt88Ixy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258566, "uuid": "7db32f67-3611-4069-8ba3-f499a206f7de", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258566, "uuid": "57ea1bdf-48bc-4c5d-9c6c-c1a52b97a7f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258566, "uuid": "c1974508-22a6-4f34-8d40-172b1e6aca12", "value": "catalog-407953661.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7eea56-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264513, "uuid": "03b37cf3-a015-471c-aacc-7106378ea172", "comment": "Malware payload", "value": "bab6f797d46a8e43cb51c8f94e8e9ab4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264513, "uuid": "85bd2a41-0ef9-4032-b0a3-2f3b0e691f0a", "comment": "Malware payload", "value": "189a5829bb2e46645263d8761b1baad4c76c912f1c51283eff45b8b38962e2ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264513, "uuid": "db256ed3-05da-486b-bf72-3783bb87688f", "comment": "Malware payload", "value": "d94be730e5f04e62fafed0ce4430d0282cb1d4aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264513, "uuid": "be4912dd-7b10-46d0-892f-8fa78729fa00", "comment": "Malware payload", "value": "093693e16af015386da73bad2acbae5db94d84e6386284240f63dea3b85e3857176210d4652b3cced2847ac733dd8f2a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264513, "uuid": "c65dec69-caed-4f8b-8b16-345f3510645c", "value": "E63302E49507E0479749BC2DEC9B9D438F3CE91E033E78D2122BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264513, "uuid": "ffe217bf-35a9-4e75-84bb-f23801432ead", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZJ:bXma7774mfCyWMB/4GpWvZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264513, "uuid": "04601f84-651a-421b-b67b-027bfb25d815", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264513, "uuid": "bc822bc8-81b7-4f41-ada1-377f597d73f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264513, "uuid": "6aaa6c2c-e81f-4cf6-8714-ffbb55254dd7", "value": "statistic-781306394.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ae7781-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259768, "uuid": "29fc1fde-f3e8-4c28-9e0e-a2865a538344", "comment": "Malware payload", "value": "b9b9c48c49fc72aa25ff44873d394358", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259768, "uuid": "72f6f454-26a9-4046-9514-9e76b5863101", "comment": "Malware payload", "value": "18c4bedf73dd9a1a1aa92c5a1c865c47c40a05ef30473af2a389d568a3cdb905", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259768, "uuid": "829a0aea-cf21-43fa-a02c-e98a8aa38b2e", "comment": "Malware payload", "value": "a01bad182f349c7700828facab354817a6696461", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259768, "uuid": "f407ef9f-7c39-4c7d-9997-c5139124342f", "comment": "Malware payload", "value": "f79c44e54e259e2d497ae4be7cb23242b2c6c9d3e19c207791607759ad3c8852a615e507484707a37624f41f36ae551d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259768, "uuid": "ca61813a-0dc8-42c7-ba12-b09531310ed3", "value": "0B3301354BECDAF629B6E0AFC8C6F604FBB1D455C4D3866649F8B2C8B6D01855E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259768, "uuid": "a12b3f67-b2d2-45ba-b9ab-9ddb5b4689af", "value": "1536:ejfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXQY:WB9wzbqtWb08UscYJhnpjyq9qBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259768, "uuid": "5ea88654-5e89-4046-b7e9-6fa69cfc33ac", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259768, "uuid": "03963ae7-851b-48a0-84d2-af0baa39f180", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259768, "uuid": "72fdda5f-55be-4f75-a4c9-f2246e3df90f", "value": "diagram-131833794.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0de364e-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263633, "uuid": "ed4b9393-98d9-451b-8ea1-8199e3f08722", "comment": "Malware payload", "value": "d17002cf6925b8d3f0fd485b6a1d79c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263633, "uuid": "b88bf90a-bf05-45e7-baad-e872fc648531", "comment": "Malware payload", "value": "18c7f89aa46cb365c15a20d89153f13e2075eb75572822114dd0b2ccd6621699", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263633, "uuid": "300838de-c7c4-4156-abe5-c0c221c94779", "comment": "Malware payload", "value": "e6d829cad455ebd975d0fe7ea1598b8f80e42280", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263633, "uuid": "71d8827b-5a3d-4515-b495-038714106e49", "comment": "Malware payload", "value": "19150148b81b32fb6f74296c9d100d39b8940a599811c8bb659c029f251a580e2e9b074072f5fe6d295bc10837b5f3c5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263633, "uuid": "01006c87-2248-4079-8bf7-3a56dfb53076", "value": "5533F1D06906B08BE349BC4CDCAE9D134B7EED1E463EB892013AC0875E61AB57605D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263633, "uuid": "04294a7d-9dd0-47c0-bf27-06d9bb77e792", "value": "1536:5XXtg3K7774iXfEz5lnm/hQMOEYus1GplItoT:tXma7774mfCyWMB/4GplxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263633, "uuid": "21bbc36f-f1b4-4f97-9002-3218adaa6576", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263633, "uuid": "754e4615-5f32-4662-bb2b-1ba4fcb13048", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263633, "uuid": "a1e3a6e2-8f48-453c-baa7-11faa65e084a", "value": "statistic-2062855785.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c6b914-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263179, "uuid": "9b6514ae-968f-41d5-98fc-fbfec6d4d1f5", "comment": "Malware payload", "value": "0c44de6c0e060d7f30b949b8424c0fec", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263179, "uuid": "ae42901a-6715-4c14-bcd3-3a8cc083e833", "comment": "Malware payload", "value": "18d1b839b62fe0d89c972e05061678dae378f59980ed14d57d914bbffe0715ec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263179, "uuid": "ef604299-2c22-46da-9957-958bdbbad01d", "comment": "Malware payload", "value": "39c58909944883e75fae572d22a5a1fb4a97560c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263179, "uuid": "a87ce4a6-d26a-406d-87d8-aaae29c56ff8", "comment": "Malware payload", "value": "29cf8e49431cee0697cc9b1f4789c2593b66454f0a006b7581762d5e1c66798bdaf10a45828beb93cbce7513fb078b0f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263179, "uuid": "0fd3b0a9-bda9-480b-b088-2c97e029861c", "value": "5133F1E0A402F04B9718BC5CECAE9D034F7DDA1E433E7852457AC08B5E62EB5B749D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263179, "uuid": "a8a85f92-59c7-4f4f-b3e9-ce7e972d9bf0", "value": "1536:qXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIyv:qXma7774mfCyWMB/4GpV5dyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263179, "uuid": "48be2097-61b3-4522-9d66-ee2be5dc50b7", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263179, "uuid": "dde97351-70f4-4076-b7ae-8dd5197cf015", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263179, "uuid": "b4e88e46-52cf-4d5e-b4a0-4d6695b512d1", "value": "statistic-171006109.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3daf21c9-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257883, "uuid": "d2d3d0df-8353-4231-a56b-56e5ecc5bdaf", "comment": "Malware payload", "value": "5d3897acbd0eb26ff7a63ba70b356ca9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257883, "uuid": "3c943cd5-108e-464d-901a-476b51e0ae1a", "comment": "Malware payload", "value": "18dbf77733dcb5284d24ef6db017c7b7936f7dc58e9e710d4c7493d7dbf0993a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257883, "uuid": "08832f96-7032-4d27-b560-a2e5ef9cb742", "comment": "Malware payload", "value": "d32ac5721f76ddba02d36c34ca77a2c5398acc24", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257883, "uuid": "f5ad1ca2-d7c2-4080-8553-8a8466ec387f", "comment": "Malware payload", "value": "ace37c8e0337f332e784710509c3d5d7cbffa5a073040ad6f104ad76006edb2fef0b17b44593776c333fe15418eea629", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257883, "uuid": "ac74c206-ba8c-4b54-a8ad-9ab9b4a4e19e", "value": "2D33F141E655028DCE4EE1DB30F6F8DCE6DE7A030EA974E09A7F2B45C1560F4482A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257883, "uuid": "bbc91d5c-0584-4c57-aa2f-21214007e2d6", "value": "1536:f2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIM3:ufqhp+g5ru2kmUEt88M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257883, "uuid": "9e6e1eb3-9ca4-4604-bf0b-123eb3c2d5c5", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257883, "uuid": "7832dcfb-14bd-4435-8a48-89d54e234628", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257883, "uuid": "16a03869-8862-453a-9506-89eef020cad1", "value": "catalog-1943353215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d305c6d-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260620, "uuid": "f9d2a079-2e35-4d86-97cd-09bec000bf13", "comment": "Malware payload", "value": "b6363c939dd4276e5fce762049730a38", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260620, "uuid": "1c8b2838-7f50-4938-b676-63e4d326ba94", "comment": "Malware payload", "value": "18ed278f1309cf696f4aca27e2b1ca6c174f2b485428416c464901984910430d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260620, "uuid": "6ca1ccf3-3ef2-4773-b954-762560417b94", "comment": "Malware payload", "value": "2ef9ae0b32ec8280ed00148e561d232800fe876b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260620, "uuid": "8b0700a8-a14e-4558-83ce-527b30a4e6e7", "comment": "Malware payload", "value": "2d98a3862857bef062f67be4c4a5a4f7f727371dcb5fda7c59a8858aa594f20d2c0dabf2ec62053dcd3abf9baed3d9dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260620, "uuid": "764a62bf-8861-4905-90f2-aa2b592e6a5c", "value": "9D33F1714BACDAF628B2E4AFC88BF904FFF1C455C4DB862649F871C8B6941559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260620, "uuid": "ee9cb8d6-df3f-4a3d-8c9e-2b6d189532d5", "value": "1536:fjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXp5:bB9wzbqtWb08UscYJhnpjyq9qBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260620, "uuid": "d0e56b17-ef17-4dee-ad22-9a6db2583821", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260620, "uuid": "f6db0f29-71c5-42fd-8d5d-9d7730abff67", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260620, "uuid": "fa24d9c7-3cb3-49d3-b492-10a3ad06f3e4", "value": "diagram-1928736731.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4537e90a-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257466, "uuid": "bc9a8ec3-af7e-4999-accb-b102d9aa906b", "comment": "Malware payload", "value": "71c04ad94597d9c6b4cbfccaf5f28862", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257466, "uuid": "831d99bd-2b57-4671-9a92-8340e3918313", "comment": "Malware payload", "value": "18f7070096555f1ee79191ed70a4f9867c87f100fdf6707ddc180db4ada12ede", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257466, "uuid": "0341e20e-2e0d-4ef3-b82e-c5b1c26aa7da", "comment": "Malware payload", "value": "0dc19a9f837ddafc00fc7cfd03c8b34b21a6c33e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257466, "uuid": "aa77468f-f222-4343-b503-a410e487d527", "comment": "Malware payload", "value": "e105af3a6ddd50d1334467c080132fc54ae3750a3dc67b4a25c8cee56452c6f75f8ea94b03d060a3740d4285a73f2943", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257466, "uuid": "93f40429-ebc0-4576-8e79-e0da0014cdec", "value": "87330281D694028DCF4BD2EF20FAA9D8E59EBE57099AA4D09B7D0B01D1534F1482F68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257466, "uuid": "7bc4d1dd-de90-4902-9546-f39640e319b8", "value": "1536:S2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIB7bO:3fqhp+g5ru2kmUEt88B7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257466, "uuid": "5bf9cabf-f70f-4c07-b0bf-d01f541f520a", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257466, "uuid": "9fa3e56c-cd09-46c1-9c2e-b0c3c9ec9fed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257466, "uuid": "cf340c17-5198-4e15-9642-9a3e29a98ae9", "value": "catalog-1605743655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccde3605-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257693, "uuid": "58bba4f8-847c-45d7-a5e1-3343564d86d5", "comment": "Malware payload", "value": "ed7d39bccdb5bdbb1681fe4eccd38cae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257693, "uuid": "deb07c9a-e499-4969-a147-a49c2b77cd5b", "comment": "Malware payload", "value": "1908a5b3406e26690e028e1345f306b3fd91103a2dd087edf909657029d031e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257693, "uuid": "a58e9471-e794-4adc-9b70-b5d8e325fc4b", "comment": "Malware payload", "value": "0a22d07cc49ea19db99d16a80bdfc222646b22e3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257693, "uuid": "c4a0d5fc-6ab6-4b34-b7fe-3ee14b1d37f8", "comment": "Malware payload", "value": "541004847ca90553dd81bf1f359da835c0ac40562981c8bc21ee7f5aed6d15f93788e0ff621f1904fecc35e9281a56e3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257693, "uuid": "e0e89718-88d7-456a-8c0a-4a508c88d12b", "value": "8933F155E658028DCE4BE29B70F5F9DCE1EEBE530D9A74C0972D2B0191430F5482BA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257693, "uuid": "ee8431b4-84c2-4a1e-8b8d-4b184c5e5ede", "value": "1536:32fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxI:mfqhp+g5ru2kmUEt88xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257693, "uuid": "257477d7-db5f-487b-9ffd-faae8b772f7d", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257693, "uuid": "5a07e3cd-4897-4b52-8d57-24f3e5926c7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257693, "uuid": "f536ffeb-0465-403c-a36c-73284df466f5", "value": "catalog-1799345063.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e3a182-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261381, "uuid": "137ae512-7c34-4679-a8a8-2278c18d796f", "comment": "Malware payload", "value": "4eee9822b188ee699cd3170ed83c079b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261381, "uuid": "8134d8a5-55e2-4dac-bf4e-d8b577ce4c30", "comment": "Malware payload", "value": "191c8b8afddb9ff9d91e8cad4ef51927d303ead6548cdda01679041262a2fa03", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261381, "uuid": "b52d3406-9464-4184-92df-99c3adc7f6a7", "comment": "Malware payload", "value": "cfd727b1e9df00c2477db5874d59e23ff77a3e29", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261381, "uuid": "71c9e9bf-2858-4135-bb30-48d72781e40b", "comment": "Malware payload", "value": "de90ef58424d53582b4f76295fbe34dea8803383ea266ded1b32e6000365123deffe9d394b368c6234beb65ee421a432", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261381, "uuid": "72c16bd3-b8a1-4713-9b83-6d14d579a294", "value": "0B33F13547ACC5F66DB6D0BFC8C6F604FBB194A5C4D78B224AF8B1C8B6D02855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261381, "uuid": "a2598b56-0933-483b-a978-2eb70ae84f1c", "value": "1536:IjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXA4E:oB9wzbqtWb08UscYJhnpjyq9qBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261381, "uuid": "440cf742-eee5-46e1-a8a6-595b3fa026d0", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261381, "uuid": "40e3713d-9277-434f-baf2-15fcc3816c4f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261381, "uuid": "9f648089-7970-4d54-b5d7-ef00c7fe6e3b", "value": "diagram-508122803.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c42de1-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262755, "uuid": "c61e862c-14c7-4b99-b297-790c45dd5c40", "comment": "Malware payload", "value": "44ea77560c13d8a4ee770caa80dff490", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262755, "uuid": "b563a6d4-a6a3-4b58-b963-d05d78218feb", "comment": "Malware payload", "value": "191d65df6728c67c15270f0efd84a22557501cc6a55ebf834107b11042f49e8f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262755, "uuid": "f96fda34-8ed3-41c1-9480-f47fedbadaca", "comment": "Malware payload", "value": "dc3f5231e0c66121e0de25397442a9571c6d2fd5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262755, "uuid": "0ef6325b-9ab9-4681-a07d-7cade2387fd7", "comment": "Malware payload", "value": "4fb3a74eb3d332853697c614a8934d1d1c929622614a204e436e6314d08c696c0f63baf658e9e9fd41c7a4511dab0223", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262755, "uuid": "f6bdf963-a593-417a-99e3-d9bcbab25d1b", "value": "643301E09506F08BE319BC58ECAEAD034E7DDD0E473D74A3016AD0875EA1AB5B349D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262755, "uuid": "a57622cd-a33a-4008-977d-7d6a22a85f73", "value": "1536:EXXtg3K7774iXfEz5lnm/hQMOEYus1GpvL0M01+:wXma7774mfCyWMB/4GpD0M01+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262755, "uuid": "ce558970-59c5-4e61-b439-27f13f81dbdc", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262755, "uuid": "9ffaeb5f-6654-4a55-bc34-544a13aa867f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262755, "uuid": "c866afc7-401b-419b-ae09-deab6982426f", "value": "statistic-138284249.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607d0033-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260518, "uuid": "09ac8f40-f94e-4f4d-9cce-7a67a4de4220", "comment": "Malware payload", "value": "9ff01b98d22505d57fa2fe7fc0d75b05", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260518, "uuid": "99c0d725-2eb8-408d-8422-ef796f0d2c7f", "comment": "Malware payload", "value": "192c18cc7ac87eb9f6dac4c1af99b6605a227927cdb682f2c5ae92d5800b53d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260518, "uuid": "6ca48fcc-4bb5-453e-99d7-48b5e863dc9a", "comment": "Malware payload", "value": "541c136dff4f4d58c439593c8ebd2e6da6e084db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260518, "uuid": "d4f31601-c546-46ae-9594-66ff5a5ab9ab", "comment": "Malware payload", "value": "4e6f98f8b9a6163f423cafd6ea5a30657642969e0535edaa77c712c7d02eaa2c0224fe6a2f7300a29aa5b4504f35d5fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260518, "uuid": "4f3ce2a4-7354-4ebe-add3-f1df0cd40266", "value": "B13301314BECC9B62DB2E4AFC8CBF504FBB1D094C5DB86664AF871C8B6941555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260518, "uuid": "d08e8860-8abd-4f6b-acdd-b091b12aa13d", "value": "1536:AjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXPa:gB9wzbqtWb08UscYJhnpjyq9qBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260518, "uuid": "6a69e64d-daca-4a22-8e8e-fbbf537907da", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260518, "uuid": "cc663a9c-3b83-40b7-8190-8432b6154058", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260518, "uuid": "2ded9f95-c4f5-4371-9b4b-00420a5a8416", "value": "diagram-1834266051.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1920309-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264493, "uuid": "21a4dc8a-a944-4b74-ba50-ab4af3cb43cc", "comment": "Malware payload", "value": "564af3113b6ab8d61b4ae9f91f392807", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264493, "uuid": "5c447eb8-498b-4109-943e-a59364ba70b9", "comment": "Malware payload", "value": "1947535c8e96f14bc13c333a7e2218f5951095173b900bdf29a8fc65ed2fb659", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264493, "uuid": "6f257788-f229-42a2-a535-e4d69a00491f", "comment": "Malware payload", "value": "47d27845353516de362ac3f8bc07932ad55e9fe9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264493, "uuid": "b7d10fec-ae49-418a-ac52-2d228389136b", "comment": "Malware payload", "value": "33c0dbae038611561c53010c4160e79fccadc5c3ae67612b92f6f32e73cf46974f3ecfa4427d8f24c747d94c6ddfbe63", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264493, "uuid": "9fd7123e-376e-4457-8cae-f7929f7f705a", "value": "A63301E09906F08B9B49FC18EC6F6E134F3DD91D427D78C2113AC0C79E91AB4A609E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264493, "uuid": "98f941a2-01db-4b7f-86e4-097901791349", "value": "1536:cXXtg3K7774iXfEz5lnm/hQMOEYus1GpyubO:YXma7774mfCyWMB/4Gp9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264493, "uuid": "a591e2d2-90a8-4495-9e2e-7ac25f5b3519", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264493, "uuid": "18418b16-4242-4e1f-9a43-2068148ae004", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264493, "uuid": "98cb2bc0-e2d4-4bdc-9a40-f67717c4a112", "value": "statistic-763160592.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d3e2b1-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261144, "uuid": "0f473952-61dc-4ec4-b7d9-2e5adf5c0574", "comment": "Malware payload", "value": "2905151e98a8b1bc7031f9f0a2ab5c8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261144, "uuid": "e8601e0f-5c16-4c61-a877-96d4bb0f8fc4", "comment": "Malware payload", "value": "19795fd38d18ad8da6cc888dc73e75b48e8a6db0cfc986be2c97fa46c0726c80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261144, "uuid": "9e47538b-527c-4c6c-853e-1e1c64486a5f", "comment": "Malware payload", "value": "1c9e70138697636d985529bf77f1ceb316b8c52a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261144, "uuid": "d8afe7b3-3b43-42a6-be78-3e82150a9475", "comment": "Malware payload", "value": "4342c25d95612ce4901fc1c41742a342b59068af2f506b8425226568ec73e16ad88dec7d92517c28af689174ac4f0854", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261144, "uuid": "ba585bb5-789a-46f2-a182-d9d964017741", "value": "DA33F17147ACD9F668B2E4BFD8C7B504FBB2D49AC4D786224AF871C8B6D11944E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261144, "uuid": "d31d670d-7050-4ed4-833f-b68bbad16d52", "value": "1536:rjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX8n:fB9wzbqtWb08UscYJhnpjyq9qB8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261144, "uuid": "ca1d2614-3872-4fb2-9f25-8d2e44aae3c0", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261144, "uuid": "5eb89134-2528-43b3-a063-9bcd9629a5c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261144, "uuid": "fc8dd886-1d13-45b8-93cf-42c0b9e4d37e", "value": "diagram-342069476.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a307a1ec-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264495, "uuid": "4ac59f0e-0574-428e-a9ad-398d28dfc8ba", "comment": "Malware payload", "value": "f2f7eb4122981e0f42971236f3288d78", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264495, "uuid": "760f29f1-30be-43c5-840c-6c79ffe85310", "comment": "Malware payload", "value": "19af7c02e75ae38a19e31ab5d59f83863604b06181d3bd5cc17aa33f7622df10", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264495, "uuid": "5d237143-47c3-4cd4-9fd2-429a1fc8d34e", "comment": "Malware payload", "value": "e70040efb02694b4ec68719448690e33aab38840", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264495, "uuid": "6220edd8-90ff-4df7-bdec-128faf7482cc", "comment": "Malware payload", "value": "05d3bd5f261d8538cee98f30d106d7d2a25dea312c23a2555d9fb617ca24099fe578d7eeedecc95041485828458a3cf8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264495, "uuid": "82011bf1-86a4-4452-ad9d-31245bcf32fe", "value": "A03302A0A906D087A759B81DDC7AAD078F3DE90A473D6C53013ED0874E729FC7649E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264495, "uuid": "792662d0-322a-4bb5-8aa1-7a2181e36b33", "value": "1536:vXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07q2x5:PXma7774mfCyWMB/4Gp07Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264495, "uuid": "702a7c28-1e8e-47ec-a8a9-c412517f71f3", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264495, "uuid": "e23dcab4-784a-49ae-9623-9c3867fcfff6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264495, "uuid": "42399ba9-484d-4038-b4b4-62da40daa262", "value": "statistic-763837213.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d1b641-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260707, "uuid": "0af48348-68bb-4189-995f-9d69523ebcff", "comment": "Malware payload", "value": "e41c8148ebed91838c6edb1c636da977", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260707, "uuid": "081694a1-87bf-4d26-a337-d8e203f89b67", "comment": "Malware payload", "value": "19bd7eb4a6a883fa9c387a6abb5a04fdebe7543a93b93ad266b6c020f47ef46d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260707, "uuid": "48383d4b-0b78-427e-9eca-fc0ce1212e3b", "comment": "Malware payload", "value": "b2fa5a1a07ccb44c63d673b619e4d0a230ed2a8b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260707, "uuid": "5541d17b-6a50-404d-ab67-b96193780867", "comment": "Malware payload", "value": "6448ba3106aac6894c65be54e8bddbd487ad91c0eefa03d6a3ff28d1b98135acbeeed3502da37d1512af27f1c8d70023", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260707, "uuid": "c30fff10-e2ea-49d6-ba80-fcefd5c97879", "value": "B733F1311BACDAE66DB1D47FC486FA04FFF1C4A5D4EA861685F8B0C8B6D12519E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260707, "uuid": "45d7a71a-27b4-4033-b285-35b20075d179", "value": "1536:OjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67I0L:mB9wzbqtWb08UscYJhnpjyq9qawJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260707, "uuid": "36944bab-06a4-484d-bf68-203ea869cc0f", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260707, "uuid": "b5aab802-d15c-49d9-b319-a3306f5ce086", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260707, "uuid": "94c8b059-0cad-4a0a-ab85-b32449b03239", "value": "diagram-1980875652.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73d8bc8-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256879, "uuid": "f36e1039-ca7c-4200-a0da-7517e38c9165", "comment": "Malware payload", "value": "4a2921513d5d457692f0688679981b09", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256879, "uuid": "a4059dbf-3a2b-488c-9917-f3948f97709a", "comment": "Malware payload", "value": "19cff50b037f0e2120d8c44fe45d73656774b779f5eb2d4c72d31c1a632638a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256879, "uuid": "8178d0fc-232e-48d9-92d8-89878605d4a4", "comment": "Malware payload", "value": "10ee253ba1898451671bf2282498285f0f7e053c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256879, "uuid": "317c1513-379d-40c1-9405-cf6b82b98b8c", "comment": "Malware payload", "value": "c35a41be6b81f3e62b47e38af84d9794fabdef9df6909a853146a42598a1269df607191c67f5677ee4e7e89a032c5e10", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256879, "uuid": "9b1911f0-9dca-4c2c-9fcc-14e49f119715", "value": "1C33F142A654128DCE8ED2EF30F2F9D8E2CEAA4B0E9974C0576E274581574F0082F68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256879, "uuid": "daa3c7a2-aaab-4c8d-9945-17b4073e378f", "value": "1536:M2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIs2h+:9fqhp+g5ru2kmUEt88s2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256879, "uuid": "63952b21-6f27-4a12-9c64-53f13583d840", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256879, "uuid": "f5a9295b-4fa9-4253-9230-d1f2ed07d94a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256879, "uuid": "00bc3d04-5ea1-4b1d-983e-634b309dba61", "value": "catalog-1162932062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfab9894-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261590, "uuid": "86bfb557-79ff-4dec-b945-f28c9706e01d", "comment": "Malware payload", "value": "bc76a6c292619a9e545a895abc1365d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261590, "uuid": "e7869c85-28b0-4000-9f63-734e3e190b61", "comment": "Malware payload", "value": "19d5496920dedb64f8f6e3f7e1f65ffa98fd581e76681d4be66601b9644b48b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261590, "uuid": "ea1ef865-23f7-426b-b09f-2dfb2dda491c", "comment": "Malware payload", "value": "be0874ad643ea1378f3f0d19b5321cacae7247fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261590, "uuid": "de72ea65-4908-4e47-a909-e327e9bf0dbe", "comment": "Malware payload", "value": "ba918b0ba00f44d1c0f18f56857fd33a86e1a0142069ebab27bd0d36d53a54a6ec725292e5f1a8e1c76979c3cc0a3201", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261590, "uuid": "258cb24c-4283-48ac-a53b-f0e53be6e10c", "value": "7A33F1310BACDAE66DB1D47FC486FA04FFF1C4A5D4EA861285F8B0C8B6D12915E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261590, "uuid": "5e493ccb-acf9-4777-9945-ca56a1235af7", "value": "1536:ejfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67u08:WB9wzbqtWb08UscYJhnpjyq9qaws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261590, "uuid": "bed5765f-a918-4207-9853-b4eb762c09d4", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261590, "uuid": "edde4240-ed7c-4159-9705-10a5a1306af4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261590, "uuid": "d1c36c23-57cc-47f3-9367-1f8d84861549", "value": "diagram-655772321.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38e5bca-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259449, "uuid": "580390c1-3a60-4bed-9873-3310c2d6fa02", "comment": "Malware payload", "value": "a7f92cb967ce99d86b126c917d9c871e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259449, "uuid": "dc148dfb-7649-4ebb-9736-42d7b168c989", "comment": "Malware payload", "value": "19e636ce01fe676bec713202a550c2547b807ba19e1c2f4aa6e7a923db69033e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259449, "uuid": "e0227a6c-f552-4c3c-8ee4-519b43dc111e", "comment": "Malware payload", "value": "3eebca38f3c786e0fdbad26cd7f0324abe96dcfb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259449, "uuid": "f4ab70a9-71fe-411d-8169-78251a9d78eb", "comment": "Malware payload", "value": "af0b8c92ade8dd258c4843a3b43730c109c694541cf932ab33d9e42db26e92a608b89a374d4440062ec35a75648abe1d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259449, "uuid": "769da0e5-92a0-4c29-a85b-008c54f5ff8c", "value": "A03302714BACD9F628B2E4AFC8CBF504FFB1D495C4D7862649F871C8B6942859E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259449, "uuid": "e6a8ef0a-f394-49f2-b909-93279de904df", "value": "1536:DjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXI3:3B9wzbqtWb08UscYJhnpjyq9qBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259449, "uuid": "22b7ea2d-e9d8-439a-b045-2187dae65d4a", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259449, "uuid": "f46fd806-f25a-4176-924a-12a2bc81d11a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259449, "uuid": "06d39757-f71a-453e-adc1-7f050507f350", "value": "diagram-1065770295.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25ef189-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258937, "uuid": "c6a2b055-52a0-4873-b8e8-890af482db1e", "comment": "Malware payload", "value": "508e5112ac27ef29231da8c4fa90ab1b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258937, "uuid": "2f8f3bc2-212e-4b89-a7df-a88364fafa0b", "comment": "Malware payload", "value": "19efab7e1612730727959bec05aeeb9a55e7a32fcfba43e539b53c6bebc8d0ff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258937, "uuid": "f694b0d1-b422-495e-a9d3-7bb5cc830a0b", "comment": "Malware payload", "value": "cc53feaa927f4142438c81a78ad17ed7c96e3a57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258937, "uuid": "462eb87e-08c2-4c8d-80b7-080fb4ccf984", "comment": "Malware payload", "value": "96c8921a88c9b27c6c5e8eb06dfdbf98e7eaff428664a1fc8c85bd753c5ff8d29a5700aaf65e4d24b9a248454eaed43d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258937, "uuid": "d0cc0730-f509-4ac2-ac4a-256a49ba438a", "value": "2233F1859268118CCE8FD2DB20F6F6DCF6DDAE470E99B4D0AA2D2704D1520F1492F68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258937, "uuid": "765737c0-8354-4db8-8d20-85aed1b4f97f", "value": "1536:g2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIKF8zDWw:Rfqhp+g5ru2kmUEt88JDWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258937, "uuid": "73d0f091-3f90-4522-9df8-a37f2b6323f7", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258937, "uuid": "e514eef7-33e4-49f5-9890-0018f0d53230", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258937, "uuid": "3fce9a83-2e69-4bb2-8f43-a2f3a8eecfd7", "value": "catalog-696673041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceb37d8-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261640, "uuid": "87b38f13-7160-4897-8f83-ea3f64ef64eb", "comment": "Malware payload", "value": "e8ce6624bb3e06e314ef1a819a30e2aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261640, "uuid": "c4b974c3-9a57-494e-99d9-db86e732ef42", "comment": "Malware payload", "value": "19fd1cbf1fa2bdacddb28c0f74effce99b32ac5ccc14700620caaef28925c5a5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261640, "uuid": "6154ff97-1329-44eb-bdfc-5e1849446768", "comment": "Malware payload", "value": "badcde8b1cf8a34fd48265f1f01c9f6897bcd311", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261640, "uuid": "9c034e00-f9ab-478e-b6c6-8bfba2ab362c", "comment": "Malware payload", "value": "c5b6840283f1c697b1cf1d4cd6e0a6e18ddea8d646bab2ae9d9ba936cfe0da9d897dcbb7fe94869a1f0d805e0808baf1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261640, "uuid": "37ee32a7-94b2-40a5-a43b-983690c0002a", "value": "2933F17117ACDAA62DB1D47FC0C6F905FFF1C8A5C49B861649F8B0C8BAD12659E31E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261640, "uuid": "6321131b-9111-439a-a2c6-c41760ce84d0", "value": "1536:UjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67ZjF:cB9wzbqtWb08UscYJhnpjyq9qawZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261640, "uuid": "0ef1b20b-b246-4122-a4be-1719868a708c", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261640, "uuid": "4aeb2657-6994-4d12-8bf3-07226f27ad0e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261640, "uuid": "03ac6493-5f4f-467b-b008-f93befe078bd", "value": "diagram-695355083.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e43bb5-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621257846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257846, "uuid": "a36bea7f-a689-4ba8-9a1a-71d9f9ba404e", "comment": "Malware payload (AgentTesla)", "value": "6db6427cc97a6d40595b771e38f81e8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257846, "uuid": "79bba3f7-daf4-4467-9a90-4c170060dd20", "comment": "Malware payload (AgentTesla)", "value": "1a0c594c7bd5a51dcb4c2ee8378da927dde04aa4dc87f9d6c800d5489ec04a56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257846, "uuid": "b9673ba9-2a02-4253-8d48-72c7b1138189", "comment": "Malware payload (AgentTesla)", "value": "9d0e90d5c694c3be1fac5e3b7e707ea10c6d5743", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257846, "uuid": "af36e0a6-afd6-456a-8d18-cdf9b7d64b58", "comment": "Malware payload (AgentTesla)", "value": "bfbbecee99932d59e7b008cca1c7dc68afb90c572e839c7550e3092c84a09664905a29aae621aef4d6c9dd18f2954af5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257846, "uuid": "32f04744-7cc2-4599-9601-3e58620f2553", "value": "72A4CF34F8DD511CD777EB705AB2524C635AA23EA26BE5AC0C9E12C109F2702EB91D33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257846, "uuid": "4141bb9d-77ea-49e3-9760-f668af8fa24b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257846, "uuid": "9e0c3de3-68ba-4fd6-b9f6-eb712e17c337", "value": "12288:thfud7Jicdrm0X0Ag9XrKMlmnnwaska09n7:thfC7JiVOK9XrDUD2An", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257846, "uuid": "f659c975-a8b0-4a15-804b-5d96c12cdb9a", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257846, "uuid": "63e3d889-a2c2-43a7-997b-01c93d1573e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257846, "uuid": "f8e05456-3800-45c8-a3dd-976e74f87f7f", "value": "46 import_export.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6929d90-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258166, "uuid": "a3a7433c-f724-4165-9c11-03053b797258", "comment": "Malware payload", "value": "3009e0523f10ea769dc24f069c2a106e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258166, "uuid": "08c2e982-4328-40bd-a91a-bdd681389678", "comment": "Malware payload", "value": "1a10d468959887b52db65202f249aa18652d15efcae63da29a0fadfa23e49aee", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258166, "uuid": "b312c0de-a2a9-478e-86a0-8be9e3ebe4b2", "comment": "Malware payload", "value": "d14b7890b199621660dfa1c0cfeda9a18e761173", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258166, "uuid": "9f9c2bd4-26b7-41bc-8242-c194bf748615", "comment": "Malware payload", "value": "6781bbe9aacb52857f8bb724f2d583d8f9f03c9a683ee1c314e3c1e68b63bbad78e80fe2b0e8a9f9517d36df44848d93", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258166, "uuid": "6c977fbb-9b0c-426e-abc9-a180075c599e", "value": "1E33F186D614018DCE4FE2DBB0B9FADCE1DE7E470EADB4D09B6E2B0581520F1452E58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258166, "uuid": "d742f102-d7cd-44fa-aa0c-37185fd0ba29", "value": "1536:52fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIQJ:kfqhp+g5ru2kmUEt88QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258166, "uuid": "c7947ae6-57e4-41bd-b9f7-53ec1ab67787", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258166, "uuid": "5992670d-d7f6-4e49-8175-a0b59707bde8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258166, "uuid": "39a8d60a-13fd-4b5e-bd74-46c4e30ae028", "value": "catalog-2138674165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf12cad6-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262824, "uuid": "9b764160-962d-43d3-986f-a57d70fcbd63", "comment": "Malware payload", "value": "789fc72e72399e24d60ac3a207444615", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262824, "uuid": "673bc968-447a-42e6-86b0-711c50d02ba9", "comment": "Malware payload", "value": "1a22b3c578ea1bb4eba40f138eb126e65fcba1458db234e4329f43d7414d54a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262824, "uuid": "84d4f59e-3508-48eb-bb39-c96c7a5efe9c", "comment": "Malware payload", "value": "c0f9a6f7043020c812807127c035efc14f155c91", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262824, "uuid": "0970282e-5321-4b3c-b0fa-d34d8bdf7508", "comment": "Malware payload", "value": "93d2c3febff37900f20b7fa015fe6e479b7c9dd1157777374e6e9b8510533f7dc6ffb496052cd84b9e0b0b5ee468a6a2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262824, "uuid": "33148d31-d3b6-4f75-aaad-76789046e04d", "value": "5E33F2E0D801E086A754FC58DCAB9D038F39DE5A473DB853027EC0D65E62AB5F246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262824, "uuid": "2f7936d7-f6cf-46b4-8ee6-6345b6521837", "value": "1536:6XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOub:aXma7774mfCyWMB/4GpCOub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262824, "uuid": "2dbc5610-878f-4d65-950f-e774be81337d", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262824, "uuid": "4dd8413f-8a89-40c8-a835-17431e5da9fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262824, "uuid": "273449d2-b479-4d49-8962-fb489b4bff78", "value": "statistic-1440429009.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d93045-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258682, "uuid": "5abc147b-cc72-4c53-82b2-10648404cc95", "comment": "Malware payload", "value": "37c9121732e13c260c34ceca9182dcab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258682, "uuid": "a880ece7-7f47-4b85-911a-21e5447cb7c9", "comment": "Malware payload", "value": "1a691ea34a52b447e1c1b2d895933974a6e8c9ba452379375bf7aa400fa4f2a6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258682, "uuid": "1866cffe-bb3a-4804-b30f-7849fb307192", "comment": "Malware payload", "value": "7554c190779377f5166cf94ae7bc5f2ea4f4590a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258682, "uuid": "7057cd32-6202-4250-854d-967e9e896ef6", "comment": "Malware payload", "value": "9d625b8d1aa8c5889c5f9f9090aad1115ad1352a586250e6b697c381eaf6fc992e73e0df6fcc4c9fe8030f1cc9115990", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258682, "uuid": "9e6c6c76-861f-4d3f-b897-3a46d2bb1364", "value": "C8330186D264214DCF4FD29730F1FACCE5DE7A430EAAB4D0AA3D2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258682, "uuid": "34baeb9f-239d-439c-9154-9bad5e4bef58", "value": "1536:N2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3H:ofqhp+g5ru2kmUEt88IxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258682, "uuid": "68f2eae2-cec4-42cb-b46e-002c3e2708c4", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258682, "uuid": "89ec84c7-61b0-4833-a3d9-91f3e18a50b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258682, "uuid": "1336c46f-8cd5-46f1-b840-7f81077783e6", "value": "catalog-487829625.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a0af5e-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260094, "uuid": "c3526fc4-1c10-4db0-9b7b-e8c098790ded", "comment": "Malware payload", "value": "588b4c8120395a6bcfbc521cf54b0130", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260094, "uuid": "f2de3058-baa9-40dc-bcb3-0f1eb08b05c0", "comment": "Malware payload", "value": "1a7633a5c32c4b3d6fec286e4b7340e328556a69cea2802bd149af0b24b6c98b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260094, "uuid": "610fabe8-30b7-4508-a755-0bc831d4f53c", "comment": "Malware payload", "value": "0aed7c282175327847ff33e6117162234daf09d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260094, "uuid": "f3da307f-45c6-4ae9-8167-68f0e1be479c", "comment": "Malware payload", "value": "53440ee36c5fc4d98239cb9d3a686a3d25dff1eb9e584982e5c8d5dce942cfffbe65a69e230368c4800a8d2dec79d980", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260094, "uuid": "771f1c6f-aaf9-4924-a48d-ebe3f311ad2c", "value": "BD33F1311BACDAE66DB1D4BFC486FA04FFF1C4A5D49A871685F8B0C8B6D02515E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260094, "uuid": "cdc3a610-5d12-4883-a9e5-d0435bc68af5", "value": "1536:gjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67W02:AB9wzbqtWb08UscYJhnpjyq9qaw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260094, "uuid": "93941e4a-e0ff-4f37-841c-a33a1396b190", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260094, "uuid": "661f055d-9a71-40f7-bc53-61e77249e9d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260094, "uuid": "06f776ad-7e38-48f1-8e9e-5df378d77158", "value": "diagram-1566001612.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a6fcf1-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264201, "uuid": "3b178de1-912a-40e9-82e7-2fcdbcbaa885", "comment": "Malware payload", "value": "13ec4f039ef6f843abc8a10ce1e390ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264201, "uuid": "6dd44cbb-d816-4ddd-834a-20b611b17354", "comment": "Malware payload", "value": "1a8dba327b288aac5747ec1b04b993893d526aafd17c125fcafb15ce87f8223f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264201, "uuid": "cfdba042-1e10-4018-ba8c-6b6b1b6d15ed", "comment": "Malware payload", "value": "35b621703157c4b7f057ea65c81ab84c5efcd78c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264201, "uuid": "45da5d5d-0fa3-4f3b-a68c-4d61b726efaf", "comment": "Malware payload", "value": "1a488d233b4fa1665ba164f6a30ec4734f73cc518af43b5bfabd6346da1208557082572a52ba143bfda8c0f833602783", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264201, "uuid": "8b5b2793-3a4e-4a8e-b34c-1c59937861ef", "value": "F43302E49507E0479748BC2DEC9A9D438F3DE91E033E78D2122BC1D75E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264201, "uuid": "afe95d1c-d103-4aab-b751-169ac5b8f4ff", "value": "1536:AXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ1:kXma7774mfCyWMB/4GpWvZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264201, "uuid": "84ad3713-1e1d-4bb6-a293-2b225332c3c4", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264201, "uuid": "ce5c921d-0cf5-464b-b6a5-3dfc5e8f8a6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264201, "uuid": "37843787-c0e1-472b-946e-e2600b990819", "value": "statistic-556213738.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2d0717-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262712, "uuid": "e4b005e6-529a-4bbf-803b-fe8658bba567", "comment": "Malware payload", "value": "d193e282b761aeef55fe9eef98e63330", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262712, "uuid": "88bac863-e9b5-43c2-9928-8f31d04506c3", "comment": "Malware payload", "value": "1a9f0cb2061b9e81223a1a783b600708926e035d384c9d61f87f203c245dd72e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262712, "uuid": "477aabcf-cbd1-4599-9a4c-c5df8fd43a89", "comment": "Malware payload", "value": "6c71da8fd789131c764f89f08c3cc52ca325284d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262712, "uuid": "8d8b6769-2f79-43d5-880e-6bd2cb985799", "comment": "Malware payload", "value": "4f6287b570fc9b69c0ec372746323cd9a9a2193eea329492dae0745a92b9c15f7d6351a92d47453b22c0be0fa5433fe8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262712, "uuid": "3cb55a29-96d3-4315-9608-9d15fd25c560", "value": "5E3302E0E801A04BF754BC4DECB79D028F3EE91A077D7893116AC0875D62AF5A709E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262712, "uuid": "8d061e4c-1f06-4988-83e1-fa38bf7389ae", "value": "1536:6XXtg3K7774iXfEz5lnm/hQMOEYus1GpjIdgHT:aXma7774mfCyWMB/4GpjIdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262712, "uuid": "d1e5675e-73f4-4ae0-9f0a-f2e851f380b4", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262712, "uuid": "d6f109a5-965d-4992-93e5-1a0fd66eb6f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262712, "uuid": "459bb0de-f02e-44a6-8f7c-def04455b059", "value": "statistic-1342491107.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0933ebc0-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262519, "uuid": "9c431306-c026-4cbd-9cb9-962da8ab56a0", "comment": "Malware payload", "value": "65f32b8051b60869531dc351d5aa1d38", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262519, "uuid": "4863d2e3-b210-40b5-acd2-64fea2b22bd9", "comment": "Malware payload", "value": "1af884f4fc6f7a153c78fb09025bbfd71126c83326b5dc3bc3339f8f172dad20", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262519, "uuid": "a90d052a-a5a8-4202-bc88-ea5b3de51e4c", "comment": "Malware payload", "value": "c14a299c16024097b3a3f5b18e6f4255fdd300a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262519, "uuid": "74d423f4-2b85-480d-bb00-f6350dfe6927", "comment": "Malware payload", "value": "2982a0cb369e6322e5f55548faa9d3b85819c327f37af5dc34feae1db272e3e10dfc0f28594f9a7c12baae767306b1cb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262519, "uuid": "5af50c07-e360-408d-add3-cd217353aeae", "value": "6F33F2E09502E047A358FC58DCAB9D13CF79EA1E477D7842027EC0879E72E75B246D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262519, "uuid": "6dfe0605-12cf-4aa6-9c89-467bdd9fa260", "value": "1536:VXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMO95c:xXma7774mfCyWMB/4GpCO9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262519, "uuid": "db0ce8ec-8c66-487b-a6e4-9d73d402561d", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262519, "uuid": "1335e81d-2f0c-4ce4-a3ee-90b902f290aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262519, "uuid": "828f24ff-bca5-497d-a7cd-9baac6c919ca", "value": "statistic-1219570109.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6bb6c1-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258258, "uuid": "9388c518-137f-4d86-9732-7aa8cddbd1d0", "comment": "Malware payload", "value": "a4bef3e2e4d688c009b959b5c7753624", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258258, "uuid": "62d0d9e1-f2c2-4ca5-81b9-80cacb215cee", "comment": "Malware payload", "value": "1b0acd9a9ea2c6476b19ac46186f97ee8b9bfac86784c39036d5dac7e2d8bec7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258258, "uuid": "c71fceeb-1a36-4525-9a20-12e147dbf0f8", "comment": "Malware payload", "value": "359103644c81c96411a709ba24b3828efecb8b53", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258258, "uuid": "f1addc92-bd9e-433a-a72f-e15b19f4612e", "comment": "Malware payload", "value": "5a931350f15d101f3e1e0ab9c86d80383f9c3abcd00e8aa6502c66d33999363cd30a27a545bbc625d3cc18952acd1332", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258258, "uuid": "97b2852e-d650-4c8c-ab83-22d838c2850e", "value": "CC330195D614118DCE4FD2DB30F5EADCE69EAE530C9978D09FAE2B4895A30F0081E58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258258, "uuid": "0e124138-f26b-40c1-936e-a399a0f76ba4", "value": "1536:g2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIQLNlf8:Rfqhp+g5ru2kmUEt88+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258258, "uuid": "c5433a91-f040-4ecb-9d31-1f75ca88155a", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258258, "uuid": "ca7af613-1aa8-4300-9ae3-9588bf18a30f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258258, "uuid": "0ed7c61a-8c8e-486d-b8a3-96cbdbb4b7ed", "value": "catalog-285510321.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6233f1-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261877, "uuid": "dc522116-f4e6-4503-8d7e-11f903c5ab82", "comment": "Malware payload", "value": "21fb3b8d1e76bb60614d6aa4d2a4131a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261877, "uuid": "25db68fe-08b6-455a-b281-0e2736ea4cbe", "comment": "Malware payload", "value": "1b0b31f6d20c0636d736c640efaabbd37cd35b8c837a5c67c75991d6d95204fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261877, "uuid": "36655be3-4032-4c03-8969-bd5f67eb6306", "comment": "Malware payload", "value": "96c52ad3ebd46c320aafdafcb72ffe42c3b75f72", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261877, "uuid": "90119566-8e3d-4b80-985b-ce68af407c4b", "comment": "Malware payload", "value": "0da4afccf516c35505405408118b3cb0452342d10f92c47cd5189dc23dcb759d3ceb605ddff6614c2528e4ecb88b70b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261877, "uuid": "96105d82-ad18-4205-9eac-2e3f95431233", "value": "923301314BECD9A62CB2E0BFC8CBF504FAB1D494C5DB8A264AF871C8B6941555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261877, "uuid": "6f03863c-5f45-4971-95a7-5b87daf6b75e", "value": "1536:jjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXaz:XB9wzbqtWb08UscYJhnpjyq9qB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261877, "uuid": "fe9c1871-e39b-4050-b8ee-d19d2014d1fc", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261877, "uuid": "d46ada6b-8a8f-48b5-ae21-03f61ce9d86f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261877, "uuid": "91b6461d-e605-48e4-992e-7aac9cd357c4", "value": "diagram-848273857.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d78093-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258935, "uuid": "144340cd-0da3-4e23-8587-9288605bfb8b", "comment": "Malware payload", "value": "3b6660460963971dc07e958a7f2b453b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258935, "uuid": "2b4693c4-c492-431b-922e-74ce9415c28e", "comment": "Malware payload", "value": "1b2d5e4e91eb8bad80c6b6bd143e5d94e75cb4b8b35eef17b3c813384d539748", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258935, "uuid": "19295a9d-5157-41a8-bf00-05b5acb35eb4", "comment": "Malware payload", "value": "a50cd8ad977d02fef64b0ce9a4a10fc0afb9827c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258935, "uuid": "5fe8f9b1-5729-4fd1-bcd3-b5ca131b77f4", "comment": "Malware payload", "value": "54c4710a3a84565bee66c95ddfceff15f533d5b336f097529b24b59722c3762980dd3a0cb7132b01dacb24e1fa7ef0cd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258935, "uuid": "887bfd7b-f21d-4fd8-a473-e850f25698ad", "value": "4D33F185D654018ECF4BD2EB20F5EAC8E59EBE47099E78D09B3E270582534F04D2A2DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258935, "uuid": "cf016233-cbbf-430a-9c34-f5cd74322d1e", "value": "1536:22fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI6iR4:bfqhp+g5ru2kmUEt886h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258935, "uuid": "d828e947-1fac-4d80-b186-9b21d3a05b3f", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258935, "uuid": "9fc188ed-b6aa-43d0-b81d-0edff1ac1876", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258935, "uuid": "77852494-909f-4484-bb26-9b3d43a41e36", "value": "catalog-692499868.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada60830-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257212, "uuid": "80ac87ea-9eba-4702-866f-29e49498e538", "comment": "Malware payload", "value": "2fcc9b7e283d2cc119fe77ae27e7c3e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257212, "uuid": "8e44e182-7c36-40da-bef7-56144f926efc", "comment": "Malware payload", "value": "1b40ff6a956d36b331733f2a1758261e700a49696e1190f1ec18a8a90e19d293", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257212, "uuid": "c66de512-1827-440d-92e4-07f94764b74d", "comment": "Malware payload", "value": "e196f80904d9d038e5294ace865edfb9e4cd1b13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257212, "uuid": "02aafd76-93ee-470c-ab06-74bc52c60d69", "comment": "Malware payload", "value": "bd1fb1dfe84cc18d48f0154bea10a0883fa4d63b4b1db9f3544c08109a0acb17cad25dd1d0bc2dabc68da1f24bb3238f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257212, "uuid": "50545800-d0cd-4310-a4dc-182b61dca86b", "value": "D43302A6E658114ECE4EE29B30F6E9DCE19E6B430DE6B8C09B2E1705C1570F5082F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257212, "uuid": "246ddd75-f060-42aa-aaec-6594d1ed933a", "value": "1536:92fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIBfx:4fqhp+g5ru2kmUEt88Bfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257212, "uuid": "5dbcbfe5-c0e1-4784-839a-9c5f25523fb1", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257212, "uuid": "c3558dc9-439f-4226-b9ad-e3b477bbb9a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257212, "uuid": "47e90389-2c94-4cbb-b17f-3b918b78a193", "value": "catalog-1426824186.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2354ef51-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257838, "uuid": "f69aeb29-98af-46a1-abfb-43f9d8a6c1ef", "comment": "Malware payload", "value": "109d0b22e471718439debc2ccd1c9312", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257838, "uuid": "4d104735-3424-4b31-a028-4618cc78501c", "comment": "Malware payload", "value": "1b65bef3e5dd728de0e116fc8e67e3aead4562bea5a20298a5ebde29b0462ad1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257838, "uuid": "e5081687-3ee9-4fa8-8ed5-63a274fa8e01", "comment": "Malware payload", "value": "ba8992b64a6fad194324ff584db40693ee6dfd1a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257838, "uuid": "d8ddfcae-bd63-483a-87e0-a005cbcec12f", "comment": "Malware payload", "value": "8d1737173f2972f920df74df35c88ca217aba5ad9290358839ea493aa8e21252eb7ced62ffc51e7aa5a6cc7ad98d431e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257838, "uuid": "4d13f9fa-b36a-47f4-902c-ae9eae1528b3", "value": "3133F2919554118DCF4FE2EB70F5FADCD68E7E130DA978C06F6E2B4981830B5092E98B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257838, "uuid": "6e9764e2-cd90-4920-baa5-8a571fef74f3", "value": "1536:o2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI11J:Zfqhp+g5ru2kmUEt881L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257838, "uuid": "9838ac28-baa7-4ef0-94f5-03df218e7e0b", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257838, "uuid": "cb3a2e93-3c3c-4b82-9867-be2cc4e44f16", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257838, "uuid": "8efe278d-9b3c-490e-b827-fd118eea8155", "value": "catalog-1911843477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e6ac6b-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260291, "uuid": "16df26a9-a276-439c-83ed-ec0d1eae962d", "comment": "Malware payload", "value": "a7c83f310c747bf4ee22b27f97d1c0bd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260291, "uuid": "25e680b4-a0db-48d1-ac2b-5b25a12843ba", "comment": "Malware payload", "value": "1b7615649433d4fbda8ff3f55ea3fdb484360c879af25fd7890e1cb3d6f4cc43", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260291, "uuid": "812a8a97-5cc0-48af-95e1-936bc05eb23a", "comment": "Malware payload", "value": "ad847ff9d052c07662fe6ac52a9c2c58b65f878c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260291, "uuid": "cbe22ecd-1d9f-4c53-9f7f-9f950b11b132", "comment": "Malware payload", "value": "6a22c8ca967213b23fddb48a6e5897114b212c2885557de93a34135fb3bb4f2332243d511bc86525c0ddcc514297f543", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260291, "uuid": "fdea5f6e-2d91-4bb4-865b-4a70a168f514", "value": "EB33F1711BACDAA62DB1D47FC0C6F904FFF1C865C49B861649F8B0C8B6D12659E31E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260291, "uuid": "ac93fb8e-ded4-4322-9dbd-d26d0900e2cd", "value": "1536:WjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67l+6:OB9wzbqtWb08UscYJhnpjyq9qawlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260291, "uuid": "f33f202d-8bfe-4b2a-84f0-1d068fb43d94", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260291, "uuid": "efd9bf7b-25aa-4305-a09c-7d469386e5c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260291, "uuid": "dc2797bb-0994-495b-a107-0f1a2505bcfd", "value": "diagram-169547782.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b58c88-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256881, "uuid": "c4937df3-7ee0-4ca2-8742-423ee91b0c00", "comment": "Malware payload", "value": "6184ae3342d4b8503d7a4d8f24b3abe1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256881, "uuid": "e9d5f6fb-9c5c-45c3-9862-76e9e0ab3f09", "comment": "Malware payload", "value": "1b7ae675f02634acd36831fdfbf6f448fdf88dae4f9b9b8fd1ce6df472b1306b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256881, "uuid": "3285e872-7d6b-4550-aa7f-409d056a1e0d", "comment": "Malware payload", "value": "3ee8e35e9714b062d7e59a43120fe7cd25053fd6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256881, "uuid": "1ee10f56-3e0f-474b-8425-e8d67f6885ed", "comment": "Malware payload", "value": "80286dac52eaa3cfa7f0b0008d324ca72a110f1fa521582810d5e6d408bb0194ec0cf96429eca00e42046b8d94600a7d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256881, "uuid": "68f8f943-3d13-4778-8e1c-505360f706b5", "value": "1A33F184D164108DCF4FD2EB70F2FAECE1DEBF43099A68C09A6E2644D2520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256881, "uuid": "4ce7c565-2ce7-4b9b-8d0a-8cb4cb8824d5", "value": "1536:a2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbeD:ffqhp+g5ru2kmUEt88mAbeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256881, "uuid": "4c1caae0-c9d5-4526-9e50-d1bc8a75ea74", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256881, "uuid": "a4b3200f-51b2-43ad-b14f-93ff6e1ab44d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256881, "uuid": "5b75ef08-cc22-43ad-91f9-2ce974c8998a", "value": "catalog-1165403623.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ab63b0-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260716, "uuid": "87edd0ea-9ea6-47d8-8843-022eaa0c0e17", "comment": "Malware payload", "value": "4563a83e9687981a429d949facfacc66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260716, "uuid": "d2f8cd5b-5cef-4fb2-b733-35b385710597", "comment": "Malware payload", "value": "1b928c858a411a1598f28e73551aafd776eb54d2942b80a76fac7c4e7dd921a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260716, "uuid": "77b45f55-997e-470b-a24d-df2e93ed065f", "comment": "Malware payload", "value": "83f677e16df48688c04e76da4b94d4f507ffb925", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260716, "uuid": "fc15393c-2b4f-4d8e-b308-b490cc3f6122", "comment": "Malware payload", "value": "37b03558b6defeb6f4790b5d330c4a7b8a39941400a6f767e93567ed9c63a002d704bad674d5e3ad5ae8494142a172f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260716, "uuid": "3357a262-b526-4a08-ac8d-62ea3b5fbfe7", "value": "FD33F13647ECDAF62972D0AFC8CBF505FBB18465C4D78A2249E8B1C8B6D01855A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260716, "uuid": "a49cb157-ad35-40f7-a8ab-3a8246c4e04c", "value": "1536:ljfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXZR:hB9wzbqtWb08UscYJhnpjyq9qBZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260716, "uuid": "c4d62058-7946-4757-bcfd-fba8e4a1c944", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260716, "uuid": "50b0d350-e578-4cba-8efe-013edbc282f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260716, "uuid": "63c0eaf6-15a6-43b9-9ffc-81af5ee362ce", "value": "diagram-1985096216.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324095d0-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259582, "uuid": "ea729c99-ae96-484b-9a8e-d30236b62d39", "comment": "Malware payload", "value": "b7ae132c23b9734b556302911e275352", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259582, "uuid": "be42b4b7-9926-4012-9cb8-dff30f5edc79", "comment": "Malware payload", "value": "1b96dd636ed7173e4d64c7055a38e89431830398d31b376e76bc481114039350", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259582, "uuid": "dea7e0fb-8472-442b-bd93-bd4a2c8acffe", "comment": "Malware payload", "value": "8a15bfa387c116b7048ffc7f62513a2e631a109e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259582, "uuid": "78e3c17b-54c3-4679-bf9a-48e888217e98", "comment": "Malware payload", "value": "c096c00b0f31bc5ae85343bfa109d7e6df165758d7a7160b2075778b5a210c7b98b0cd9263e88b40562093c99a30f339", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259582, "uuid": "6929bade-bb4d-4789-afe9-c7fcc7da2e3c", "value": "6033F1710BACDAA62DB1D47FC5C6F904FFF2C8A4D5EA861645F860C8B6D42558E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259582, "uuid": "bfac4e1d-8517-478b-8fae-760a373a5928", "value": "1536:EjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q677n:sB9wzbqtWb08UscYJhnpjyq9qawj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259582, "uuid": "5e0c2589-20b3-4c48-9a1a-3533c248c180", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259582, "uuid": "e344143d-8839-4b68-ba18-fdce178e69d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259582, "uuid": "4285e51a-b6fb-4ca7-ab24-9179b2fb1122", "value": "diagram-1164599724.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d4435a-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258883, "uuid": "086c6e09-f527-4a58-a233-3e6a050c9aed", "comment": "Malware payload", "value": "5eb16b565f5e0274ba6918050a3b5fe1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258883, "uuid": "c118b178-e85b-4bb8-9ac2-59164710721e", "comment": "Malware payload", "value": "1bc299923430a0ab23f51d123e84f3a6180b90eb7f9e8e167c0197f0306fc746", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258883, "uuid": "49df3ae7-e89b-47df-82ae-f1ebd74cff6a", "comment": "Malware payload", "value": "7ff84198f9c725eb4560c8a0a9908b588388bdf0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258883, "uuid": "43a9a9c4-7080-45ee-8244-9237f446716d", "comment": "Malware payload", "value": "fbe459f753ca0bc4deb8187b992d10ec21802df363c179110b5e8b4dd3a07180c2384245a64f29e07b50a7460955e5a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258883, "uuid": "30021823-4c36-47a7-a843-cad3efa9d81f", "value": "D7330196E755018CCF8FE1EB24FAA9DCE1AE7E030D9A74D09A7E1A05C1930E1182E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258883, "uuid": "c95e4571-2552-4d5c-a484-202257d9660e", "value": "1536:62fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIyJoM:/fqhp+g5ru2kmUEt88yD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258883, "uuid": "f17aa955-c182-4633-808a-748cc0bf59fd", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258883, "uuid": "2a5a086b-2ab6-4c47-884e-e4116eed3d79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258883, "uuid": "b8f2bd8f-6468-472b-89e5-d6dc035ed847", "value": "catalog-64277273.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0737172a-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263804, "uuid": "fa93cc68-8944-42d7-b984-0ca8d0c73f50", "comment": "Malware payload", "value": "409e8efcce5fd501b641fea1d024e816", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263804, "uuid": "88f89021-a3f6-4ae9-ae2b-e69d03dca717", "comment": "Malware payload", "value": "1be875832c4d7e47560891d5720e9c6c8461eb6f29e30639bdcb0ddec496499e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263804, "uuid": "91e109c0-d269-4576-96be-fe775b97bbd5", "comment": "Malware payload", "value": "7c3ea72db213379139cb94134524be627e2dfcd3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263804, "uuid": "c2975f51-063e-4cfd-89c3-11cb3d2fd6f0", "comment": "Malware payload", "value": "fbd2ffebdef7c11f98a9932ed440aadd7ddadd1044f7be020300efdfbc29804639c385b6232b507510281fb16f20af84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263804, "uuid": "3dc37ddb-66e4-4452-9fe9-79b7f2551dfd", "value": "F433F1E0A502F04BD758BC5CECAE9D034F7DDA0E433E7842457AC08B5E62AB5B749D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263804, "uuid": "ad98938b-cd61-4160-8288-f379dbb09927", "value": "1536:XXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIL8:nXma7774mfCyWMB/4GpV5dL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263804, "uuid": "dae8fe9c-7530-4140-a5ef-78f3b20534f9", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263804, "uuid": "3c53eaa6-41d7-4b80-b5da-d751f690ddb3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263804, "uuid": "4fb1a1d7-8946-43b6-9aca-7ff57f3fa112", "value": "statistic-260481463.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1f8c88-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262767, "uuid": "d295cdc5-35c1-48f9-b60b-0a993fa83db0", "comment": "Malware payload", "value": "840d77439072f4a03843e03abc9875fb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262767, "uuid": "31ec9b2c-60c0-4bd6-9a5b-884660194437", "comment": "Malware payload", "value": "1c0352ea79b39da25385a0c8d4f5b962515d5e69b9bca9048e4af51bff3ce5a7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262767, "uuid": "d50b7f30-f8d0-48d5-b2f5-c32d95596083", "comment": "Malware payload", "value": "329ffdb4bca67c483fccfc1e32e2f3ebb73ce8e3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262767, "uuid": "e6e4616e-4c7e-492f-a5b7-fa10bed206b3", "comment": "Malware payload", "value": "0a98ac1238061e3d25dfa7e10f6690195f04a31b7e15b45aca82c5cee57c40513bcffc2128de325824c9023a2f45786c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262767, "uuid": "4c02ecff-0f86-4a2d-b3d1-fa5b2cfe3f39", "value": "5B3302E49507E0479748BC2DEC6B9D438F3CE91E033E78D2112BD1975E61AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262767, "uuid": "af77be85-27d8-45ca-925b-d3e3ed9936e7", "value": "1536:/XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZg:/Xma7774mfCyWMB/4GpWvZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262767, "uuid": "47cd34c7-04d9-4852-93d4-ecff7cf40319", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262767, "uuid": "853d4542-a3c2-4fc8-b69c-c2880d2fb7f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262767, "uuid": "2218b5cf-75d0-4be5-8ff2-373124355545", "value": "statistic-1403855440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973a73b0-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263187, "uuid": "6225d515-6999-4869-9f14-a0e32d7dfb9a", "comment": "Malware payload", "value": "a0ec53ce75ec0b3ca0cff72e608a7ae5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263187, "uuid": "b202a863-7a8c-48ab-9c43-3f05450d57d8", "comment": "Malware payload", "value": "1c183b7da3fbf9133c57f0e9d6fd19a93c6a4e64734c1afb73061458eb26452e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263187, "uuid": "667b3341-1c62-4046-94ce-9ccc46d0d3af", "comment": "Malware payload", "value": "b4dec29d5ad69ac25a72674144312845bd97117f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263187, "uuid": "195a5cfa-0e58-40c2-898c-3c3cec3d0993", "comment": "Malware payload", "value": "88e455523add1558e91710a03406e675e33ef6c3fe824d8a6cd4474ee14a3afb99db56bbc7fc1a9e405437b7a4a893d9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263187, "uuid": "77ebc538-e4b1-4883-954c-7607d4613990", "value": "1433F2E0D801E08BA758FC68DCAB9D038F39DD59073DB852027EC0D75E72AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263187, "uuid": "b81e20cf-c0e8-4c1c-8b39-c2e1432ab808", "value": "1536:sXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOIt:IXma7774mfCyWMB/4GpCOIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263187, "uuid": "449bfa3b-c164-4ef1-8c0d-02099152ff90", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263187, "uuid": "159f2e67-812c-47ea-b3d9-854d0fecb6c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263187, "uuid": "8bde3e73-d391-4a05-bfca-1a35702d190f", "value": "statistic-1715038447.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee6c0c6-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263737, "uuid": "c739755b-4a70-4fb9-b375-6e166ed06e83", "comment": "Malware payload", "value": "caaad6aa0160a0136f1e77b0d500310e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263737, "uuid": "7f0f98eb-1911-4282-80af-da619e6a0d56", "comment": "Malware payload", "value": "1c29a2b168a2216a7f03105cc8784f8776bb1e5a2f5e201db6692c0eb39940c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263737, "uuid": "9280327b-a3e2-4f6c-b08d-ca7ac049f043", "comment": "Malware payload", "value": "8efb1118620ebcf458bf081c1e80b67e2ad578cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263737, "uuid": "ae1b3c2b-6a0a-4eda-b14d-163db3a775b3", "comment": "Malware payload", "value": "7b48d2cf344484decdeaf81aaf409478271d8280159f4352a056648b265b44f7faa2dc9ae1140835c3d8a5ee024bd628", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263737, "uuid": "81e833c6-7670-43dd-9c90-09a94d37c095", "value": "023302E49507E0479748B82DEC9F9D038F3CEA1E033E78D2122BC1975E61AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263737, "uuid": "051c29cd-3798-40d3-8c4e-1dbdaf72d294", "value": "1536:HXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ5:3Xma7774mfCyWMB/4GpWvZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263737, "uuid": "c996eeb1-fd46-4d27-b51b-4c39d4fdca04", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263737, "uuid": "f3fca271-cf3b-44bb-9c9f-0ef11ebc7ea4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263737, "uuid": "1103b7c0-3172-4a5e-9465-0fc42aa3ec3e", "value": "statistic-2124726741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7937378-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259778, "uuid": "524c5a12-39ad-45c9-8ff6-eb1c24282c20", "comment": "Malware payload", "value": "ca041ecdd4d5dfd0a703db998c29cc0b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259778, "uuid": "9fcd004b-e6c1-45c5-bad8-cda0dedc1c86", "comment": "Malware payload", "value": "1c3931c893c8ecf176d34c8b0ff97e1fa9842e149ac9fef0f4990ab959297649", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259778, "uuid": "6d3915e7-145c-4570-917f-ccf86abe19cc", "comment": "Malware payload", "value": "c82522fbcbfb37fdf7e5c16643795440e7cef168", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259778, "uuid": "e460add3-a1b4-4f94-ac50-07f1902a377b", "comment": "Malware payload", "value": "40d9785554df7f8bbb29ab7798b384e5209a652305237d1c27f9593f70cdf7269fcd266c4babee3acc196412261efeb5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259778, "uuid": "b2513ede-18f3-4a45-9ac3-e4e5a7b7302e", "value": "6133F07547DCCAE66D76E0BF84C2F808FFF28951C987862649F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259778, "uuid": "3a4ba534-9276-4977-8289-ae9ba94e21ee", "value": "1536:5jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w6a:dB9wzbqtWb08UscYJhnpjyq9qEK0wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259778, "uuid": "174476c4-931a-4ca3-8262-0359c96c3e47", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259778, "uuid": "a9c20220-cf57-435d-acdd-6ec755a02991", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259778, "uuid": "5ca5eb54-819e-4a28-8047-f90cc61f0613", "value": "diagram-1330944510.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a86b44-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260119, "uuid": "f06ca684-0785-418b-a785-a44420dc0083", "comment": "Malware payload", "value": "1cfe2016246de8df0d8fea5091f3063c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260119, "uuid": "f66e36e8-ee06-462a-82e4-db6d72e29f69", "comment": "Malware payload", "value": "1c3b6af55158b8998be07b0389a27937e7197e76dcc78c1f2411f71bf409e2ff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260119, "uuid": "e77c1c60-ad01-47d9-bd11-9484b3e48247", "comment": "Malware payload", "value": "6d3ae33b9e2abb7ec13ce06dc1aa6058fe798bdc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260119, "uuid": "b06bab0a-0534-4350-bac4-a7c869902baf", "comment": "Malware payload", "value": "744e32afd70d427a83634ee4aaa71707e7156858f9ab44392bfc490e412fded0b5c5ad2349b3cb671dc222e8e8ab50a7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260119, "uuid": "e7ba225e-ce2d-4885-8d41-88b22f6800fd", "value": "2F33F17147FCCAF229B2D4AFC8CBF504FFB2C469C4D78A614AF871C9B6901455A22E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260119, "uuid": "7e5779a2-e91b-4e6c-ae3f-0d721cf60d95", "value": "1536:CjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX9:yB9wzbqtWb08UscYJhnpjyq9qB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260119, "uuid": "c2ad9272-1ad2-409c-bd7c-f8ad17336498", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260119, "uuid": "f61b1bfa-7fce-4f6a-8d47-c5660117c260", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260119, "uuid": "c13f3457-558e-460e-96f5-49e8fe665b12", "value": "diagram-1577209412.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a558ce-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261387, "uuid": "42b149a7-b3b9-44b4-8455-218a5d8e36eb", "comment": "Malware payload", "value": "356397d00dd843168662bfc3cb7458cf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261387, "uuid": "371dde94-fcf3-4918-a130-42583cbb28c8", "comment": "Malware payload", "value": "1c3cf45bfa8df2b7344a395d20b6dd4c6ffa2ed90bfef9a93daa343246bdfe65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261387, "uuid": "fb57b0bb-585b-43c1-90b1-531f5d72cf46", "comment": "Malware payload", "value": "f5a34a22c3669ecc3f580c9bb2282f4e444d0916", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261387, "uuid": "3e9e7ad1-3942-40aa-bd95-8a1e690631e1", "comment": "Malware payload", "value": "ae6657ac3abd4a12accd05885d246264d6f1cb4a94706117fa906f3039c82b938dce5d51a8c7b2f25988f93d19f5103b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261387, "uuid": "4c2057cf-1f8a-4c77-b6a4-8c8e596785c2", "value": "4933F1711BACDAA62CB1D47FC587F900FFF2C8A4D5EA861645F870C8B6D42658E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261387, "uuid": "2cefd4ff-6311-47d3-afa5-51760075427b", "value": "1536:3jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67nB:TB9wzbqtWb08UscYJhnpjyq9qawB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261387, "uuid": "2ce07b56-38a2-45c2-b75d-36687d112e0b", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261387, "uuid": "5d3a9f5c-4624-42b9-bec0-a4f96c2792ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261387, "uuid": "1fb779a1-fd14-4de6-aeb0-77c7bd8e57e8", "value": "diagram-509418412.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424e0045-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263474, "uuid": "3351ad7a-fd5f-47c1-9177-1c037a975c9b", "comment": "Malware payload", "value": "7c5aca4514475b25f47af5addd2859c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263474, "uuid": "9142dee0-e78a-4c4c-90d6-d014b0b2f9e8", "comment": "Malware payload", "value": "1c482ffc9d7c71c2bfa6733a708af6b601b6643a272198d19b33352e2953f9e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263474, "uuid": "1650930b-12ca-40db-b17a-613c2a8a4c12", "comment": "Malware payload", "value": "2e7894f92466cb9f845e7ad4ba928f5ffb499f5c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263474, "uuid": "f1832dc3-9ead-4fbb-b69a-9a2ac59e5aea", "comment": "Malware payload", "value": "687a50390ba28c01c635402d367e87d6c6438db76dda00e907aaff9442bd65ae3afa3d010153dad3bb58d48e649a6d8c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263474, "uuid": "110fe500-dc0b-4075-8824-3bc7713dca78", "value": "8533F2E0D801E08BA755FC58DCAB9D038F39DE5A073DB852027EC0D65E62AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263474, "uuid": "4a5ad4b2-b837-4f80-af18-53e6586650be", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMO7z:bXma7774mfCyWMB/4GpCO7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263474, "uuid": "a95a87f4-c687-4900-8cfa-af08e0eb9a21", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263474, "uuid": "07717364-6d0c-456b-a7a6-5bf8ec349dd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263474, "uuid": "990bf18d-eac3-4c3f-afcd-e281875a323e", "value": "statistic-1934754823.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92af63ae-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261461, "uuid": "d31e1d1a-eb0b-44de-a5b6-3f0cae4e0f0c", "comment": "Malware payload", "value": "0d2d6f7a344cb09006b214021eef809e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261461, "uuid": "ccb33919-887c-4f9f-abd0-5d32c4962967", "comment": "Malware payload", "value": "1c5a185cd4b25c52aefb4a8ac9da57d293f6c243bbba7c4a48f5a065d6e8edc9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261461, "uuid": "e63a6363-ef1c-4fac-9afa-18fb6483d6ab", "comment": "Malware payload", "value": "2e70cd4f25be99240ef858389278e20d2874234b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261461, "uuid": "13cacbf8-9161-4b56-bc8f-c962650225ad", "comment": "Malware payload", "value": "8c939cbc6caf988ac53b633c1805cc3e6f081e0f5cf43fadcce6c1558963362eaa87cb39c58c18f4ce6c69667c2b5a4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261461, "uuid": "ca4650d4-4165-4ace-a165-622facaa37c9", "value": "6F33F07247DCCAE66D76E0BFC4C2F808FFF29951C987862645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261461, "uuid": "82472046-54b8-4466-8d65-a5bf77fc4f28", "value": "1536:YjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wap:YB9wzbqtWb08UscYJhnpjyq9qEK0wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261461, "uuid": "b9b28ac5-74f2-4cf0-96ab-97009a282ae5", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261461, "uuid": "83694201-6350-482f-b9c4-ceb8e7589ff1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261461, "uuid": "3e6e0779-c18e-46e0-901b-0babf984fa6d", "value": "diagram-560106016.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e4a9ac-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262787, "uuid": "d99aa5d9-3652-4bf2-bfb7-d98cb85f48f0", "comment": "Malware payload", "value": "5c99df6a5b3b01b18baa747226669b66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262787, "uuid": "ef2e61ca-3696-4da5-9b44-11d4b937d458", "comment": "Malware payload", "value": "1c5b64fd9de18e9f0922878492c1b2bee397d974b437c88f8aa57ae8cb33f2f9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262787, "uuid": "5b38169d-c6f4-4748-a0cf-aebe8fdd4725", "comment": "Malware payload", "value": "74d64cd2b027de8c8286a8038fa178b6ca135f62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262787, "uuid": "8b186ab6-f027-4d38-805e-12ec217caa14", "comment": "Malware payload", "value": "95a86afaa84d99c868c602314d23b2fe6978a8c14e0bb50f8063cfaf8d137bfa51891e530cd5217dc16d675c5bdd4423", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262787, "uuid": "7fb2b96b-3baa-4a59-928e-520b0cc3efb6", "value": "C633F2E09506F04B9358A85CECAF9D034B7DDE0E433D7893423ED0875EA29B5B64AD2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262787, "uuid": "39c31bab-3d46-4a4a-83c5-b09727d4704a", "value": "1536:9XXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIN:pXma7774mfCyWMB/4GpV5dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262787, "uuid": "cc45a867-936d-4fe6-ac87-a3c10482f0bc", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262787, "uuid": "e2252d16-a69b-40e5-b9b1-fb68570903a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262787, "uuid": "6b2185ca-6558-4315-8207-eb81a6e48b18", "value": "statistic-141564003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedf9825-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262878, "uuid": "553f3d03-587f-4ce8-9d66-dd6e4a9ec9dd", "comment": "Malware payload", "value": "3218bbea1fa5c0c41e15c88181097922", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262878, "uuid": "f955a1c8-c447-4417-a758-3766a5157942", "comment": "Malware payload", "value": "1c96da5a7ce0910cfb6b36b80dae2b1f1a201d1902b7471cf62a90dd2f47cecb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262878, "uuid": "6efacbb8-0885-4033-9694-b04420628de7", "comment": "Malware payload", "value": "78efdea1a3db1f92e1f140d4c3586a36599d17be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262878, "uuid": "0b00f092-fb61-4708-b8a7-e60f203b99cc", "comment": "Malware payload", "value": "c24f2dbbbadabbb50a78260857cd76cb4c6b428b08f0b8614fcdad88abb587f47831cc458e143a5439ba7b080dbd590e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262878, "uuid": "98cb44de-5df3-4196-9551-34b8cbe1e554", "value": "1D33F2E0D801E086A755FC58DCAB9D038F3DDD5A073DB852027EC0C79E72AB5B64AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262878, "uuid": "2f8bff11-4011-4e75-ba49-98b6e4a853a8", "value": "1536:HXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOqN:3Xma7774mfCyWMB/4GpCOqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262878, "uuid": "050f2dd0-adac-4600-9f46-39f3994e2acc", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262878, "uuid": "75ddd93a-496d-417c-af4a-7535dc3a4491", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262878, "uuid": "b0bf00c7-eac5-41f1-97a0-7e4f2715ab58", "value": "statistic-1472180133.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a35b93-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262639, "uuid": "70c95856-96e1-416e-b30e-6dcbd52170a9", "comment": "Malware payload", "value": "c81df779d0c7772bf03b15a8f305fb1d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262639, "uuid": "b2ee8088-6182-48cd-818d-f6464e0a0b3d", "comment": "Malware payload", "value": "1cc82d38ea6f450bc85d76decf58a7feec5f6b5f6f7c77760764da663b4f736c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262639, "uuid": "d6b69d06-f3fc-4bfb-a59c-8a174d12d6d7", "comment": "Malware payload", "value": "c8e3656e8b5dc1aa5b87f9d2cdc570926045ca76", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262639, "uuid": "815244df-0df0-4111-b0e0-836520f4de91", "comment": "Malware payload", "value": "677e5214c3567d91bcfe0b2def101f3fd533908590957dac7b67e5a1f2de8a23c4bd219f1029d74effb4e41cca0d5f27", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262639, "uuid": "b90ef882-2bfe-445d-8f52-f05ef04d381a", "value": "B133F1D0A905E08BE349BC4CDCAE9E134F3EED1E463DB992023AC0875E61AB56605D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262639, "uuid": "b47ce5f8-f07a-435e-ac9b-48956770642c", "value": "1536:iXXtg3K7774iXfEz5lnm/hQMOEYus1GplIt16:yXma7774mfCyWMB/4Gplg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262639, "uuid": "2eda542f-8736-4dc2-8eb7-09958159654c", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262639, "uuid": "29ccedc0-00e3-4efe-a298-43d2df2b889d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262639, "uuid": "32fe4645-6daa-4af4-97e9-13cfbe508cec", "value": "statistic-1307754400.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318b538a-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262587, "uuid": "998d7511-e823-47ba-9a14-8842b56722e8", "comment": "Malware payload", "value": "ac157afb668a7909245d77b4e072c480", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262587, "uuid": "72c77879-7c3a-403e-a2ea-b795c1151426", "comment": "Malware payload", "value": "1cf2699c0eaf623f1e6e5349f5df5fb34248a32ab318c8a1c5bd9fadf6495017", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262587, "uuid": "cdef7f94-f5b7-41fd-9dd0-f590921ec977", "comment": "Malware payload", "value": "0aec71c9bb7549ee86f9a08e697d2a2030cd0ab6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262587, "uuid": "21980350-0967-4030-906e-eb4dd4740042", "comment": "Malware payload", "value": "243618bdc388a4d922610bd43d4eed24a2fa6bce7798fff51e9f9570a2d46d8c881381d30d76d8af39c0e6ede72e9b9c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262587, "uuid": "366d4c61-0a1f-4793-af19-f5d73b0722c0", "value": "B13302E0A902E087A7597C68DC6E6D079F3CED0A433DB853112ED0874EA15F8A745E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262587, "uuid": "6e079582-f6f4-4596-88f4-fc3c2f30776b", "value": "1536:6XXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qAW:aXma7774mfCyWMB/4Gp07g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262587, "uuid": "e671c9f2-a77e-453b-a90d-eb4e30e34eb1", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262587, "uuid": "3a676406-03f4-4e94-a1dc-81e5af85d10d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262587, "uuid": "c6a1b925-0c40-49f5-bbf4-b8760783973a", "value": "statistic-1273205512.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05299c3f-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259935, "uuid": "957199ae-1948-4fb6-a96a-ddd336e2b1ed", "comment": "Malware payload", "value": "9c9ccd24013767918a60c3cbe4b1d50f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259935, "uuid": "d40fc977-fb8a-4cba-baee-9582bdb64c52", "comment": "Malware payload", "value": "1cf6c2cb274eb6970011e1af812776abcc4c9a638dac143832efea0edf164887", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259935, "uuid": "271574e3-53f5-4cc6-b6f4-b6a8b68af900", "comment": "Malware payload", "value": "7ed6a0beb22d9d39bb1751f931a3b1e84287e420", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259935, "uuid": "3842ed85-1fe9-4b40-b9af-f7511758597e", "comment": "Malware payload", "value": "089b6fa788196f76517fd7dd7fff7c130046c88486a3fd0d1a8d94cc402a456f501e265cdaacd4a9c6848a68a55ecf0d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259935, "uuid": "e936e6d5-a89f-45e8-b62a-8d469725c120", "value": "9233F17547ECCAA76C72E1BFC4C6F845BFF29421C897872249F9B1C8B5A12564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259935, "uuid": "3da53f8f-74ee-4086-9d62-138a143dd280", "value": "1536:CjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wC:yB9wzbqtWb08UscYJhnpjyq9qEK0wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259935, "uuid": "48be055b-a48f-4986-9b1f-d14c65240079", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259935, "uuid": "7e40349d-ade1-4b45-a0a4-f9f6a5220392", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259935, "uuid": "c7bbe77b-33c7-43b6-a333-b4d33fc95f16", "value": "diagram-1467303961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3c3a54-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262981, "uuid": "408d5b5c-0e40-4fe7-92f4-8b3ab0410512", "comment": "Malware payload", "value": "7e46f8cc696bf88b074271297fc56c8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262981, "uuid": "80144de5-a91a-4477-a518-781320a4a6f4", "comment": "Malware payload", "value": "1d00b4bf733a2e4b4766eaf221eb17970988fbdb36b7a09ffa03b9352d7ad619", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262981, "uuid": "9957d4b4-cb80-4d57-9f8e-e578c260ad87", "comment": "Malware payload", "value": "c10cd85cb68dc3149b82bc834f0c6ae5a2292858", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262981, "uuid": "09452fdb-ee27-47b9-943d-c545ffc0303b", "comment": "Malware payload", "value": "34775897782eb0464232b659ebb2cea04f9e02902030c5184b41808cae6580ae3d7a32759276cad6a55d30c367ad1657", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262981, "uuid": "cb2ee47b-5848-48fd-b3e4-84ba98f4e828", "value": "143302E49507E0479758BC2DEC6B9D038F7CE91E033E78D2122BC0975E61AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262981, "uuid": "fdcaf54a-d137-44d0-9141-cb4d5180c16d", "value": "1536:3XXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZj:HXma7774mfCyWMB/4GpWvZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262981, "uuid": "274bdfbc-b75b-451e-9f81-9512b5656aa0", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262981, "uuid": "3665b7a0-d37f-4808-80ab-304df231c4fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262981, "uuid": "a5457ce6-a1bf-4428-9914-56fd082ecabb", "value": "statistic-1536678474.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67792a25-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262248, "uuid": "058f52ce-871b-4e13-b0e2-9e0fae648b5f", "comment": "Malware payload", "value": "241b53bf93bd1c9ab182c2cb5442d550", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262248, "uuid": "9717fdb8-d383-4e66-864e-0f0f0cb2168e", "comment": "Malware payload", "value": "1d13d1a6d0ec241fc3301fb0fe0ce30d46d08820f32345a7ce96286cf60677b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262248, "uuid": "5503241c-3b50-4f9c-8d02-269131ef96e5", "comment": "Malware payload", "value": "947cd6ea245d52c6052cbd0a2e280644edc21eaa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262248, "uuid": "6a50e6b7-f041-4cc0-9d0d-01f99ba88275", "comment": "Malware payload", "value": "7eb8d0c9ce056fa892291cdc147a8ee476f7f92f92859fc15da35ae3ca40e0ec046f630b10053cd65740c6aeed77a903", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262248, "uuid": "3cafbe9d-383d-48db-8da8-295afbd5c3a2", "value": "7333F1314BACC9B62CB2E0BFC8CBF504FBB1D495C4C78A664AF871C8B6942555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262248, "uuid": "05027429-fe4e-4dc6-afff-5846b183c12f", "value": "1536:bjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXog:vB9wzbqtWb08UscYJhnpjyq9qBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262248, "uuid": "9118ac8c-a6a5-4df0-ace3-b7cfe77e2088", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262248, "uuid": "954ac917-573a-4303-8d3c-c1e8653eb3b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262248, "uuid": "d291e051-237c-452d-ae90-b12d086e411a", "value": "diagram-998871022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3660afa0-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263454, "uuid": "749646a0-b310-40c7-96d6-d13e39a2f4e3", "comment": "Malware payload", "value": "103c5bf2c7de633d0d95a389a5afd6af", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263454, "uuid": "8695578e-9b86-472c-95bf-89e555b624dd", "comment": "Malware payload", "value": "1d1992a707f3e962253615be70e334d6631089a50f6f4cb57bc0257f5c78ec85", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263454, "uuid": "c0f822f0-db0c-4d24-be49-203af718471c", "comment": "Malware payload", "value": "150bebc68c0516b8db8e062bc108d73ca8220042", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263454, "uuid": "5e91769f-dd4c-4b0d-9dd5-16b239bed8e9", "comment": "Malware payload", "value": "73257348256f740afcdece74bef7a9eb16e8546659cd35f2be04d9b82988220aa52ac9e4b6b9bb3bf705305f8fe7bc29", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263454, "uuid": "cc85633c-ab4e-462b-b417-0a531b8d98f4", "value": "4833F2A09502E047A358FC58DCAA9D038F79D91E477D7843027EC0879E72EB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263454, "uuid": "7db14ce2-d4ae-4595-84c2-6b4507b49a61", "value": "1536:uXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMO95S:GXma7774mfCyWMB/4GpCO9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263454, "uuid": "cb3871d4-02fa-4361-9f59-33407c070f4b", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263454, "uuid": "86c2fb23-43c5-4acb-acbf-4788b7f47792", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263454, "uuid": "df188f3d-06c1-41fd-a75b-1b1929a6f765", "value": "statistic-1907296952.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0ce214-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262497, "uuid": "024ce80b-e2c1-468d-82d1-52ef314434ac", "comment": "Malware payload", "value": "6b868aa874143e9f74f3c066124db5e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262497, "uuid": "6af49f91-58bb-46b2-abd1-d3c5c32dc331", "comment": "Malware payload", "value": "1d2768d7065e80044c7080adf55def499995033a21a220c4b90bb1dbc6717d52", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262497, "uuid": "86e5aa2b-aff2-45f9-8e3d-60d458e48570", "comment": "Malware payload", "value": "af2821aaf97238526a9435ab7f40e7e0d6b14db6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262497, "uuid": "e9930f7f-97a4-4f1b-b57d-c38a364110b5", "comment": "Malware payload", "value": "58c130819a004b6649959d1335510f526b70f59f2462354edb21677cfae26a47ed65bb95bc657c7a52cb911e12f2ff34", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262497, "uuid": "742c85cd-6cb2-45f7-958c-73a630d9148c", "value": "8D33F2E4A507E047A349BC5CDC6A5D038F3DE91E433E78D2022BC1974E62AB6A645E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262497, "uuid": "e0accc07-cd08-44fa-926b-a8f3632cc17c", "value": "1536:TXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZfo:LXma7774mfCyWMB/4GpWvZfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262497, "uuid": "62eded94-5c4a-4f0d-836a-298a51b851f2", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262497, "uuid": "b2e9f0ab-0de9-4c2c-bccd-fb8eac830cd2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262497, "uuid": "35af43ba-d98c-4b8e-8ad3-6912b2c71920", "value": "statistic-1207033324.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b346a442-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260657, "uuid": "cbcdd15d-e8e6-46f2-9e40-be0510d4f9bd", "comment": "Malware payload", "value": "1517d00298777444fe00800dcf49a584", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260657, "uuid": "dd6ff6d2-82ab-4006-a0de-ae34c7e51441", "comment": "Malware payload", "value": "1d326684b5e0ff806499442225c815202531f9b574e72770014b2ee7b2582334", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260657, "uuid": "68300bb0-2405-477a-b0b6-31bf1d300d57", "comment": "Malware payload", "value": "bc5c5eb9e7e42ca50f87783b20f9c1487b594763", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260657, "uuid": "0c5d68cb-4f8c-4a8e-9d51-c84d84370b09", "comment": "Malware payload", "value": "38ba4fba899bd27dcf854b5e9505921a142db00ac8643cf99de269cebfad0b3730a58d9d994b969a753936d3b7d37f65", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260657, "uuid": "b674fd00-d55d-4a2c-879e-93664feb28bc", "value": "F033F13147ACDAF62DB6D4BFC8CAF604FBB19495C4D7862249F8B1C8B6D02845E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260657, "uuid": "5e031adc-f793-4418-aa3f-08dc23f0915b", "value": "1536:MjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXu41:0B9wzbqtWb08UscYJhnpjyq9qBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260657, "uuid": "b9f9e074-f32d-472f-9adb-2ba0a39150b0", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260657, "uuid": "8e114ad1-f884-48e3-9592-b50749ec02f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260657, "uuid": "2a16d9b9-1f1e-4bda-bc7d-bcaed01e0359", "value": "diagram-1954331405.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665a6ca3-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258380, "uuid": "9f90164c-44fa-450f-b0f2-7e28c9506dd2", "comment": "Malware payload", "value": "5c24ad7bb92e3767df65c6c57f6fd56f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258380, "uuid": "b2497277-6eda-4e20-9e6e-2a78c9397efb", "comment": "Malware payload", "value": "1d6bd1a8ecaabb1535f1d9539712d3f23adc2b77670093c0cb6387a5bdd0faae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258380, "uuid": "795863ac-0ac0-460d-8639-b90d180522d8", "comment": "Malware payload", "value": "7c0ecb94591896da7c8c0a39161b48a0180454ff", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258380, "uuid": "6e06a501-7b08-4a48-bf25-2df4d11cd9a9", "comment": "Malware payload", "value": "79eefdc4ef43c1bab5639c479d261ce42a7bd4d4efa18d5c46513684bc303b874350ddd369b64e5fd3ee94dfdd6df160", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258380, "uuid": "fcdf941f-b8ae-4c99-b7f8-e5c5aa00efb4", "value": "C533F186E554218CCE4FE1EB20BAFAE8E1DFBE53099D74D0966E2B0196430F0492F54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258380, "uuid": "4791f1e9-a47e-4c76-b333-0240f442681b", "value": "1536:o2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIFn12:Zfqhp+g5ru2kmUEt88Fn12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258380, "uuid": "402825cd-d225-427c-bbf4-f7545076d20e", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258380, "uuid": "3087a1d9-0bd7-4127-b110-5ce233df4e30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258380, "uuid": "8e65cc7b-6ac4-40d4-880c-c4974c4659dc", "value": "catalog-387012064.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267a07f2-b6a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621209740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209740, "uuid": "f1961bd8-e753-448b-ad45-5b3699d6cad4", "comment": "Malware payload (Dridex)", "value": "9cb7c71af2c2ee3c1354ffea5c088b8e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209740, "uuid": "632350fd-dcfc-4d3b-a233-d2080d669d1b", "comment": "Malware payload (Dridex)", "value": "1d72bb9f5f70e4d0c95a97078b3107833a72b4f7e28348f6e9531a6adea53796", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209740, "uuid": "dceb5cde-155d-4e19-94d0-c29dce825d85", "comment": "Malware payload (Dridex)", "value": "47799c9277dee3934c5c07e62591e53ab9c06315", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209740, "uuid": "b101185b-098f-41b1-94c6-5a31191c25b9", "comment": "Malware payload (Dridex)", "value": "a3e445c88d75fd32f1debc6485888c9d15e97b6f22c2a1681ac3d7406089204ee1711bf2e33cc662625558cf3b4b1b17", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209740, "uuid": "17ed183c-9fb6-41c4-bbe6-22bca12879a0", "value": "B4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209740, "uuid": "97942c17-1a8e-45dd-bf21-dc6351c7e2b4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209740, "uuid": "1fb5f6ae-90f2-4554-b88b-1470530f627c", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621209740, "uuid": "9e8f8450-3c24-46fc-819c-948c0769708e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621209740, "uuid": "35a46a46-73fb-4eb3-8e58-418c3019f2a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209740, "uuid": "82ecd980-6fe0-4854-b87c-00adb11a39d4", "value": "9cb7c71a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8cd871-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256938, "uuid": "1ae52eec-734e-40b3-bba9-d258f0a2526d", "comment": "Malware payload", "value": "f92d1d02a19673750b710f8601582ef2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256938, "uuid": "029459fc-597d-48d9-97cf-29cd2d56116c", "comment": "Malware payload", "value": "1d7de7bef8f36a64262692c2a3925a06c35b1298170517d3d928d2e91f9eddd0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256938, "uuid": "88da5126-6dfb-4852-91a1-3e4b3b525c36", "comment": "Malware payload", "value": "412b159aa3029d0b6f4604153855675ce87a7a52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256938, "uuid": "5587d568-4cc9-41fc-b671-0f9194f7cccf", "comment": "Malware payload", "value": "e48886fd09777db328d52e41d4d09f71df587db689848310df2940ff4af76574f96bf2e9c997dc2520bb4d944d1ac121", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256938, "uuid": "8d1c1534-6e9c-4c22-8b27-38886c497783", "value": "09330186D264214DCF4FD29730F1FACCE5DE7A430DA9B4D0A67E2B0581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256938, "uuid": "bccdfe43-bb38-4594-a807-f93b83966e27", "value": "1536:p2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3E:0fqhp+g5ru2kmUEt88IxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256938, "uuid": "cf872962-d587-4eca-87a8-b22c652b0ace", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256938, "uuid": "9d02d4c5-7c22-4000-bb5a-92402cd44624", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256938, "uuid": "f63b289b-6752-4dee-85aa-7a9ce58c2a1f", "value": "catalog-1222285578.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0c6e99-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261774, "uuid": "eb8db6a2-cb29-4135-a487-a79825e565e4", "comment": "Malware payload", "value": "3c2bb0b150687b51b7a0eedbde690028", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261774, "uuid": "435466b1-8183-452c-bbf9-b102bd4f3be5", "comment": "Malware payload", "value": "1d89291e5ef37b1b3c1ee21d75bcd222eacb848fcd87d4051620e3a03c716b53", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261774, "uuid": "0767b648-ccc4-4f62-83f4-77800cedcd20", "comment": "Malware payload", "value": "1437c7777b00c33674bc58039a8cd85a9b2e8af3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261774, "uuid": "d9c8b425-f3ea-4bc2-9dc3-ad4937344a21", "comment": "Malware payload", "value": "8d9a18a1cc9f442e075c370dd55ab64ec2a4fdbd28ec84fb54557b75ad82c677b8aff763b377ba8675867ae3781b19da", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261774, "uuid": "14c3c047-8d71-446a-a8e5-9bc0bddc2972", "value": "9C33F17147DCCAE66976E0BF84C2F808FFF28951C887872685F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261774, "uuid": "7937ed03-cd13-488d-9e42-943e43f0b3a6", "value": "1536:ojfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wVH:IB9wzbqtWb08UscYJhnpjyq9qEK0wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261774, "uuid": "6e31f8fb-ebe2-46cb-b197-b81a97bd1540", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261774, "uuid": "017a64ae-57e7-44f8-9c32-d11d0607b027", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261774, "uuid": "fdb17d07-c69c-4580-8f13-106d9b28c30c", "value": "diagram-781740349.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f983a9-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261635, "uuid": "d5c24af4-3bcc-493d-8237-12fb72b1e9bf", "comment": "Malware payload", "value": "315bda78a4a501517b71f5ca41edf6b9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261635, "uuid": "209bded6-ec60-4f46-81e6-4124bcd5296e", "comment": "Malware payload", "value": "1d8b8e6bd89ea7f2e6d94b1bfe7ac4cf2589d2818cd7399dc1ffeb18cf46cf33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261635, "uuid": "78581256-c293-45bc-8147-12c1bc2dd27a", "comment": "Malware payload", "value": "43d5268706c45f1a3a5683e8f3ec012b525713b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261635, "uuid": "23bfb2c2-cd15-4c8d-9ae6-978407f9adad", "comment": "Malware payload", "value": "723903f6020c73c1e4fae4a22ba05e187f0cc1b1e10f7c3e26e6aa06c947697b4c73238f997d05a28b5fb333e3d28f6e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261635, "uuid": "692b351a-c9a3-4610-8ccb-ec1e68a06d2e", "value": "C233F17547DCCAA76C72E0BFC487F845BFF28821C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261635, "uuid": "fbfacb20-a972-425f-b1c7-19a5e3bc960d", "value": "1536:FjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w4:BB9wzbqtWb08UscYJhnpjyq9qEK0w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261635, "uuid": "3da64284-ed1b-48f9-87d2-b4f1f762ded6", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261635, "uuid": "f6ff3bc5-e506-4666-bce5-e62dd0ad89e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261635, "uuid": "7cf91658-938e-4912-9d65-466e1a4fd118", "value": "diagram-678904267.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2534e8f-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263769, "uuid": "1b7c0682-c644-4783-9ed2-cab04008b826", "comment": "Malware payload", "value": "1bc809018d8fef5ba5f6b19cdd13123b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263769, "uuid": "b704a987-7a5c-4eaf-ba98-de968151a916", "comment": "Malware payload", "value": "1d9930b7c73829d79ab234b1bc5de50325702b2a11c445e206d9a7852623065a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263769, "uuid": "e8dc435e-b52a-428a-bbda-1d5c58ee17a8", "comment": "Malware payload", "value": "634ccd49570a8cf7ef55724090eb9a9ab3291b5e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263769, "uuid": "53ab8e5b-13ad-4b83-ad21-d39c408f29cf", "comment": "Malware payload", "value": "8702d870a2f24f13cc53adaef4453462b824bee40ad81ba26aa45f874c491f4b89a99229ba303be7d149802438f1367e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263769, "uuid": "40373ff5-6480-4b41-b2ba-ea7eca887151", "value": "F73302D09906E047A75DB80CEC6FAD038F3DDA4E47BCACD3127AC0879E61A756249D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263769, "uuid": "92db0eb4-4278-4b4b-b884-52ee5249e2ab", "value": "1536:sXXtg3K7774iXfEz5lnm/hQMOEYus1GpFYw:IXma7774mfCyWMB/4GpFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263769, "uuid": "33ac5313-958e-447d-a3f2-67d41213aafe", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263769, "uuid": "33bd58a2-dea2-485e-b046-fcaba4828811", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263769, "uuid": "0971fce0-5b27-44fb-b16d-de5a7673c75e", "value": "statistic-223497457.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569fd9d3-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259643, "uuid": "3c4a1a50-b9eb-4706-85d6-364ba0e26bf8", "comment": "Malware payload", "value": "d52fd72dfdc7f625e637fcc4ea4a28fc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259643, "uuid": "5e6de293-a105-4e94-95c4-94d82a4af6a9", "comment": "Malware payload", "value": "1dab1e3e7a7db47860f20b34617543db1b001af1ec784cd10ac213075c3d1045", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259643, "uuid": "1830e7b5-7cda-4065-919c-35fc614f2fd0", "comment": "Malware payload", "value": "1250e9e8bddb273ec76759c81714e9f7fe2e0379", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259643, "uuid": "a3f88ae2-80a1-45e9-a8e3-8ee66a412977", "comment": "Malware payload", "value": "62ad3f0bf536176672d67bdd4b02b30af785193f7e9832d8490947da32e66e4f27d5fdcda05b128ca759c32176b6bda8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259643, "uuid": "bd0c12ed-9dfb-4713-9aef-55f1729afa76", "value": "2D33F1754BECCAA76C71D1BFC4C6F845BFF28421C897872245F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259643, "uuid": "0011aca2-4164-4634-8ef0-cc95bbfce32f", "value": "1536:RjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wW:VB9wzbqtWb08UscYJhnpjyq9qEK0wW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259643, "uuid": "8a68d485-57e0-4383-8c65-b368deb028a3", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259643, "uuid": "7c5c2f74-f485-4ba9-990c-735f8a035df4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259643, "uuid": "2a35465d-e77e-4dc3-a674-ac4ccc6e1012", "value": "diagram-1211925916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8fcb4a-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262495, "uuid": "7a86889e-c517-4f36-8906-fa096cb51978", "comment": "Malware payload", "value": "6aedba22ef5d8aca3cc13ddc56ab3b19", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262495, "uuid": "32fea182-240b-4f0f-8ad5-2d801a34d544", "comment": "Malware payload", "value": "1deabe7e439ea3ac6cd5fe70ae33f84bb97c09f0ae2a02625a0a26d93c724ac1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262495, "uuid": "2096ac27-c979-4169-8dce-8d53b3a0bbaa", "comment": "Malware payload", "value": "ce74d9531720e61b3bd9e941a7876e5b9132ab41", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262495, "uuid": "70e02e8f-ea7f-4aab-ac9d-83f9acb98e7c", "comment": "Malware payload", "value": "5c4f9ca70ba7d44e4dfdada43c5862ceefa69cd08c81ce35438fb6816fb7d6fc0af6a00b065548ecf238ecdac750b409", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262495, "uuid": "a77276a3-617d-4876-9ec1-608e8f8630e3", "value": "8633F1E0DD06E087D749A85DDCAB9D038F3DD95D067E7882013BC0835EA1AF5A645E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262495, "uuid": "adf45692-bb48-4660-ab53-7726a6596e4c", "value": "1536:8XXtg3K7774iXfEz5lnm/hQMOEYus1Gp/BuOxh:4Xma7774mfCyWMB/4Gp/EOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262495, "uuid": "da68c155-0301-4cd9-9b9d-a1766ffd0e67", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262495, "uuid": "f3cd18e6-4db9-4384-a6c3-4adb11f55c30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262495, "uuid": "9b05fbac-1bff-4c0c-b9f5-20df1d34d830", "value": "statistic-1207031834.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4317f77-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257706, "uuid": "b1a9cdaa-48ad-4140-ab4e-db17934401ca", "comment": "Malware payload", "value": "3390eb1fcef4163d23dac0dd981058a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257706, "uuid": "1f91ac6e-abef-4a15-bf7d-91d3013b39b3", "comment": "Malware payload", "value": "1df5239e85aec360408331df4851b363128031be99dfb856d67c3dd386cc5ed3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257706, "uuid": "1ebf7835-3a3d-4f54-a967-2bcaf68567e9", "comment": "Malware payload", "value": "c421529fa76a6b0989b4a5115820b65c5e51952d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257706, "uuid": "f895c616-9b92-414c-9771-8a44e184f404", "comment": "Malware payload", "value": "0b9f51735b050c1ded4f7566222e2563669d1ed71cd9fb3a7dd89247ac444d0bb5595d45910179e9dd6655636e4427eb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257706, "uuid": "26fcdd2a-6445-49cd-b478-c651d1a217ca", "value": "AC33F1469219118CCE4BE2EB30F6FAD8E6DD6A430EA9B4D09B7D2745C1A30F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257706, "uuid": "51889fbb-5a65-4781-a5a7-3d0a488e5579", "value": "1536:/2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuISg:Ofqhp+g5ru2kmUEt88A3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257706, "uuid": "8f43fa39-b857-4547-8c58-db3a676c84f7", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257706, "uuid": "cd7d69eb-a09b-4e49-864e-eedb3851375b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257706, "uuid": "c224096d-6df0-4eba-8eeb-671aa8816688", "value": "catalog-1811240445.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14bf626-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259016, "uuid": "c7319e0d-df35-45d5-884b-ae5a88249674", "comment": "Malware payload", "value": "10357279a847c50ad42a60fec0785780", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259016, "uuid": "b82cbdbe-8477-411f-baa2-c02356601b1c", "comment": "Malware payload", "value": "1e22cac60daf2728ae5995821eb23b5fe54ccfbff51c25a974d9b70c539f6619", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259016, "uuid": "5fa77538-4442-420d-be8a-06d102e822d9", "comment": "Malware payload", "value": "e2edf6776062ca9397cc6929ccd0750d2aaab287", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259016, "uuid": "0da95d7e-36c4-4649-9bf5-8de3ebbba274", "comment": "Malware payload", "value": "b586c9321400c79646dee20fde1a6c8277fca05146bb4949d6bd6db51eac4c6af9bd548d9a29edf80709fcf13b736bd7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259016, "uuid": "1d3cb9ce-a075-4641-a03c-864831e61503", "value": "3D33F241E655028DCE4FE1DB30F5F9DCE6DE7A030EA9A4E09A7F2B44C1560F4482A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259016, "uuid": "6d33aef6-ac8a-486d-85a6-4a6bc994ae32", "value": "1536:Q2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIG8:hfqhp+g5ru2kmUEt88G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259016, "uuid": "94f8bc1d-9b3a-462e-b76e-6edfd68806c3", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259016, "uuid": "66ddb401-698f-4453-9a15-e996a77d58a5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259016, "uuid": "66d7b28f-753d-47ca-b24b-2f2a4cb6cfbe", "value": "catalog-752928553.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f7756e-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257574, "uuid": "5311514f-2696-4bfd-b711-51dfeb5fad56", "comment": "Malware payload", "value": "f7ed6b6f5d404d72b65f21264749e2b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257574, "uuid": "8875dcc8-478f-4bea-9364-3aee2c5a77fe", "comment": "Malware payload", "value": "1e287b548d673ea21241246f9780f520ee94ddf44085d32170c9233ce0b075e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257574, "uuid": "10c1de57-7d78-4880-b1fd-0e98eb951304", "comment": "Malware payload", "value": "91f109e6609d47383c9ddf3e8e0a6b36b6462a1c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257574, "uuid": "02844fff-edff-4aef-a65d-c876bc68da59", "comment": "Malware payload", "value": "a44cc094a3674ace3be49f966fa6cf27bbf7f7a08e8f177c6ef122ae154e019a25f830c3a5e6394d63008258a2ef670d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257574, "uuid": "1d4569e9-77f1-4ac7-8875-45ec03f4f55c", "value": "B9330281D794028DCE4BD2EF20F6A9D8E59EBE53099AA4D09B7E1B0191534F1482F68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257574, "uuid": "841b7d71-d578-45ac-a5cd-42f119f1c048", "value": "1536:x2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIB7bG:8fqhp+g5ru2kmUEt88B7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257574, "uuid": "49a793c6-2bf3-4f40-b0e0-5f749d1c9f4c", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257574, "uuid": "e3bc76bb-f443-4b7b-8258-3a49cc1f67e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257574, "uuid": "2c564d69-0ef4-4d4b-966b-1c3cd8002a95", "value": "catalog-1700760606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3c16e4-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259112, "uuid": "3b16c76c-decb-452d-9146-b53169417dc7", "comment": "Malware payload", "value": "11d626ee9617c98232b2655506e497c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259112, "uuid": "12d1edbe-2c70-4c11-a254-46b4824f817a", "comment": "Malware payload", "value": "1e2b23f97c5ac1d0694bfeba317f7f9a4cf34f26381c2e1d1a745572d8dda77d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259112, "uuid": "b22d3adb-d665-4860-87ff-34e42df573bb", "comment": "Malware payload", "value": "d56c5d5f051a4a62a65a8ac9d09191fafbfd5b91", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259112, "uuid": "cd20dc53-07a2-4ed2-92dc-b82b2b94d1bf", "comment": "Malware payload", "value": "c82032b2ad0c36df50161aac511f51e7f9e1f6b3eb957856dd6b3b94dd13be8a55fa0bee3531c8a4cbee413f935cfa47", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259112, "uuid": "cc0abd6a-19af-4ba7-876e-dfa32e44e6b4", "value": "48330186D664214DCE4FD2D630F1FACCF5DE7A430DAAB4D0AA2E2B0581931F0492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259112, "uuid": "5166a06b-9e95-4f60-905c-206f3749193a", "value": "1536:e2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3Y:jfqhp+g5ru2kmUEt88IxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259112, "uuid": "ab400338-57c1-4140-a306-62379d5eaefd", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259112, "uuid": "80744b5f-5e4d-45bf-9cde-810a1c46f254", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259112, "uuid": "28436a30-a1c8-4919-bde4-fe4f33a567c0", "value": "catalog-803918793.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb03f173-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258174, "uuid": "7d2776b0-6184-414c-a2e9-30101a57c193", "comment": "Malware payload", "value": "5e4d47b2d0234c21145ecfb6239264e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258174, "uuid": "981520b9-ec31-4e5e-b54a-8e60d8b70087", "comment": "Malware payload", "value": "1e34985d601bb1d6eeb3a3f73038eec9bca874da5ac3fe9634a19c1da59ba070", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258174, "uuid": "26a2e2f6-1443-41ba-8fd9-412c6766bc44", "comment": "Malware payload", "value": "c374ff0c6c049d29d8eb94356d9c22b299d8efeb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258174, "uuid": "d8dd9019-410d-4810-8b1b-104213164307", "comment": "Malware payload", "value": "3ab028ed4107a3beaca8b767dc54e4922e6a193fb9c77bf8462dba3b4045a98548cbf36674da4d6a256fa5e223942f03", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258174, "uuid": "849ee699-c609-4e53-b07f-6b67579fe17a", "value": "5A33F184D164108DCF4FD2EB70F6FAECE1DE7F43099A68C09A6E2644D2920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258174, "uuid": "be093406-4c7e-452f-a640-3bae6913a200", "value": "1536:+2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbjv:Dfqhp+g5ru2kmUEt88mAbjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258174, "uuid": "c4601cae-6d7e-455b-80b7-86eb45d21cc0", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258174, "uuid": "019e334a-ed8c-4695-a55c-e5b9ee4b8b32", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258174, "uuid": "db843893-3a69-46c7-aec8-72e9afa9e1a0", "value": "catalog-2145970484.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030311c8-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264227, "uuid": "31bccf3d-eda0-4e72-846f-b579dfad9293", "comment": "Malware payload", "value": "37b0fc17c54fb97d9510651f35494aeb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264227, "uuid": "77a64e7d-ef8a-4735-86fe-1c48d72c0c80", "comment": "Malware payload", "value": "1e9e312eed347398667a771262b6b7e30d8a6f757fd46136e2e71f5eda606007", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264227, "uuid": "5d364fd9-188e-41b4-92d2-980ff8cf2958", "comment": "Malware payload", "value": "dae04b0f3298c4c3c2d538b0beeaecb4cbf3a61c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264227, "uuid": "c289f605-7fb8-4460-8ef8-b81a92c0ce0b", "comment": "Malware payload", "value": "5633c0b18002a0c6f2eaa447f39f989244ad61cbec9f8572f364b187c4ddea80abd8366ab07ad1bdf605a3359e6c4a26", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264227, "uuid": "9c8c00f4-25cf-4501-a258-548dda421280", "value": "C233F1E0A402F04BD758BC5CECAE9D024F7DDA1E433E7842457AC08B5E62AB5B749D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264227, "uuid": "8d63d169-acb2-4977-8510-e196c6dc0b95", "value": "1536:nXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIMV:XXma7774mfCyWMB/4GpV5dMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264227, "uuid": "ecaa71f5-adbe-4b64-8242-cd084a23d3e3", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264227, "uuid": "d54b8d15-b7e1-4fbd-a4f1-056dab97fae1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264227, "uuid": "13ac38c4-0e20-4d05-a38d-76123320e1a8", "value": "statistic-567621336.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de96f22f-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264166, "uuid": "9fab28e6-7999-4a5d-bbe9-931ee1576dac", "comment": "Malware payload", "value": "8a4ba24394949c947eb7fd160140a073", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264166, "uuid": "abef0ff6-918d-4a74-bc46-2c9ee0843cd7", "comment": "Malware payload", "value": "1ea06cd6e11dddfe99fc498b87bea7bf0d3f5aaea475cd370a3a12d924308ad5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264166, "uuid": "d3f652a5-2d18-405e-b54b-4d16bc73b9af", "comment": "Malware payload", "value": "c43b160b61b0b322ec7ecf458e8e75beca4025eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264166, "uuid": "3bee91f8-28c7-444d-8c43-6954e2f22348", "comment": "Malware payload", "value": "4ccfb4af6fc10d99fa65bf8cc65592f2a2f38fce8472be9386fe636d1f8ab4c4c7b103585bc52e4c1e1e014a064757f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264166, "uuid": "8cd48b19-dcfd-495a-ab2f-7bcf920f3d27", "value": "3D3301A0A902D087A759B81DDC7A6D038F3DE90A433D6C53013AE0875E629FD7649E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264166, "uuid": "71758f49-0451-4420-9f3b-13ca2f48440b", "value": "1536:PXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qrxf:vXma7774mfCyWMB/4Gp07Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264166, "uuid": "1747995d-4ec9-4e86-becc-0a2f199716b3", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264166, "uuid": "655f06b6-da4b-4dad-9158-212f09225537", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264166, "uuid": "6cdfbefe-a40e-4611-bcfa-17d5922b1b09", "value": "statistic-535533973.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb91d35d-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260751, "uuid": "712ce68f-fa3a-43b2-aea2-977af45dafce", "comment": "Malware payload", "value": "536a181c6703bfa4b814a1e7eb70184e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260751, "uuid": "cff5bd65-e4d3-4353-a07b-63e526402933", "comment": "Malware payload", "value": "1eaeac3f81938c2d6302121b05809946bb4b71cabc6c6cfeb1fbda4586b87486", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260751, "uuid": "92140b4e-9365-4432-9e32-3ae6b9a7efe3", "comment": "Malware payload", "value": "460198121a5397d0625aa975489661e31987b98b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260751, "uuid": "a33b5a48-e664-42db-a470-43dd8a54cdc5", "comment": "Malware payload", "value": "30087909d986119cdde8d0a63d1062592705b055c3ae8e78089236cc6cfd5c85fad95c4302662868979718348072a7b8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260751, "uuid": "c38641d3-6d1b-4c1c-83b5-b107dfb729d9", "value": "7233F1714BFCDAF22DB2D0AFC8CAF504FFB2C469C4C78A6249F871C9B6901455A22E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260751, "uuid": "f5f92e4f-ffb0-46d5-8f33-af77180761c7", "value": "1536:CjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXk:yB9wzbqtWb08UscYJhnpjyq9qBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260751, "uuid": "90367f9a-e04a-4583-a7e8-363a1f282639", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260751, "uuid": "ef3e7f9e-dac8-45ac-b3bc-31daa2441e56", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260751, "uuid": "13a164ff-82b0-4c04-a19f-5e31754ca933", "value": "diagram-2012282895.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71443c0-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260744, "uuid": "301398da-2d51-4625-86c3-210d55d26503", "comment": "Malware payload", "value": "85c836e1484aa569f0bccee5745f12aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260744, "uuid": "4c2b24e5-f795-4927-bae6-fb4a397b67e0", "comment": "Malware payload", "value": "1eb78990f8326737c3eac9e7b0c22eb99ecb0d6b38cd30f4966ef5dd0ef21204", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260744, "uuid": "de0e74d5-3c27-41e7-a8d0-2039761383ea", "comment": "Malware payload", "value": "0b330d8765797f3ee7a2f01940cc29b3874bce7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260744, "uuid": "edda1ac0-94b9-4b8c-9542-961beec84dd8", "comment": "Malware payload", "value": "3ff9291a24ca3f341341eebc9a0ca9a73e642c8caa8c00b012ad461e616c0865b738efb81306d8d51b4d09e31b32fb1c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260744, "uuid": "18405d83-bd26-4ea1-b660-5dd4ae9369a5", "value": "823301314BECDAF62DB6E0AFC8C6F604FBB19455C4D3862249F8B2C8B6D01855E32E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260744, "uuid": "c636cb04-5e27-4075-bac4-cecacc08445b", "value": "1536:0jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXtB:8B9wzbqtWb08UscYJhnpjyq9qBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260744, "uuid": "526591b2-2df9-4734-8d19-61fdfbd90539", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260744, "uuid": "0fb368a7-00a5-45df-bd8f-03b3f3cf6a1b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260744, "uuid": "3d90437f-4b8f-48f8-95fc-a3e2e98cc146", "value": "diagram-2004034040.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de8f9a6-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257910, "uuid": "125b7da6-c104-4cde-9af8-134763d842d9", "comment": "Malware payload", "value": "52a946bbf447c6834a3a5f638d0a03a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257910, "uuid": "43200f0c-acde-4b73-a1ea-f71fb57cf2c6", "comment": "Malware payload", "value": "1ebccc85fdb76192d3538b87d3fa72039cdb96341d6de48c33b5b15580d2a271", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257910, "uuid": "2763628d-3e1b-4d30-aa5c-32846ed3566a", "comment": "Malware payload", "value": "676b51ad663c24cfbdb1c9b563db4c3d5937665d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257910, "uuid": "57ee7ebc-0fdb-404e-9c30-b2e6d2e5cac1", "comment": "Malware payload", "value": "212e373f5c973d5d3eda16272ddafcb54c0747a22f46eaf7d1b333dcd9344db26238aa7ff3bdf2d35fe64f2cabf82eb8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257910, "uuid": "b99773b0-b4a3-4ab2-a115-7820ec005269", "value": "8633F151E658028DCE4BE29B70F5F9DCE1EEBE530D9A78D0972D2B0191430F5482BA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257910, "uuid": "c54a9cf1-eeb4-4a44-b068-a7d09f29670b", "value": "1536:Q2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxu:hfqhp+g5ru2kmUEt88xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257910, "uuid": "db2ae8c3-73b9-4822-b1ea-c1a8b5261cbd", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257910, "uuid": "57e16299-998b-448b-a272-dd5060fdd4a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257910, "uuid": "d07baf9e-1acd-4f6a-9ae3-23ed037d1b04", "value": "catalog-1961886522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125354b2-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262534, "uuid": "e9289fb0-3a1a-4a7d-9f58-54c57c665b33", "comment": "Malware payload", "value": "59a820db9570855b821eb30d5871948e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262534, "uuid": "f4003c9a-ac08-4f9a-baec-709bc7140b79", "comment": "Malware payload", "value": "1ece2d6fdfca9f5879931a53990f51d81b30046ce943d1bae07e45e93fb268ce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262534, "uuid": "1474bf1c-421d-4c24-9398-8dfda8a0ffd3", "comment": "Malware payload", "value": "f0e71a30e380e28e54432106dfe797bff82c0874", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262534, "uuid": "6b5dc7aa-d7dc-48ed-9832-8fa94bffc367", "comment": "Malware payload", "value": "0eb28d4933a9fde83273d9adfe8d3a738ef737a97a20420afaa6d26d165c35f4247327fb100fec345f7851b57a6bc234", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262534, "uuid": "0440c900-e02f-41e5-9576-3ba46f991559", "value": "3A3302A0A906D08BA719BC1DDC7A6D038F3DE91A473D6C53013ED0874E629FC7645E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262534, "uuid": "355b8881-a0a3-4c63-be61-7f4e8d3b94c5", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qDx0:cXma7774mfCyWMB/4Gp07YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262534, "uuid": "99996bab-929a-4b5d-bda7-44ec7ea3ea6c", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262534, "uuid": "b7af433c-4932-4a56-9870-f76d12b7f0c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262534, "uuid": "ab1cf2b8-b950-43b6-9267-295ab5ed3e1f", "value": "statistic-1235957136.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883a5b5f-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262732, "uuid": "8f2586e2-0946-4e45-b3f0-f83e904ae89f", "comment": "Malware payload", "value": "f0ec79c6ae4926d677621d69a0d50886", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262732, "uuid": "832ac253-b30f-4a25-b584-d2d35f17ca66", "comment": "Malware payload", "value": "1ed00c584476bce461b2e6353abc9db504d43f1cc829d4ae8b88313a86c9b107", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262732, "uuid": "bf965ab7-f254-48e5-9a7e-7e148be2e50a", "comment": "Malware payload", "value": "4836683f0b28f1270cb9d624b0923aa1428a8738", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262732, "uuid": "e481077a-3a13-474c-b444-96cda4377e60", "comment": "Malware payload", "value": "2ecce1790d2cd7073ccb3b030f3740a1f529fb94934a486abb49a3a1e5197e9c34ac27b3280c9eb7539b2bf3f5eacc09", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262732, "uuid": "abaf8f36-97d5-4bc7-8a76-ff0c5a7e66bd", "value": "773302A0A902D087A759BC2DDC7A6D038F3DE90A473D6C53113ED0874E629FC7649E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262732, "uuid": "8e3803c0-e7f5-41bf-8a26-bbef61efcc5f", "value": "1536:7XXtg3K7774iXfEz5lnm/hQMOEYus1Gp07q7xN:jXma7774mfCyWMB/4Gp07gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262732, "uuid": "a17a62b8-6fd8-4a84-9650-f06413d9da71", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262732, "uuid": "2afdecd6-056f-4852-bde2-1f4eb3cb8f2c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262732, "uuid": "9b9e87c0-64e4-4cc4-ab25-cf6889ca5420", "value": "statistic-1361919050.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e2b3a0-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258064, "uuid": "8b36c963-aad2-4730-8a01-bb53b10e8d64", "comment": "Malware payload", "value": "b9472bdd151a4cd0cabe3ed5321292fc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258064, "uuid": "4961e14c-b2ce-4368-b863-66f630418a30", "comment": "Malware payload", "value": "1efe631df2ffb166b87c2bea8d74c30fac7d5aa59d4971a032ac6bca3c7f37de", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258064, "uuid": "3595e942-1dd6-4e46-8cdb-2e1f6b47095c", "comment": "Malware payload", "value": "334b9378004f53b4959c99a8edf45d182c4bd742", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258064, "uuid": "7f9425da-6f0a-422e-98d9-349cda75f0c8", "comment": "Malware payload", "value": "1ee1c1d9e15ef552bf07047f81b8144e75558bbce06f055e8aa9478816b734d7c588de444cddb87729e55b15874e8f5b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258064, "uuid": "f0c48e3b-24b1-489b-b473-dc5208887b64", "value": "A733F1469214128CCE4BE1EB30F6FAD8E6DD6A430EA9B4D09B7D2745C1A31F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258064, "uuid": "9538fbe3-69fb-4302-a638-7b3e82c396eb", "value": "1536:s2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuySX:dfqhp+g5ru2kmUEt88ANI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258064, "uuid": "58fe11b8-932c-461d-994e-563151088df1", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258064, "uuid": "233be9a3-4bad-4bd7-b0df-5e38ec4f2267", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258064, "uuid": "a7d5b164-5dd9-4204-99d4-ad5084c13f31", "value": "catalog-2075637927.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe09f87-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261155, "uuid": "4d1cfba3-8b19-4247-a03e-969f0d6236f8", "comment": "Malware payload", "value": "2dd1e2e61656e37b2463f9751364bde6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261155, "uuid": "34d52ed9-269c-482c-bafb-16fe193cb826", "comment": "Malware payload", "value": "1f1a747e8caaa1733c362615ff668df624f633641e1e55bc089f1549769f9ffd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261155, "uuid": "e4042c50-53dc-4401-b7ad-a15523a8cc33", "comment": "Malware payload", "value": "cb2998e9f15a5ff48594d6abba541e8c561644de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261155, "uuid": "fa31a75b-22fa-4176-8fe3-bce04ce51511", "comment": "Malware payload", "value": "d3b2895a2bc5144aa99385daaa845437b39e895d65eb9adfa9d3dce7f4edf0fe613da7eddc827d0145f02d8f6c12725d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261155, "uuid": "dc86083b-c72f-423d-9b1b-8d9f9857c36e", "value": "6233F13547ECD9B62D76D4BFC48AFA04FBB1C465C4D7862249FCB1C8B6902854E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261155, "uuid": "5a142273-b6ad-426c-a9d6-5ed69c95b482", "value": "1536:MjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX3:0B9wzbqtWb08UscYJhnpjyq9qB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261155, "uuid": "1d682965-b108-4143-9a19-17e820938843", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261155, "uuid": "44e57bb0-1f34-458d-8ac5-f26b130287ef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261155, "uuid": "1de838ad-9ad1-4db2-b7c4-757c87ca5e85", "value": "diagram-346364490.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186d95dc-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257391, "uuid": "7ee2b0d1-cc20-49ca-8f28-b1627d8d32a0", "comment": "Malware payload", "value": "e80f8c27a6867dab18df483e02e0d7bd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257391, "uuid": "c23383d5-4fb5-42b8-a988-3faf51bd16b5", "comment": "Malware payload", "value": "1f1b3dbc963006212d986283e25d6575f9847de8b4618c322c8615fb04832a12", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257391, "uuid": "d36ec42f-ab45-4867-bb8e-fc4c0fba8a3e", "comment": "Malware payload", "value": "c61d0dda446c42d1c0fc70bab53e7770f0b0604d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257391, "uuid": "18873917-473e-40f5-805b-5ec1760f8105", "comment": "Malware payload", "value": "7a6fa56fa7910f1b9d4c6b34addb2d35a8928145005f8a9b3aa11fb1242dbe53e30fbb71304fcb71bb16252ee9124ec4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257391, "uuid": "b07d70d0-93ae-477c-86f7-ac6a1026769e", "value": "9A33F184D164108DCF4FD2EB30F2FAECE5DE7F430A9A68C09A6E2644E2520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257391, "uuid": "042ac0b7-ed55-4e27-9b0d-dfb90a18d224", "value": "1536:42fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbBG:Jfqhp+g5ru2kmUEt88mAbBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257391, "uuid": "d37dea8e-a883-470a-90da-6ea0c065dd47", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257391, "uuid": "04ff2b42-22dc-4cd0-a807-0ef24a74d30f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257391, "uuid": "b230ccfb-8c36-4960-8dc5-3ccf20615452", "value": "catalog-1546001563.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b49cdd-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257042, "uuid": "91b390e9-94ce-48a7-9376-0f2e713024d9", "comment": "Malware payload", "value": "c04dc52bd07fe7c17f2f3b773f6f2260", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257042, "uuid": "575abd64-06a9-4086-99fc-b52e0ffb0c34", "comment": "Malware payload", "value": "1f377143479db626e9a79560c21f3ee0a0e861e8b5420721a8e9822d3c6a5f39", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257042, "uuid": "3188b415-3554-4611-a3ff-e64b880d5210", "comment": "Malware payload", "value": "7a427af38a8e9ec698ee70f1a74fbb19f3558822", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257042, "uuid": "d9a682ff-f970-4d5f-953a-58bb9c0f12ab", "comment": "Malware payload", "value": "2c5515cf2b25258d21374ab1f4d00aa2a9b37b4e47417015709d55ac6a32292bd3295f5587e680e48e6676ec4c9d0f41", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257042, "uuid": "724dd50d-e53c-4442-a17b-6ad869d31d51", "value": "A833F196E258018DCE8FE2AB30F2E9D8E6CE7E5309D974D0A7AE5B0491530F1582E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257042, "uuid": "7da8dbae-1da9-49b3-9116-7e7f656fa16d", "value": "1536:J2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jILV:Ufqhp+g5ru2kmUEt88LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257042, "uuid": "386ce5f9-edc4-4d10-9941-44d62e4896ab", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257042, "uuid": "2cc581ee-c615-425e-9784-cbdb7118326b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257042, "uuid": "b3c79820-8923-4281-9668-476074f2328a", "value": "catalog-131762102.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6adc980-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256824, "uuid": "a579623b-b183-41de-805d-641c98173826", "comment": "Malware payload", "value": "d3ec1a922f3f3e555d55ae7ddd0406dd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256824, "uuid": "11813201-5cb1-4a93-bc45-af2f51caa302", "comment": "Malware payload", "value": "1f4cef474a22b9fe3a11b1ecdde90f00421e5c9804d01576153f6d55faef543c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256824, "uuid": "fbeeed68-4039-425b-b59a-e6ac024af043", "comment": "Malware payload", "value": "937a56c422ab9c959d6730bde505b346fc70e17d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256824, "uuid": "1ca188af-7a2a-4d43-ad7b-8a1ea82f7205", "comment": "Malware payload", "value": "54635ce7b93c7f543a0d1b98c8785c244483e598fe9735ad54eda57a390e1e82a38a0dedbe25034bc5cf5d4250d12743", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256824, "uuid": "564771ae-5a54-4fc2-82de-46f45ecc22c7", "value": "7633F241E655028DCE4EE1DB30F6F9DCE6DE7A030EA974E09A7F2B44C1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256824, "uuid": "35537536-b681-427c-bad3-0fd27ee79e03", "value": "1536:52fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIXB:kfqhp+g5ru2kmUEt88XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256824, "uuid": "55209522-c3cb-4100-8312-37f54d47a860", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256824, "uuid": "754098e5-0550-481a-ac47-2b4038d800c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256824, "uuid": "fa26dde8-2c07-4db5-8dd2-c2de50bccb66", "value": "catalog-1121397767.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ae88c3-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259960, "uuid": "84330dd5-efe4-45b2-99fd-544c85bf7f9c", "comment": "Malware payload", "value": "baf5e9b7f961bb83476b3d954612ce4b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259960, "uuid": "495188c7-7e78-4cd7-b85b-4624c8a4de15", "comment": "Malware payload", "value": "1f4d0028325b4deae7beb8c31d60fec086fbb3e39e85d3621e1da0fc01aa0792", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259960, "uuid": "4002f9c2-f211-4af4-b92c-ad4a73b640ca", "comment": "Malware payload", "value": "19c1a8f633663770ed0cec424486f1b24afe25d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259960, "uuid": "244b2df8-6b32-4b3c-8029-31dfd56848ab", "comment": "Malware payload", "value": "2ffc9823d4d009d66eaf77a1aba5ff017abe661b7bcb68cb4646fcf53ef312488328452b69e74514c9822ea3e30d3e35", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259960, "uuid": "4d4b4114-b76c-4144-ab1a-d898510c0153", "value": "F133F0B147DCCAF66C76E0BF84C2F808FFF28951C987862645F9B1C8B6A42514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259960, "uuid": "176a7b15-3203-4e8a-9d4b-270405fe6b0c", "value": "1536:VjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wgj:xB9wzbqtWb08UscYJhnpjyq9qEK0wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259960, "uuid": "ec26e958-b2a3-4d8f-b346-e293966548ec", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259960, "uuid": "d619957b-2045-4531-979f-d771770c780d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259960, "uuid": "9606de5a-ac32-4488-9c4c-dfd9c74c7c1a", "value": "diagram-1481288391.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adf3b07-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259515, "uuid": "6dea31ab-d08e-4560-adeb-4b182b5f63d1", "comment": "Malware payload", "value": "3db4738b6b4269a09a5513e55eab19d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259515, "uuid": "a64c9461-e5c0-4f6a-894b-f2eed3f9f424", "comment": "Malware payload", "value": "1f7a1f77f2b6b3b2d9ac1e1d6b6ba57131d115e93239d0b07864602e01ac42eb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259515, "uuid": "762dc590-39e6-474a-b082-4745a2f98bfd", "comment": "Malware payload", "value": "7d414fc32597f80c7426c3c0ac50c519c08ca610", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259515, "uuid": "51003ae3-9595-401a-91ef-713afcdceb66", "comment": "Malware payload", "value": "b29bc3c179492c68e3adcc2f8bca617a841dc7c0aa2ea7f51445969a78c4aa70e1d4c8fcbe3c53a83db79faadf5b4071", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259515, "uuid": "b815d14d-9d53-4540-923e-75fcf04941e2", "value": "F133F07547DCCAF66876E0BF84C2F808FFF29951C987862649F9B1C8B6A42514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259515, "uuid": "14eacc91-1539-432f-890f-c38ad53b934c", "value": "1536:7jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wgC:PB9wzbqtWb08UscYJhnpjyq9qEK0wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259515, "uuid": "bc6325e2-b5ff-4576-91aa-1af46a58a3a3", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259515, "uuid": "12ab742b-a5ef-4529-add9-7f10820470eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259515, "uuid": "2a9a0014-0b19-484e-a00a-3ee7d619b353", "value": "diagram-1111713477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68c5d3b-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261495, "uuid": "59f3800c-7058-4a56-885c-a7382fa209aa", "comment": "Malware payload", "value": "9d99135636b90db0ec92d4d71b1ae17f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261495, "uuid": "8def3f69-de15-4ba6-af0f-a78eaf91f4e9", "comment": "Malware payload", "value": "1f99dd7744572e379c5795053ddc62b471fb11bd80e390c907c1a9333cfe9077", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261495, "uuid": "ee9a77d3-bff0-4042-865d-4affb6e6a9d2", "comment": "Malware payload", "value": "3c11bb5c8ee71f2a3cb57fafcf2e88317654719e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261495, "uuid": "46199c87-e4ac-46b8-bbec-53011b850a73", "comment": "Malware payload", "value": "240d52c39fae1dbbaa3733ae0e8d30dc24b636e007b7d898c0357751dffe29b470d4dabc35b6a25c855f2447dcdaab95", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261495, "uuid": "e8b817b3-0c51-4527-8491-914c458bdd34", "value": "0633F13647ECDAF62972D0AFC4CBF905FFB28465C4D68A2149F8B1C8B6D01955E32E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261495, "uuid": "b1f6c45b-9790-4df9-9f97-061c9b558659", "value": "1536:JjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXgv:NB9wzbqtWb08UscYJhnpjyq9qBgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261495, "uuid": "2b29b9f1-b065-4128-86db-9fb835eb6439", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261495, "uuid": "fdfc128c-2a81-4ce3-a7c5-b8d0cb0e554a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261495, "uuid": "99ff278f-97fd-4a7e-869f-726dab544dd0", "value": "diagram-589578676.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96b10aa-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260318, "uuid": "8ba1c189-7edb-45af-821d-0ac83bed63e7", "comment": "Malware payload", "value": "5e2662c2768f46a64914cd8ff79a689a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260318, "uuid": "07a41914-2267-42cd-b8d6-c8f08903b9aa", "comment": "Malware payload", "value": "1f9b227db70a794d890f35bee81dfe194628da335491c8527ca76c85be825bd0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260318, "uuid": "f87c61c9-eb0c-4ac4-a6c5-434e02110749", "comment": "Malware payload", "value": "58374434f111c359da19394f650b2e9aaf22dd76", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260318, "uuid": "f2f6f8f8-cd6b-44fd-a7cc-7f72fae61025", "comment": "Malware payload", "value": "33fefbbc0b8aee3ac2acfa2746b396c5eed92801df5998812d593e0579c300652a0419eec70a228a9c4b65a795e63ee4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260318, "uuid": "dfd0f4fc-27e1-4216-ab7f-e50d1c6af31e", "value": "3633F1705BACDAE76CB1D4BFC486F904FFF1C869C4AA861246F860C8B6D12558E72E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260318, "uuid": "5c8e6909-e7f9-4118-b8ec-73e3b3a7298b", "value": "1536:mjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67wZ:+B9wzbqtWb08UscYJhnpjyq9qawwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260318, "uuid": "d352aaf6-387b-4a76-8644-e8a834eac4d6", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260318, "uuid": "6ed8bae1-d6e6-41c3-936f-9eb4dd472cb2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260318, "uuid": "9d379048-e1ee-46ca-8313-8400f39886bc", "value": "diagram-1701957008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a91316-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258866, "uuid": "25cf06c4-04cf-4331-8045-4c247975c4ec", "comment": "Malware payload", "value": "ed09ed80223a5c7c42d431f7cd3c5db1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258866, "uuid": "62e350f7-00f9-48a9-a1ef-6b099cabe5c1", "comment": "Malware payload", "value": "1fa5d53f0486eb7b6cd72cf4c4050b2eca6504f5dd2e959095601e0277774824", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258866, "uuid": "f64135d7-6095-480d-adbf-09be45c91784", "comment": "Malware payload", "value": "0c2ebd82014e8e239e02a4064e2b3fcdbd20f491", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258866, "uuid": "7ad5bef7-2006-4ad6-af2d-35d3f6282274", "comment": "Malware payload", "value": "df6f7ce1b90912e336d289ff55742bc034bfa57510d28783a373a078e886672d9f11a9834d6792d47e514c11204cebd2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258866, "uuid": "668eb3c9-b33b-46e4-92c9-d81cdb51c0bb", "value": "D533F196E524108CCE4ED1DF30F6FADCE69DAF5709A968D09A6E2B05C5930F1082F58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258866, "uuid": "319c2458-ea1d-439a-b4d1-4dd7f15bbd4f", "value": "1536:z2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIl3Z:Sfqhp+g5ru2kmUEt88lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258866, "uuid": "92be2792-060e-4072-a4d0-427ac77e7a2d", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258866, "uuid": "04fd44e5-c6b0-4a59-a74d-f355b8fa8f26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258866, "uuid": "46de18eb-ef86-4c99-905c-4aaf4a8dc82a", "value": "catalog-634948820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2e6219-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261554, "uuid": "7d43df99-1da1-471a-a68b-69b85e5c9931", "comment": "Malware payload", "value": "a8f15d966744cb0f34f3c77c6cc967f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261554, "uuid": "d3167ac8-c643-4ead-96d2-3e6f6754d1df", "comment": "Malware payload", "value": "1fc1e0089536d3a1b15b5062ac55a89a050f7510a4043f993dffa33dd1304c66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261554, "uuid": "84f35d90-60b1-4e87-8535-c354996a2acf", "comment": "Malware payload", "value": "d40abdc882ad7cdeaa78c75cf28c764ab864d809", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261554, "uuid": "2a9ea9e8-54fd-4aff-9a1e-d543e4f0de0a", "comment": "Malware payload", "value": "d85f2bbe3a57b4141d3c42509caaed0d5facd72f0c5bd3177452d6e8a39d6f4c7733a7c26a141e8fa050e24eb3453d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261554, "uuid": "dfcac0f8-b8a4-46f7-ad86-ef05ec93bd66", "value": "E433F17187ACD9F668B2E4BFC8C6F904FBF2D499C4D7862246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261554, "uuid": "d5283536-bdfb-4da1-9448-bbdc74d14378", "value": "1536:ajfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXxj:KB9wzbqtWb08UscYJhnpjyq9qBxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261554, "uuid": "47fe71b9-a1be-4120-92e8-480810124349", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261554, "uuid": "dafe4924-4afe-479f-b124-29e83858412f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261554, "uuid": "dd9e94b2-4653-405f-836d-fb9ed95bb680", "value": "diagram-624378644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9489075-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260667, "uuid": "114ba922-fd94-4483-bbac-a68638a45334", "comment": "Malware payload", "value": "606188d729b33c55c31e64d298d5a6e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260667, "uuid": "c021142d-9d45-4f5b-be1d-c0088cf1a85d", "comment": "Malware payload", "value": "1fddb54d0bf4bec8906f113d9584c24e37d814724081de19be1080020e6d96dd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260667, "uuid": "7ce17980-e8c4-4c48-b51e-06d9edbc1f18", "comment": "Malware payload", "value": "d65ea638fb58503a090ddf87d2cc5e5f9c0ae97d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260667, "uuid": "75129bcc-b03f-448a-8242-8c92c78a1020", "comment": "Malware payload", "value": "f37b1fdc6fe930c205aab66f59d7eb820cd3ae72591e2b53e4702c4a49ff59f3c07773863f8634736178c65134d1e443", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260667, "uuid": "a6f7da58-918d-44d7-8dc2-f3fb4e2f05b4", "value": "D333F2714BECD9F628B2E4AFC88BF504FFB1D455C4D786264AF871C8B6942459E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260667, "uuid": "a0bd2a74-b5a1-4aee-aed8-43043cae3397", "value": "1536:YjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXj6:YB9wzbqtWb08UscYJhnpjyq9qBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260667, "uuid": "e1f248fe-a82c-45bf-9867-d813de278d3b", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260667, "uuid": "2abf613a-848b-4199-bd54-2288dbab318e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260667, "uuid": "43003e64-2b1f-4e90-ba49-61de46223243", "value": "diagram-1958637604.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacb73f6-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258146, "uuid": "49e44f36-9893-4155-9e28-4954503fe935", "comment": "Malware payload", "value": "5928ea6f0bdc1a1fdc59078b46fb304f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258146, "uuid": "261b9a60-ede1-4aa2-b8d7-c1535ecf4bc7", "comment": "Malware payload", "value": "1fe2c11ccf7ddf0f2644097bf654483c7e52ed1acb115670f32a3d9464527528", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258146, "uuid": "51110473-3d1c-4782-9208-b1619162977c", "comment": "Malware payload", "value": "fa76498c722cbeed1f5bcb1850577f1f6ecada3c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258146, "uuid": "4af9dbdd-43d0-456e-a9b1-fd0eb916a664", "comment": "Malware payload", "value": "b09b2c2a08aff05fd2d00ae045ec6cc458a62afda5e7befe81eae0ddbce0bbd8dc66dad9a4848f77f55bbb61c939681d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258146, "uuid": "b6f06e12-5b74-4076-8ad5-50842243df27", "value": "8133F195D668024DCE4ED2D760F5FADCE2CEBA4709DA74C09A7E270590931F0042FA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258146, "uuid": "25d90b81-f06e-4a5c-9055-d212fa424142", "value": "1536:m2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI6oS:rfqhp+g5ru2kmUEt88LS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258146, "uuid": "8c222756-420f-4598-ad2e-547444f36b61", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258146, "uuid": "a476abba-fe2d-4307-9791-50b0b7154f0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258146, "uuid": "2d3fe89b-5ac1-40aa-a141-dbfc053ecc9f", "value": "catalog-2128709586.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64896483-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262243, "uuid": "551e3e89-69a1-4d36-8453-152ef1265c09", "comment": "Malware payload", "value": "439737e4afe94c140801ee1fc7351c68", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262243, "uuid": "fab11fe6-9a61-4d96-8f0e-761442d3e339", "comment": "Malware payload", "value": "2002dc03316b89e1442b6530a49793e4c3cace80e2e252aa86896853a1cb8d06", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262243, "uuid": "f27111a9-e8b3-4e6e-a9ee-8f36b4d898e9", "comment": "Malware payload", "value": "301c04f2815a80c14ccb0c9ff6b971a4d46fdd4f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262243, "uuid": "2426c3d3-7737-46fc-ba99-1fccf1118f52", "comment": "Malware payload", "value": "18b8a4e5855a5ebaf1d838e85de46297ef00d932f9cdfd4b4e1df186205fe91b55ca57ccdc5ed5856e0ea70b184e3137", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262243, "uuid": "de2780bd-2291-4c73-ab2e-f67ee2b1e1b4", "value": "4633F13147BCC9F669B6D0BFC88AF604FBB18495C4D787228AF8B1C8B6D01955E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262243, "uuid": "f642db4e-4dfb-4dd5-882b-f47c301ea125", "value": "1536:IjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXT4y:oB9wzbqtWb08UscYJhnpjyq9qBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262243, "uuid": "5e0c5a30-597f-4664-9dab-a9e46e95b636", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262243, "uuid": "a7353551-64f6-4c4b-ae88-f038f01ee4e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262243, "uuid": "3da180a6-4d98-429a-aa03-8166dd3a6bb7", "value": "diagram-998080798.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3f1fb3-b6ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621249616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249616, "uuid": "e913f287-f0e1-48c2-a514-f5df934eca98", "comment": "Malware payload (Dridex)", "value": "109402cc660eb92b89e9314335dd740e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249616, "uuid": "716a0813-5308-4b21-b0fe-43e6216c650f", "comment": "Malware payload (Dridex)", "value": "2004d2cc3613901a95c102093e7eab401a3ce7d4dfd161a496375c609dad2d80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249616, "uuid": "2fbd7add-6c73-4431-9f9c-95596225807a", "comment": "Malware payload (Dridex)", "value": "1889bbcec40ba76b8c00d862a08fd6c0e3da25a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621249616, "uuid": "0b015e50-26bb-4072-b28d-0a43d8040986", "comment": "Malware payload (Dridex)", "value": "2ddeb55acfd2e2e9839033d2e430f4b12750569f482065e7097e22b9e04e715658077fc37a2ce87ff68c016a75cc9c8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249616, "uuid": "2202e4e1-00aa-41ed-b17a-d4d1abbd2385", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249616, "uuid": "e03997b1-d0d1-4175-a1de-6efe94872707", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249616, "uuid": "bcc37716-f67d-480b-a566-73167431df36", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621249616, "uuid": "ace53c63-a7bf-49bf-8577-5170d4405ffd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621249616, "uuid": "da2e24e9-9a60-4fd5-ad69-112376a04cc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621249616, "uuid": "28fa7f98-92c6-418c-8510-c4f3e7eb1559", "value": "109402cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a743eb5-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264051, "uuid": "0762ca7e-4391-416a-9e1a-d6296bf0aa39", "comment": "Malware payload", "value": "e537bad7e271a1cdd22bcc2a1ebc93a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264051, "uuid": "ba953235-bf4d-40d4-a85b-c80073f6c48e", "comment": "Malware payload", "value": "2026bf23d88688d54cb2a2e08855adeb9a716f7b44ca75dd591d39cf62dcae57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264051, "uuid": "d3d06491-0b1a-47f8-a41c-2d3760b1a254", "comment": "Malware payload", "value": "1655029e5cf7d1ed0dd8884b11c80a075c740bf9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264051, "uuid": "08fed31f-40d8-4d8a-828c-1c9dff9d9a8f", "comment": "Malware payload", "value": "44bffeb073385062a2f0656e8f09fd57b73770256bc5b1e06c4b2ebbd6d20890e78255665785c1b77b10d8d29068f039", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264051, "uuid": "36b0a7af-6f1e-44f6-a576-f262b9ac8c57", "value": "1733F1E09902E08E9755FC5DDCAB9D078F3AC91E027D3883017BD0475EA1AB5A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264051, "uuid": "d6896eaa-d659-4516-b751-d15c7738ce2d", "value": "1536:iXXtg3K7774iXfEz5lnm/hQMOEYus1Gppps:yXma7774mfCyWMB/4Gppa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264051, "uuid": "c3c554b5-f907-4123-b5c9-a972da8f0073", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264051, "uuid": "478ffb6c-54df-4aa1-b4c5-b83f78508b7e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264051, "uuid": "c3605bd8-f31d-4de5-bb79-cd8e96d46679", "value": "statistic-453473926.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb01a5f8-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264535, "uuid": "2e96ce34-1b70-4cf4-b1fc-89a9cba692b9", "comment": "Malware payload", "value": "6541b41566033dadf4a3f185947f4cf6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264535, "uuid": "cccf55fc-039f-41ae-ae22-c10e917c0a20", "comment": "Malware payload", "value": "20304d13dfa280f477f84c4fba168304bf30206656f85b82e0116f01c8360137", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264535, "uuid": "08f3b81e-51aa-4725-9d46-e9ff8b23efc7", "comment": "Malware payload", "value": "5301f2b1a6f8de825e3d781f155995ee5fc192c7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264535, "uuid": "2f5ef4e9-1401-455b-ab9d-7e1bf39eef4e", "comment": "Malware payload", "value": "2325186aa552058dbaf2f9f4ac93a642c7ed285d2b852e7be6ffa67b86b12ccb22b7f449bfa9591a7286dbba346cc493", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264535, "uuid": "4a8c8bcc-22d7-4073-8e3c-5546adf58939", "value": "F233F1D09906F0CB9B45BC18ECAB5A038F39DD19427D78D2117ED0C39EA1AB4A349E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264535, "uuid": "cbfa67b2-68ae-47f4-8572-d7b8abd57523", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1Gpyu5q:6Xma7774mfCyWMB/4Gp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264535, "uuid": "a2975494-7c61-4f99-b0ea-a3813fc1979a", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264535, "uuid": "d83f7783-b0c0-428d-80e8-b44e387f989d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264535, "uuid": "21043482-2b57-4c8b-907b-599ba95712dc", "value": "statistic-794699318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e09c07a-b6bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621220947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220947, "uuid": "6592397f-3af4-483e-b435-e51e3cfd8ef3", "comment": "Malware payload (Dridex)", "value": "b9819b09b52865393dab7985a6948495", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220947, "uuid": "39d682f9-aa91-487f-bc8d-3e5c35ec4660", "comment": "Malware payload (Dridex)", "value": "208d84fbcd41cfbf3bc14e7e1c86bf55c2c7cd66b81acf924814422ac9cb7189", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220947, "uuid": "c1e9cbc7-cc05-4686-ba88-d66c0416ec47", "comment": "Malware payload (Dridex)", "value": "e23cdd6e15ac583ef79f31cb6bded19043963a34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220947, "uuid": "ea516882-55b8-4dc9-a6ac-d08bfe8b5238", "comment": "Malware payload (Dridex)", "value": "238aa939fccb4b256f94ad2aa6c756861dbfcf096bc513f3c7c374a3c3a0787135ac49ce5247f4d8f3d025e7fe98f87c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220947, "uuid": "a1be7a31-20c9-48fc-ac37-8c762a704c0f", "value": "FCF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220947, "uuid": "b24eea1c-2d0e-461f-a72b-65f29c16a5fb", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220947, "uuid": "71585aae-e8c7-42f1-af6d-66638d9ee47e", "value": "3072:WA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:W3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621220947, "uuid": "dda87b95-8bb5-49a5-bfe7-7b4295f646ec", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621220947, "uuid": "c338fe06-0921-4f81-a1b9-54b38f79db29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220947, "uuid": "d1444936-c007-42ae-b468-fe922d97bf8c", "value": "b9819b09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b30002-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258750, "uuid": "c8eca0a1-8575-440e-8c49-8cad2c1a76d6", "comment": "Malware payload", "value": "873c54446caf7e86caa747f60ecfd2da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258750, "uuid": "cb1e1435-f14d-4646-99f7-e8bc282f5e6a", "comment": "Malware payload", "value": "20a9e25fb9e3207f79bf48cce5bf510ff7a7e53e0a61f3ef519c554e63e6c334", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258750, "uuid": "be5e14f2-3547-443a-952d-f67304274179", "comment": "Malware payload", "value": "ecdcce3e48b69051f455fab330299a8a954f45ff", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258750, "uuid": "2c679a9d-d086-48ba-b209-1d70509fee75", "comment": "Malware payload", "value": "b23e68c012908f215d1333da2c6aa3a6850856ffa98d5d8350c4905272fbfb5c982eab01e4a3ca230cb61e37704f188c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258750, "uuid": "e4b03a38-50d1-4ab3-816a-a4b1baefcfc9", "value": "5A33F1469218118CCE4BE1EB30F7FAD8E6DD6A430EA9B0D09B7D2745C1A30F1482F65B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258750, "uuid": "78d52cec-c0f9-462c-9c82-8e6648d0a996", "value": "1536:s2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuVSP:dfqhp+g5ru2kmUEt88ACG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258750, "uuid": "377c5343-254b-4d61-8d19-c1aa8442c1b0", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258750, "uuid": "7d4172a3-ac78-4122-a4db-7f9810354408", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258750, "uuid": "b753e6e5-a938-4981-966e-714c50b587c1", "value": "catalog-532362788.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21676ba-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263232, "uuid": "0b651973-26e0-47be-a085-5b03d862507e", "comment": "Malware payload", "value": "b9f54e3ab8fd7b593466229c2175f0fe", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263232, "uuid": "b0023f9e-a8dc-483a-83a8-de989332c17a", "comment": "Malware payload", "value": "20b94384e7612c42c5060f1f55b9dc649f52d1b4500384c56fc4c56c24165920", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263232, "uuid": "df2dd640-b635-478d-9fdb-b618e0bb5730", "comment": "Malware payload", "value": "ed79c906a0312ba5b8e22408e3177f77a9a69bb6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263232, "uuid": "a0d490e1-a5c7-4957-8308-78dc72a65fd6", "comment": "Malware payload", "value": "25a313d075ee3b2a06129b3abf4a9b7c26d3668c5758db2ba4f4f7ada10288c53cd4b958f5415b764ef67cf33d580645", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263232, "uuid": "6c87b644-d8a4-493c-8770-17e91fa5cfc8", "value": "5633F2E0D801E086A755FC58DCAB9D038F39DD5A073DB852027EC0C65F62AB5B646D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263232, "uuid": "b682cc26-4a9f-4037-bd1e-7c663562fb0c", "value": "1536:pXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMObm:9Xma7774mfCyWMB/4GpCObm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263232, "uuid": "6247240d-b595-4080-8f18-eb9cd8b58eff", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263232, "uuid": "de44e03d-9810-482d-8bb4-89afa5777cf7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263232, "uuid": "a877ad29-8e89-4de9-8800-1c68da3f61ba", "value": "statistic-1753539354.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c999ea1f-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259835, "uuid": "199cae5b-97e6-4937-8478-864255479ffd", "comment": "Malware payload", "value": "6fea86712007bd6c0ee07fcc5fdfcd6d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259835, "uuid": "e68e18be-bf6e-43ce-8222-df282d93128e", "comment": "Malware payload", "value": "20c21fba328a3e3159eca680fcf5ad8255d78430f81399bc546391e69b4a1ba9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259835, "uuid": "7898711b-ac82-4c80-906c-6db630970bc7", "comment": "Malware payload", "value": "def551d10cf289c1476bed4235609d6fb28b7e88", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259835, "uuid": "038c2b3c-5ea2-4b0d-b9b7-ebfdac37d521", "comment": "Malware payload", "value": "7670cd5953fb1fc0c1790867c49ed92cc269cbab9c3138a219cbdccaf7604342bb68de1e617737d3c91e71582de98633", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259835, "uuid": "650e198a-7c0b-4a6f-a43a-9236b026c254", "value": "3D33F1754BECCAA76C32D1BFC4C6F845FFB28421C897872245F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259835, "uuid": "78687cdd-e36e-4596-8329-26b1d13cdf41", "value": "1536:6jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wb:qB9wzbqtWb08UscYJhnpjyq9qEK0wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259835, "uuid": "2c52f9e4-72d8-4600-abe9-73ae01eed5d8", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259835, "uuid": "f61dc1b8-4bb3-4d07-b6dd-8afc6c184dd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259835, "uuid": "8283501d-8ed2-4ab1-879a-7e72fa5073f6", "value": "diagram-1380389200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac13e180-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263222, "uuid": "5e9d4e01-1f7a-4911-9eb5-405bb591a104", "comment": "Malware payload", "value": "b3dac239da17cf7831c595712fe855f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263222, "uuid": "423cd669-2077-4519-8f67-74b805a7c45a", "comment": "Malware payload", "value": "21160deae505238992468ce6c0e28d61860cd6c92199bc4fdcf24d40510de0d2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263222, "uuid": "aa0ca7da-0ab9-46c6-9cc9-c7d85ad74418", "comment": "Malware payload", "value": "2239576b75930934fabfd19a75eea97685e142b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263222, "uuid": "1b262260-3b40-4818-b87b-d4780ce6ef59", "comment": "Malware payload", "value": "289596b532f5869fcc6f456f84a9c1e71da94742fea5cfef6cbcda870fad4c35f3f357a5af3cdff01b36105c6095e761", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263222, "uuid": "4a0f23e8-4177-4717-8135-47626aec0db0", "value": "2C33F2E4A507E047A349B85CDC6E5D038F3DE91E433E7892022BC1975E61AB7A245E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263222, "uuid": "d54dec1b-2d02-46c2-a18b-619c8ca0049a", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZa2:cXma7774mfCyWMB/4GpWvZa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263222, "uuid": "77dda1f9-4188-49af-b578-666118dbbf3d", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263222, "uuid": "ce3b45d1-9a08-46ea-8cf8-2fb8e040e07a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263222, "uuid": "6a38a48b-c30f-4192-94fb-9f96d29e7647", "value": "statistic-1751478344.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039e2686-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259503, "uuid": "2eaa95bf-1e2b-4c43-a911-35bdd83864c3", "comment": "Malware payload", "value": "77273ed5f392b0e47fddf53c223e2a9c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259503, "uuid": "dfcac191-cb62-4c40-9ea9-3e512664aa4b", "comment": "Malware payload", "value": "211a749175ed275dd533ee5081cc350b04e9646d4bbad3c1230fcbd6a04dfbd4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259503, "uuid": "87e03800-7bfd-466a-a47e-dd462cf71adf", "comment": "Malware payload", "value": "ab4a522b7cf3d86c5c075dea06f5c038d4dfd95d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259503, "uuid": "afd60f08-6328-4bd5-bc61-98f8169a8a70", "comment": "Malware payload", "value": "a6be727090f85452e4a2ab8d430e335fab71118825e448a80d5d4040cf783c922e6d52bba98b01d3021ab672a6f524c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259503, "uuid": "f4db042b-3e12-4cd7-af58-a6951050c97f", "value": "AF3302714BACD9F628B2E46FC88BF504FFB1C495C4D7862649F871C8B6902559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259503, "uuid": "7925d774-c564-435e-82c6-766e6750ee25", "value": "1536:ojfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXsU:IB9wzbqtWb08UscYJhnpjyq9qBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259503, "uuid": "21e903e4-47fe-454d-a772-2382c0a9a6ae", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259503, "uuid": "ab1eca51-e5de-41fd-8ad0-60ab5e54da02", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259503, "uuid": "43baee1c-edee-4c71-8d47-0c4309af046f", "value": "diagram-1097750063.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7f83bf-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263085, "uuid": "2cab2982-4d8d-4c74-a0e0-5779ba2c4811", "comment": "Malware payload", "value": "b668dd5b15b6312421e32cc3e6567cc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263085, "uuid": "b499f52a-9172-4e81-9c9a-27ee54bb2fbd", "comment": "Malware payload", "value": "212e770dc5f594f21e086db4213d2416b01e1dc480abb78ed7b16ab98c1665ad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263085, "uuid": "018575b9-c7da-4487-9c9b-585ce01c961c", "comment": "Malware payload", "value": "13b39e49a50935e4501ba9eed4609ceb49bf23a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263085, "uuid": "8b754908-e121-42f0-b93c-893b47e38a1a", "comment": "Malware payload", "value": "c97346eb4310f898cbc945b4415c13286ba460f2a17950d539e14054d21c7a6f5f2dcb9b8924743fe27b6bf22965da32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263085, "uuid": "c844c879-96b6-4cd0-b587-b7fc2e88f0d6", "value": "143302E09902E087A7597C68DC6E6D478F3CED0A473D7853012ED0874AA26F8A745F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263085, "uuid": "535c3d2d-dadd-422b-bdb5-c23d1b9f7a32", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qAH:cXma7774mfCyWMB/4Gp07Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263085, "uuid": "dbad7e8d-5842-412b-a8ba-81a3683c591e", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263085, "uuid": "555b9296-5c34-40b0-bf1b-4ef4862f61eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263085, "uuid": "ed25b3b2-17f1-4781-934c-e10d17fe9c87", "value": "statistic-1619779179.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac985bf-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263112, "uuid": "995e881d-56a4-4a45-a6ff-fe3c241eef41", "comment": "Malware payload", "value": "bd8aca37ee9f217711c8e209aaf17541", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263112, "uuid": "740b43a8-2f85-483a-b980-f48a29f67dad", "comment": "Malware payload", "value": "213ff339f04af27408bc1345e0f8107b9b3d367aa85e3ddcfbb0ae86793b4971", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263112, "uuid": "319de2f7-51c9-46d5-809c-9f8f861c511f", "comment": "Malware payload", "value": "ba9ba235cd4152d9993c7cd02e9e3874f61a783e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263112, "uuid": "2b2cc76c-9118-4a58-94a6-d38596de96e0", "comment": "Malware payload", "value": "55f3cdc36385aec480a25be67b255b6f8facbd064cfac33381a32a3bebbb7266844705bf8d511466b2eb5e343402e487", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263112, "uuid": "53983c61-7b58-4ba8-99eb-43254253c751", "value": "F233F1D0A905E0CBD749B84CDCAF9D074B7EDD1A463EBC92013AC0871E61AB96749D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263112, "uuid": "246451c2-435f-40d0-928f-c1ab0f7f2483", "value": "1536:WXXtg3K7774iXfEz5lnm/hQMOEYus1GplItIrb:+Xma7774mfCyWMB/4Gplrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263112, "uuid": "6cb505ce-c459-4a2f-a36b-56f3648db70b", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263112, "uuid": "52836aa2-7c29-4829-8509-f6500ce77744", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263112, "uuid": "1e843e7e-d04c-4035-9652-4d7eccca664d", "value": "statistic-1646056139.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a035a5d9-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259766, "uuid": "9b7caa38-c7fa-4ca1-99a0-99226c83a4a8", "comment": "Malware payload", "value": "30ec9d6eb020ac0ec52b16fd820b2b77", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259766, "uuid": "0f960564-0dbd-48da-91e0-95be22e3adf9", "comment": "Malware payload", "value": "21463e9ca9fd1a3ffdb415c35f63665d39ee3cb463612e21dee6ed5dcf259973", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259766, "uuid": "8ac37ffc-1367-435a-b7b4-4bdabc933097", "comment": "Malware payload", "value": "fb32896d5b790de9bb0bd89411b3f02a2552af91", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259766, "uuid": "dc96195a-a641-4e39-ba3d-16295fa7f3a0", "comment": "Malware payload", "value": "08669fd4260c9fb49881c83b739e0ffa55352304774f25f9b70cf8819869e613f85c531361a22f297134d80058e1498a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259766, "uuid": "ded0cf12-7bd1-4e73-bcfc-564c37de0127", "value": "B133F1715BACDAE66DB1D47FC086FA04FFF1C8A5D4EA861685F8B0C8B6D02515E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259766, "uuid": "199e5361-342c-4137-93dd-8357dda6c912", "value": "1536:GjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q6770+:eB9wzbqtWb08UscYJhnpjyq9qawj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259766, "uuid": "eaeb1169-ef5d-4383-9720-1512b9a8b366", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259766, "uuid": "b8d64835-08a2-4cc2-a76e-4630e07f63aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259766, "uuid": "6953ac91-b2ca-468f-9a67-e6df66229fa9", "value": "diagram-1316335722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4caf704-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216931, "uuid": "b5c9dbec-a461-4e52-b27f-2a1245569555", "comment": "Malware payload (Dridex)", "value": "fb5044b2b236f8fc8605887166c860e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216931, "uuid": "300d819c-ef86-421f-ae34-00da450a885c", "comment": "Malware payload (Dridex)", "value": "21539c7d1d705c5272f659982eaaad35300426349b135ffc9c9a5cc9fbdae017", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216931, "uuid": "62302294-d009-4fe0-9882-273316eb44d5", "comment": "Malware payload (Dridex)", "value": "f71d401643b1db9276cfb25d9d13322710307480", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216931, "uuid": "4058cfe0-4c1a-4c61-b04a-138b7798e5f7", "comment": "Malware payload (Dridex)", "value": "6c810d4b0c6f158a84d7bffaa73aacd30e5575469c06114d0174343c5f1e5f1cc75f0ee31a4571301968763f3e18c578", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216931, "uuid": "125d6d9a-e9d9-460d-b747-f9f721896716", "value": "A0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216931, "uuid": "cc5d0247-cd98-431d-9c4b-b7cf00daa290", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216931, "uuid": "aa92fd7d-e1fa-4cc0-8334-e6c36e3b9c3f", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216931, "uuid": "8749a262-8dbc-41b4-89ac-2a0dfca37332", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216931, "uuid": "4fdfbd20-792a-4eac-b984-2196324beb9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216931, "uuid": "4e55fa05-391e-46c4-98f2-03403481b229", "value": "fb5044b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424299f2-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263903, "uuid": "4589e84b-2c84-42d6-b6fd-6ed5fe063745", "comment": "Malware payload", "value": "35294249426c0ff5fca629a500923426", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263903, "uuid": "dcf0b758-5ffd-49e8-96ea-da0a771c8fcf", "comment": "Malware payload", "value": "2156f21503826d577c6086de98de6f64a327679369596ec03a9efef38e376104", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263903, "uuid": "e6012360-47b9-4acf-be4f-3711bb5ee8fb", "comment": "Malware payload", "value": "f1190f95a4ccc2e385fee2e79d42a029f980a758", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263903, "uuid": "b129b4f0-42c3-454c-b3a7-906be65c1bcc", "comment": "Malware payload", "value": "e12df253b9cb606ccd24b4b2e317fde860c3746f04af3238442692f0a4447598ed54602edeba0b1682a6cd73759f6177", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263903, "uuid": "c215549e-a9a6-4200-9bd6-53c1c61bef02", "value": "5B33F2E4A507E047E749B85CDC6A5D038F3DE91E433E78D2022BC1D74E61AB6A245E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263903, "uuid": "0cbb6cb6-8b2c-40d7-8bde-56fe5194dc50", "value": "1536:tXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZgf:5Xma7774mfCyWMB/4GpWvZgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263903, "uuid": "e7c124c0-3db4-43e5-b2ed-a5dcacd06723", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263903, "uuid": "3c941396-e8bd-4ca3-82d6-da8c7a0bf6f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263903, "uuid": "ab5d2374-051c-4909-ae2d-759c98e017db", "value": "statistic-34533351.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015a75a7-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261647, "uuid": "f6b491dc-134b-40d0-886e-33f462e5f3c4", "comment": "Malware payload", "value": "e2f237af04a6379b2ab216c44def7069", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261647, "uuid": "6560257a-0e6e-4dc2-9a06-9ef60b7ae4c0", "comment": "Malware payload", "value": "217d65f2f1bc708b6c4c516f76360dd355e3a07ef6694075334d47fca3cdb5d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261647, "uuid": "8a5353e7-7a06-4ce2-98f8-26703c5c5320", "comment": "Malware payload", "value": "13dbf7836c3d93a99274234338d163a18e4f99a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261647, "uuid": "7f918d41-2feb-4c91-ba51-0a20ef28d5fc", "comment": "Malware payload", "value": "a1cf3aeca63e2dce9db4db09a2aff7285b6d3c1c45a5ab0f19b6a9a99ec30ecf538685a86e43f7f5065f279c31de5804", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261647, "uuid": "28ca6352-0a8e-4443-9db3-feed816bd9ea", "value": "1A33F17547DCCAA76C72E0BFC4C6F845BFF28421C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261647, "uuid": "5c3544e2-5cac-4395-941c-d40432a7b68c", "value": "1536:ZjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wX:9B9wzbqtWb08UscYJhnpjyq9qEK0wX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261647, "uuid": "d00690df-80d4-4f6a-975a-671a44fbc33c", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261647, "uuid": "ff97c3e6-0768-4d73-908d-54ff841d2925", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261647, "uuid": "c6c84cea-f947-4fbc-bf04-035067d20c57", "value": "diagram-698639690.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e118f29-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621264487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264487, "uuid": "8facb9eb-6d44-43ac-80f5-c3f332efe7eb", "comment": "Malware payload (Quakbot)", "value": "8c5b1c922af1d3354596f0475d7e51c2", "object_relation": "md5", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264487, "uuid": "85580aaf-a614-4157-950d-a4078d925b7d", "comment": "Malware payload (Quakbot)", "value": "2180f44d8bad0c1f09d668f1134786ab1eff2c72412c8491a8ba1b8a6c97362e", "object_relation": "sha256", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264487, "uuid": "109c848a-0eb6-45af-aae4-e738f69bcd32", "comment": "Malware payload (Quakbot)", "value": "88847614f41b250a381d78472984c2a6fe57ecdc", "object_relation": "sha1", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264487, "uuid": "1ebf613e-4462-4892-900b-9606276010ef", "comment": "Malware payload (Quakbot)", "value": "328c0fcbdda74bcc09db45c72823b74f100a46af9529694304ddb974ede6800bb0183c93d4c4dd9c6714c8b4ea839b5a", "object_relation": "sha3-384", "Tag": [ { "name": "KREATURHANDLER BJARNE ANDERSEN ApS", "colour": "#36BEA7", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264487, "uuid": "dbdda708-325b-4a46-867d-8b418cb56504", "value": "6CE4C027F690CC37D1732A7D8E4B42A4A8297FC0FD2469562BE81E4C5F393C63626197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264487, "uuid": "897241d6-b395-447f-9e19-4ae0efe4bd2a", "value": "af342d645db2fe01e0cef0eeb0587f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264487, "uuid": "3318189a-f67e-4a7d-808b-c7296bc995cb", "value": "12288:Bkw+sg2La14HUGxAdepWD6rlKRfeEJuBnitAL6wxloYm8I/BP9mmB+:u4PC4H3xZrk1eEJuBPOu+99z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264487, "uuid": "2e8b1022-03cc-4f12-b1aa-cd61490ba698", "value": 691664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264487, "uuid": "068002da-4556-4121-b4fb-920f94a92c31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264487, "uuid": "5039eb1d-1cf7-4106-8648-e7160376ba0d", "value": "2180f44d8bad0c1f09d668f1134786ab1eff2c72412c8491a8ba1b8a6c97362e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0131d356-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261217, "uuid": "9eed7837-8d17-4337-9f6d-8b562d87d7d8", "comment": "Malware payload", "value": "1d46babd492ee9848df6f1c35f01398a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261217, "uuid": "f102ce58-6dc0-4c1b-99fe-b3aa30535fb6", "comment": "Malware payload", "value": "21bb458bda1444bdf34dcbfaa24dff9ebc38299a630f29b106b167de11acc4a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261217, "uuid": "f6d8e8f7-3f8b-4632-9492-3260b1667b3a", "comment": "Malware payload", "value": "06e790bd95eb3c35b13021bdb5fc8d8a9284fb6d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261217, "uuid": "1172feeb-5e2c-4837-a2c3-25ce0492025a", "comment": "Malware payload", "value": "616578b3f2f88e2c9db170157ce25d1c5f3426b3efe65b702abcfed10e98491c802a34cc45cea8f99caf218741de9ea4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261217, "uuid": "b81b0c4d-64fc-448f-a194-210c2976d4a0", "value": "3133F1714BDCCAA76C72E1BFC4C6F845BFB29421C897872249F9B1C8B5E52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261217, "uuid": "161e0172-a490-4ce6-9de0-f90b02273e65", "value": "1536:1jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wj:RB9wzbqtWb08UscYJhnpjyq9qEK0wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261217, "uuid": "d11b7206-cacb-4404-b4c8-61fa154ec4d5", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261217, "uuid": "067c9232-f950-4428-b320-cccc5fe714d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261217, "uuid": "803ba49b-4daa-444e-a5d4-617cd96e0eeb", "value": "diagram-414082561.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27c5d5a-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264548, "uuid": "4dafd89b-8f3b-4225-9cd1-493d144a53f5", "comment": "Malware payload", "value": "89c4529fabb0d9f333da84fe9ffef524", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264548, "uuid": "b642736c-6181-4b72-b612-950157abb720", "comment": "Malware payload", "value": "21c907efefff8db3789fa9915f8ebb0e43cfb84123acb8a5edd713a8d007e446", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264548, "uuid": "57371bb8-07fa-43f2-b150-35f5685b0a4a", "comment": "Malware payload", "value": "0d46acdfdff9101d7b3eb2eaa882d5f8b1edb097", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264548, "uuid": "287cd988-7132-4e4b-b600-286df0950d82", "comment": "Malware payload", "value": "d617e54c16534bd0fe7d38a4eb8e934beedf9dceb48057f8e0b05052711b4f61b2590159459292493389a45e5d0dc636", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264548, "uuid": "dbd12df4-7517-42c6-bfaa-a2f2438d9026", "value": "073302E49507E0479748BC2DEC5A9D038F3DED1E033E78D2126BC1975E61ABAA245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264548, "uuid": "469d89c2-59b7-4b75-bf75-80e72a9d4111", "value": "1536:fXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ5:fXma7774mfCyWMB/4GpWvZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264548, "uuid": "3b15db88-8672-4b68-991f-ae696cb891cb", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264548, "uuid": "56e7e16f-8a61-4800-92b7-cfe61908e437", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264548, "uuid": "72226e2c-f535-4a60-84a2-75f704256c20", "value": "statistic-800657269.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a480f8-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257356, "uuid": "6dd9ce6d-559d-4f79-afde-87be11e31e61", "comment": "Malware payload", "value": "89f92dd11bafdf9be2a6c8c94dc45248", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257356, "uuid": "2ce9e412-913b-46ec-9476-77b752191982", "comment": "Malware payload", "value": "21ddcf51ee3bb8d3d868bd57fcf8cbdb7721369178bb26ed0488c39fa085b19c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257356, "uuid": "37ace512-c452-451b-a165-7b9d45c10837", "comment": "Malware payload", "value": "9333035c4267e79fa261cd3baae70192616c6a31", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257356, "uuid": "6b05d0bc-6113-43fe-80e9-8ae0789dd58e", "comment": "Malware payload", "value": "fd3c809e4a075fa0d6dc0750a5d7c37ebf2e9b52472ef46e82df6fcda8c87e7b8bf1213decfc2e9ba0e80d7d914d65c2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257356, "uuid": "7c9533e0-429a-437a-be51-d17e94ade764", "value": "6333F1919554118DCF4FE2EB70F5FAECD68E7E130DA978C0AF6E2B4581930B1092E58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257356, "uuid": "8872ced6-786d-4a59-a1d0-495a517a8765", "value": "1536:E2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIh1H:1fqhp+g5ru2kmUEt88h9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257356, "uuid": "10ee8496-c02f-450d-9cfd-e1f93710cfd7", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257356, "uuid": "36eac933-d122-46f3-bd4b-94ddca7a4e08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257356, "uuid": "bdb2aadb-4e96-430e-bd4b-4d971b46ccaa", "value": "catalog-1513758516.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afb59e5-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261717, "uuid": "358dce4f-06b7-45d0-9b73-b0e53799d11b", "comment": "Malware payload", "value": "d0f70a1fc546961aac402db8d62706c2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261717, "uuid": "0365c2c7-123c-473d-97f9-9e7dbc6c57d6", "comment": "Malware payload", "value": "21fff0274125ce4bf2da26b7cf37abefb28375db134fde5fd3b5930fdf9d3974", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261717, "uuid": "9850d3c1-c7c2-4700-a495-4a0e1acda829", "comment": "Malware payload", "value": "624215830aebaf05fd6096d50bf6d8642d07e070", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261717, "uuid": "ad6eedfb-fce6-452b-8f74-49059fe4d6d6", "comment": "Malware payload", "value": "f51173a0f024c76b45e9a88de6a4c887130f3a2c068fc01eaa948e6912985f784f71c61143cbe6e328e39ec3b1f814e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261717, "uuid": "8f65ba3d-ea27-4b07-a0cc-a7f79450af43", "value": "8A33F17147DCCAA76C72E1BFC4C6F845BFF28461C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261717, "uuid": "ac903e02-ecf3-4571-8fee-64b01ebd0006", "value": "1536:qjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wE:6B9wzbqtWb08UscYJhnpjyq9qEK0wE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261717, "uuid": "ff980731-89f0-426f-ae81-c8bd27e5058a", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261717, "uuid": "f9b19c1d-960b-4049-a44f-d61841f355c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261717, "uuid": "b48acc00-968d-4cc4-a81b-fc9eb3301007", "value": "diagram-744471642.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabe3f1c-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257341, "uuid": "eaf0a572-1f23-4ef0-8ea3-d79596b27cd9", "comment": "Malware payload", "value": "7291286ae28373fd18cc0ac0e2e9e501", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257341, "uuid": "5d7f3ed9-c643-4694-a1d4-a0a10bbeee7e", "comment": "Malware payload", "value": "22171f04c576baa3d9f6808d6f45cb70b5f85712a6990b8223320c580bc6bfad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257341, "uuid": "56cb8646-664c-4549-a074-78b21860b685", "comment": "Malware payload", "value": "aff5232726a2ebb46284b8457ffec5c2b5c59d8d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257341, "uuid": "c1c7b917-88c6-4d3d-a5d9-67be7e690415", "comment": "Malware payload", "value": "eafaa9587d53f9a4452b8d25b2540ae4d99b093c2c2c88bdfa473714bc78812483f1a8a53dfad5e047589039c9a299b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257341, "uuid": "1f672d7c-42f0-483c-bead-9c8bffa143c7", "value": "7F33F184D164108DCF4FD2EB70F6FAECE19EBF43099A68C09A6E2A44D2520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257341, "uuid": "5d5f8490-ef61-4451-a6e0-62cc960f5f34", "value": "1536:b2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbu/:afqhp+g5ru2kmUEt88mAbu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257341, "uuid": "e93eb6a8-def2-42a4-9068-90424596699a", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257341, "uuid": "d617cca5-78c9-496c-8474-2a168e340b52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257341, "uuid": "71e3e676-b4af-4f1b-8e42-838349e4ff6c", "value": "catalog-1506348853.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5011bbc1-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260061, "uuid": "f198c7ce-4d14-481a-948f-a4907725ec3d", "comment": "Malware payload", "value": "a3f6a085561c6848e2e4a5f4db22f135", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260061, "uuid": "092a09ca-adaf-413d-a1fe-728499d33dc7", "comment": "Malware payload", "value": "22409138a0f780a7812718d47b0ae2f94ff812e08fe491b958dc51834a5d60f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260061, "uuid": "8b838761-ddca-4f15-a192-aa097d306a32", "comment": "Malware payload", "value": "e3452e1431e6b6b75298c6668cf8cdf8a5398ae8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260061, "uuid": "fb3fd55c-d907-475e-8898-bfa61ed0410a", "comment": "Malware payload", "value": "e34918724a29cf0cc77e2e4925b4e830d11fe98c62eac8aba878abf968dd894d09a0d2dff6a8cb2d9cfa99eea41d1182", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260061, "uuid": "c67feaba-06eb-4cc5-8f24-5276afc5e0e5", "value": "2533F13547ACC9F629B6D0BFC8C6F604FBB194A5C4D787224AF8B1C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260061, "uuid": "11b07506-4289-4fa0-b05b-8e5f4a8536dd", "value": "1536:CjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXT4E:yB9wzbqtWb08UscYJhnpjyq9qBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260061, "uuid": "55a2cfaa-9f94-44c2-8adf-cd47d6fe9c85", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260061, "uuid": "4e5ac6dd-389f-4ebf-86bd-8222f3d59700", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260061, "uuid": "4dae0739-5a0a-4885-afef-52b12c9cf2a5", "value": "diagram-1551451375.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6a49c0-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261315, "uuid": "fc24792e-3a1a-4d8b-8beb-e2c4ca3cc1dd", "comment": "Malware payload", "value": "665d86c5be1334d8bdfa7fbdd225add0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261315, "uuid": "01a77090-c869-49b7-80d7-875681a5ab8c", "comment": "Malware payload", "value": "2245627e5eabc21be7ddb371126f4a86da2b1bd9f6e6ee3c65b21885f0ff4573", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261315, "uuid": "c861bc54-2b29-4329-93ca-5f461afc1592", "comment": "Malware payload", "value": "86e084931479e48a2e0473ff7ed5d1bc50d97d88", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261315, "uuid": "4342c3fc-1074-4527-9920-361472d47a9f", "comment": "Malware payload", "value": "2a393abbcbb6aa6fc98497bd038dd019cf29bc9bcf07206f65f8d380796522ee0d3bca688df0e2ba45a9423c9073bd5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261315, "uuid": "aa565603-a722-4f86-9a6b-e9288a01602d", "value": "AA33F17147DCCAA76C72E0BFC4C6F845BFF29821C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261315, "uuid": "7fc88e51-45f0-4999-b1f7-cf4ce3b2c694", "value": "1536:3jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wH:TB9wzbqtWb08UscYJhnpjyq9qEK0wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261315, "uuid": "845c55d2-c281-4323-8cd0-c5c02a27443f", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261315, "uuid": "03be2c37-8244-4392-88d1-697cee3984c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261315, "uuid": "9b115426-cc9c-41c8-b4cd-0fd6a37b123b", "value": "diagram-455031670.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea8a2c8-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259388, "uuid": "52ef25be-2c43-4574-8c0c-82ed5de3c1cd", "comment": "Malware payload", "value": "afbabf60c3a56c4f98dac173b8892045", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259388, "uuid": "dc535f67-ca29-4eb5-a477-41d9dadcb3cc", "comment": "Malware payload", "value": "224a2ba5117c95af3cd27de353664797a90465fba2d595b118482d0113a53a25", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259388, "uuid": "9ad5a23f-8021-4b16-ae26-74043832abcc", "comment": "Malware payload", "value": "62027571aadbddf10c615f565e1b97d7cd6636be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259388, "uuid": "9709be44-aab9-43b9-906e-d2759b991daa", "comment": "Malware payload", "value": "f85dd1eee9132f783ee799e7cb6be996d18e70930a5a7fa29e361e33c3590263ba3e35a5b9d0fb299902c603ab139eaf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259388, "uuid": "efbefdfa-b2f7-4aa3-ade2-deecea6c0f8d", "value": "C133F17147ECCAA76C72D1BFC4C6F845BFF28821C897872249F9B1C8B5A12564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259388, "uuid": "35a4210c-d802-4e04-8f01-92c5ecf6871e", "value": "1536:wjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w1:wB9wzbqtWb08UscYJhnpjyq9qEK0w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259388, "uuid": "929fa3b6-328c-4eb6-a19c-ea45249888ad", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259388, "uuid": "1c355eb1-ffc1-4b26-bec0-6ed057ba6f72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259388, "uuid": "006961fc-7036-40bf-9a94-024a0117e579", "value": "diagram-1019211958.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e3bad8-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257868, "uuid": "95ac8c5a-faf5-495b-9ee1-46f6448989a0", "comment": "Malware payload", "value": "083bd19c8e830c02531dca38f0d909d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257868, "uuid": "dd65e91b-954a-4b0d-a28d-868aa3adbde5", "comment": "Malware payload", "value": "224e3bef4f2a37e03ba8ba0440025ed645efb69985f0070670b1c2b6556e4161", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257868, "uuid": "fa086693-441a-4a07-9bb5-db1e715e5c39", "comment": "Malware payload", "value": "491bc68505902f0bb3afca521038d8c6204295fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257868, "uuid": "d48ebe89-cccd-4f60-a502-1a0f49b3557c", "comment": "Malware payload", "value": "670ae57a8ce522d9b0c297445d36ee9ef2ed434d849b63552ff73931e6ea53ecea306bfa2fe68a6ad9b0e2c95ee649ef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257868, "uuid": "48a220ca-75a9-4232-858e-7e8396ea35c0", "value": "77330186D264214DCF4FD2D630F1FACCE5DE7A830DAAA4D0A62D2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257868, "uuid": "9323e5b6-9cc3-49d8-ac47-ca16d1c2282c", "value": "1536:O2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ31:zfqhp+g5ru2kmUEt88Ix1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257868, "uuid": "755b533e-b0a3-4795-84c0-a2126fc846f0", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257868, "uuid": "4f087384-5b89-4e65-994c-05e3e170703d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257868, "uuid": "747d8571-58e7-4b5a-bdc5-fdf3a6c4fccd", "value": "catalog-1931305937.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282e9c4e-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259565, "uuid": "33f19b45-086e-4545-99ee-de4e1c3cf9c9", "comment": "Malware payload", "value": "7983d61909cbacd8be985e219d7b27fc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259565, "uuid": "0ebc8a09-2996-4467-b3c7-f18a701c5241", "comment": "Malware payload", "value": "2269954b93351c20c87d417a2d2511268715681af47e54f996aaa94b8a93ad9f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259565, "uuid": "30beeca1-5a15-47a8-9316-c1da2957667f", "comment": "Malware payload", "value": "3731e722bf3242daa7c369198fc5d4946647f6f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259565, "uuid": "b117c8a5-383e-49a2-8139-ad3d45eb5339", "comment": "Malware payload", "value": "a831900bc78746dbbfd11eef2281e82331b589a58e009a69788ea7f916d3888373d0d28dcbd3b718a811842688876bef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259565, "uuid": "06ca9123-e959-431d-a35f-b69a7e79b1cc", "value": "F43302314BACD9F628B2E4AFC8CBF504FFB1D459C4D7862649F8B1C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259565, "uuid": "7528c7e8-a3e9-4309-bdde-a76478923a1d", "value": "1536:zjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXk/:HB9wzbqtWb08UscYJhnpjyq9qB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259565, "uuid": "a36bc3c2-64bb-4cfa-8505-ed1c61b3e9d3", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259565, "uuid": "d8fafb39-688f-4577-904a-fdd85b50933b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259565, "uuid": "f4329373-3874-44da-913d-133bcba16d5c", "value": "diagram-114655709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbbb469-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260540, "uuid": "df1b8ce1-91b7-4caa-a81f-20efc8df328b", "comment": "Malware payload", "value": "d2a90688a7657d4e4e0d6bd943d2986f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260540, "uuid": "34af7d7a-ef17-4d0f-bf78-0201d6d9d8a0", "comment": "Malware payload", "value": "229c9f1bc18a944b78cf5a3046f544ed8bf1e7d14d25a345a457afcccbfa6983", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260540, "uuid": "5230f1c0-e379-4823-b671-61d32fa7aedf", "comment": "Malware payload", "value": "ad67a3a10ccd6da102a227678f2d3f7a323d6ea3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260540, "uuid": "b9d25850-0a49-4c74-8db7-e91a5643d1c2", "comment": "Malware payload", "value": "46c6d0c8a4df081694c07709127c114d8fda598fede1ca37ae80544f6cea14c2a22a4a4f698a41c7c46a7a22d4f8ba99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260540, "uuid": "35648a30-88e5-4050-a111-a1749e1eb91c", "value": "8533F1354BACD9F629B6D0BFC8C6F604FBB19495C4D78A224AF8B1C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260540, "uuid": "adddab07-96a6-4e4f-8e2f-6d8016b1e904", "value": "1536:+jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXN4V:2B9wzbqtWb08UscYJhnpjyq9qB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260540, "uuid": "771d97eb-10d4-486c-a7df-1c6f8eb9f4ca", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260540, "uuid": "463907d4-e2cb-4f90-96f3-ebf963cf1271", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260540, "uuid": "65af129b-ce89-4130-8e86-e542fb4b071e", "value": "diagram-1863222866.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f1e8e1-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257388, "uuid": "b25abf0b-de83-441a-bbe2-c359cb9fcc97", "comment": "Malware payload", "value": "d032262e508446a53bf74532b75bf0b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257388, "uuid": "58bb86d6-7ec5-4b69-af6a-767e0fbf95e6", "comment": "Malware payload", "value": "22b3ff37dbc2a0740cbd456cb76e1271b53c8f79ee6f6d298d67131ac6f76d41", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257388, "uuid": "6314c572-0998-4d30-bcd4-416ad2a911dc", "comment": "Malware payload", "value": "255a5ef6a44d588061c00dfafd8846e15acaa6b0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257388, "uuid": "475c7c1d-5879-43af-8d3a-5afe6e3afb35", "comment": "Malware payload", "value": "43092aac068bd7256270ab540cddb47a69900e46e873c3a91710e97fea015db00bce625c625f28ee1bdaebb6106e6b0a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257388, "uuid": "46f0be78-c389-455e-b8aa-86721a158b04", "value": "4333F142A654118DCE8ED2EF30F2F9D8E2CEAF5B0E9964D0576E274581574F1082F68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257388, "uuid": "ca46e4f3-aec8-49ed-838d-bc74eafa20a8", "value": "1536:T2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIs29G:yfqhp+g5ru2kmUEt88s2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257388, "uuid": "e6128db5-6ac6-4d39-907f-2967ce203a07", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257388, "uuid": "a8a5c816-f9b9-45bc-acb2-6f4636e83c4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257388, "uuid": "2acebba0-9670-4c42-998f-32d04e4bdffe", "value": "catalog-1545303218.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f3e23a-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257172, "uuid": "a040fe8a-38ba-4a77-a968-0721a3228f54", "comment": "Malware payload", "value": "867b64b405449605bbfaf011e122fac6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257172, "uuid": "77736816-1e5d-458e-b416-0a50c16bc45a", "comment": "Malware payload", "value": "22be9393df3f6dc51c4dd235268bf3170addeae0015813bd58430e9f50d27c0f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257172, "uuid": "d313afbf-58a1-43f8-b19e-9b72d510d1f6", "comment": "Malware payload", "value": "2b67545c61dcd730fd3ece98bcb760d34e936272", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257172, "uuid": "80c7effa-f243-425b-8ed6-cb77fab860df", "comment": "Malware payload", "value": "7b99e464b9302ab389840374350278d2a2617d22640b66ef74f3142789b61c075b58863df782259b79a936dea5db2771", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257172, "uuid": "be6dccb4-ecc4-4224-9c36-853039d8b387", "value": "3233F194D164108DCF4FD2EB30F2FAECE1DE7F43099A68C09A6E2644D2920E54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257172, "uuid": "1f4885d2-b218-4fdb-974e-6327f1c56dfb", "value": "1536:v2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbz+:efqhp+g5ru2kmUEt88mAbz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257172, "uuid": "43104d44-9c1a-42b0-aae0-8a40a0ad3d01", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257172, "uuid": "46079913-3ad4-4347-88d5-3d2769c7fe8f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257172, "uuid": "8a441b07-764d-406f-8708-dc9005d11669", "value": "catalog-1402022826.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a79c14-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261325, "uuid": "790ffe1c-f3b7-4e0d-974d-0b79eff866b6", "comment": "Malware payload", "value": "6cdb379da6a47bce266fce5458211532", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261325, "uuid": "b1541c82-5424-400c-88ae-0a3cac8ea90e", "comment": "Malware payload", "value": "22d47b5b2896b5a016ef7d9bfa0e42772f2458df3fba64f5eb876bc9997d82e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261325, "uuid": "fbc44c24-1c10-4b26-a6d8-2fa2eae3d81e", "comment": "Malware payload", "value": "39aa5268cc39f117ed6246e147d66638441b2e3e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261325, "uuid": "3be280a2-3c22-4026-af6e-b76fff0a3c5d", "comment": "Malware payload", "value": "1cbf595786d1b5e4a36bfff93165dc260c1351d9312c86ecd6e54046d8aeee804c8f3de491bd092a957f309fbc93e3f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261325, "uuid": "85d05d8d-e1d5-4ecd-9fb1-01cdcfb42cff", "value": "3C33F17117ACDAA62DB1D47FC0C6F904FFF1C865C99B861689F870C8B6D12559E31E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261325, "uuid": "d8deaafa-a102-46a3-bf83-dc1025a2380a", "value": "1536:ajfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67++E:KB9wzbqtWb08UscYJhnpjyq9qaw+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261325, "uuid": "0f3b746f-638e-4874-83d5-3329dc7822ac", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261325, "uuid": "4c6800c2-e6c5-419e-8313-a182fd64d884", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261325, "uuid": "cd4df8a1-1c87-47ce-9dbe-e52165edda4b", "value": "diagram-46454201.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4616db-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257582, "uuid": "2e0bb55b-2f91-4fd9-a761-d9c41180ba58", "comment": "Malware payload", "value": "0a0ce424f5da6c458f26bb83e4be9dc8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257582, "uuid": "28e4e659-c31f-4e22-9410-82aeb43f520d", "comment": "Malware payload", "value": "22e0eeafdd787628436d76aadb4b036517ae32ea426006d0b51f0455a88f2fab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257582, "uuid": "f8be2c89-b4d7-4a24-a64d-6bf4918f5c8a", "comment": "Malware payload", "value": "3bfbbcb07fae241e130988ec18e8b318460277b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257582, "uuid": "24e7f2f9-7d08-4e4a-b1cf-3f0defe0ab86", "comment": "Malware payload", "value": "10c79962b0022d4edeb62169d0365674ecb759d4da7877522ba7ee2fee620c99333fc7c112b9980a0948ee18bc4c1341", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257582, "uuid": "6ebeb8d0-881a-4fae-a22b-cf276ba1e55d", "value": "1833F182E658018DCE4FE29770B5F6ECE67D7A53099DB8D05A7E1B0591934F1082F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257582, "uuid": "ab9cc715-848c-437e-b2a2-5cebddb039b0", "value": "1536:U2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI2FEx:lfqhp+g5ru2kmUEt885x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257582, "uuid": "79edfd98-1762-49be-a7cd-f66b2807c5e2", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257582, "uuid": "8261a89c-c8fd-4bf7-ac32-997a652a21c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257582, "uuid": "82b2df6e-aad1-4fcb-9ef5-0eeb93394695", "value": "catalog-1705355695.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ecd26a-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263312, "uuid": "4c54178e-1a96-4127-b2bf-a9d758cc5260", "comment": "Malware payload", "value": "de8c5ab6c51e60919590409ef5999c2e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263312, "uuid": "4152476c-1dd0-4fa0-8c59-c240b06689b7", "comment": "Malware payload", "value": "22eb31803d25bd3bb577f280496373383f9237769e5d89a9639f3a1952b49c72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263312, "uuid": "39f13de4-126a-46db-a3c1-f5993d999d7a", "comment": "Malware payload", "value": "f41e5bff77db36cf24d47ebce8428ae24d7bb269", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263312, "uuid": "7f4e47e0-51b4-4149-8a7d-505f27e0f754", "comment": "Malware payload", "value": "02b9bb731fd83e47ce8e41da8acce3a50c8718119e6289c2194fd0993e34657f290eb6714acb1563d166007bae8d9575", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263312, "uuid": "d2b35642-c9db-4cc2-8bc9-699f0213caec", "value": "B233F2E0D801E08AA755FC58DCAB9D038F3DDD5A073DB852027EC0C65F72AB5B646D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263312, "uuid": "312bcc31-609e-4f30-a956-c2b01020bb19", "value": "1536:qXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMO10:qXma7774mfCyWMB/4GpCO10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263312, "uuid": "878a1f9c-78a3-4280-a36b-660bc08db9de", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263312, "uuid": "686a4b68-6fb3-4e2e-b1e2-1074d326facc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263312, "uuid": "7c03cc2c-6208-495d-8a45-e3cdb5a3d248", "value": "statistic-181789108.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1360b14b-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257812, "uuid": "693a60f9-a0d3-4227-a1df-4b25ce3f4d9d", "comment": "Malware payload", "value": "fd361eb2dcc6ff3ca8a7d6a6e1e0c8f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257812, "uuid": "c227ef1b-e925-40f6-bce8-804a243a9c37", "comment": "Malware payload", "value": "22fc9dd0cc492f7ce30ac7e2e4f07cf452b1384521856e9ecf6300bbd395c379", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257812, "uuid": "b0d90c74-f596-4c58-8eee-c8c22b662eff", "comment": "Malware payload", "value": "750d3fbf605fe32492715da2448b3bb1242ca8cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257812, "uuid": "36c982aa-b930-4cd8-b1f6-095bb772639f", "comment": "Malware payload", "value": "0b4a73dab709e16140fc97ca80e4a459c5ad6134590f5ca626cb17fc5fcc0bb92951a07835892e198411c68c223596f6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257812, "uuid": "209c8440-11f1-43f4-a3e5-560b48568616", "value": "A133F1D6E158028DCE8EE2AB30F2E9D8E6CE7E53099974D0A7AE5B4091530F1582E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257812, "uuid": "0c61d4a6-0e9d-43f2-9bf7-3efc50cbb000", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jILc:Ffqhp+g5ru2kmUEt88Lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257812, "uuid": "fdae37ca-de5c-4ebb-a920-a91a1c2a0ac8", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257812, "uuid": "f8619d9d-0dd3-4211-a300-33d10cf5facb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257812, "uuid": "1112402b-cb8d-4652-96a8-a5f31e8b2a6d", "value": "catalog-1894677033.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc29156-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262740, "uuid": "89db82a3-0528-4539-b5aa-1e8e72752e6e", "comment": "Malware payload", "value": "f8106b432a73aae2216fe59f92311750", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262740, "uuid": "0cc7e11e-a531-45e3-8518-ae936b45735e", "comment": "Malware payload", "value": "23098aa84cad53ec16ed69f5339267e51eff482fe02e0cbc28903a8c0369814c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262740, "uuid": "0ea02656-22a5-4ee2-9093-726cc32f0a62", "comment": "Malware payload", "value": "16a3cea58c6f9803b2cbb9659390be1356e03a6b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262740, "uuid": "888c4c2e-505a-4742-a2ce-0e8a42ea1bfb", "comment": "Malware payload", "value": "a88acf2f8f0344ad45ba49e037804f41dafd640bf05c531b1f8fb20b482b27f448265cfa252ae5c1eb8d555deb87dd8b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262740, "uuid": "267dbae5-4401-4bc5-9208-24fb16c857f5", "value": "0C3302E0E402A04BE754BC5CECAB9D038F39DA5A477D7893013BC0C65D61BB5B70AE29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262740, "uuid": "c8dc6b05-0f26-41ca-a971-145c565a4639", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1GpjIdgYfZ:6Xma7774mfCyWMB/4GpjIddfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262740, "uuid": "47fce1d0-e5d0-4d1d-b071-15050fc91c81", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262740, "uuid": "bf66e2a9-dad4-49b5-9722-fb3f24e1e3f0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262740, "uuid": "029a47be-4bba-4e6a-b365-136916d1460e", "value": "statistic-1367884312.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fabe1e8-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259309, "uuid": "756609f5-dbfc-4346-b170-8bd7fd2f8613", "comment": "Malware payload", "value": "7091e3808bffb3f24ffe70a3caf925e9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259309, "uuid": "03aa58bd-ed4c-43c2-9a61-247043df533f", "comment": "Malware payload", "value": "2311d12fafd70fb849e0c83106d8f98ea1eedb145c1fc2a8a71fc1f1ec6989d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259309, "uuid": "621385f9-7838-4527-8363-ea7ff3af784f", "comment": "Malware payload", "value": "6db6c7a8acefbd833ff98455448a13037405d774", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259309, "uuid": "a6398f63-e369-40fa-bb7d-40fb1283a050", "comment": "Malware payload", "value": "43a7260fb41fab40d8d029d0e0228bf64bfc49d6ef1f6b692312c01e2cb5605d03c5586839d54e86c9afde0617b06e00", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259309, "uuid": "186c89eb-efaf-45ab-a85c-2a4300dd72be", "value": "5433F146D614018DCE4FE2DB70B5FEDCE5DE7E470EADB4D09A6E2B0180520F1492E68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259309, "uuid": "3a12503e-f35d-4a29-93d4-90cacca76da8", "value": "1536:X2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIQk:Gfqhp+g5ru2kmUEt88Qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259309, "uuid": "157e9524-a113-4cc0-a1da-c0d79f770f08", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259309, "uuid": "9ece05ba-61f5-49b1-abfe-a29d8cbab9c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259309, "uuid": "31666578-2484-462d-83de-f8efa49cda27", "value": "catalog-941433704.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e98eb9-b6f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1621245740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245740, "uuid": "82e1496a-6c4b-4d5b-9f48-50ef67f47f32", "comment": "Malware payload (CobaltStrike)", "value": "c51a976cd395602dff183cdd3b80b4e5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245740, "uuid": "28740abc-05c2-4fe0-b120-654bacc4e2d8", "comment": "Malware payload (CobaltStrike)", "value": "234e4df3d9304136224f2a6c37cb6b5f6d8336c4e105afce857832015e97f27a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245740, "uuid": "94641b8a-868e-4678-aa87-0ad20356bdd1", "comment": "Malware payload (CobaltStrike)", "value": "b25e2c1fdf17a70ddb7f5c57000ab9a626d300d6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621245740, "uuid": "21a79e5d-f424-44b3-8515-e5e3d88f23c9", "comment": "Malware payload (CobaltStrike)", "value": "87d230a2fa64e9e36e41be25c87abab5cb4e6670f18d585c43d153a09be3da60cd2caf071c238c440b69315e2c01a83b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245740, "uuid": "c2abff1a-d6fa-456c-b9b9-39b39a09fb8b", "value": "D854D0697A46BAEDE03F85F495A1B72FFA37C364CDA9A0082D21C717E32FE045D11261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245740, "uuid": "a5d6486d-618e-41b3-916e-acb606a7603e", "value": "5b2b857b553b0a288eea73680491a4ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245740, "uuid": "a5643429-6c23-4421-a378-180e720cd8fa", "value": "6144:Do3W+x7ohxEQanIo0y6rpZ4uzE2UBMmKsn8nbGN7:Do3W+hWxtIKy6rpyuzE2UBXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621245740, "uuid": "20192270-b6e9-46bf-8109-2567905d08d4", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621245740, "uuid": "ee409e1a-9376-435f-be95-40ce271effcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621245740, "uuid": "0850af79-8201-49b0-9a06-fb0c2d437669", "value": "Conti_Cobalt_4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d950e821-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258144, "uuid": "b8e8f138-a23b-4543-b441-2a9b0f4ee037", "comment": "Malware payload", "value": "6a7df92c7c8428f91e2d721a2c82a995", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258144, "uuid": "fda8aa71-9b4f-419d-93fe-8ccf9aeb8b9c", "comment": "Malware payload", "value": "235679de3d066cd45155f4b5f50715f963dbf7962cc5187c050db7f3bb3ca320", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258144, "uuid": "6c634cd1-edc0-4677-ab2a-6dcceebc93f6", "comment": "Malware payload", "value": "e407c228c14887da42845f8808bda190e16038f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258144, "uuid": "62900120-71c9-4488-bfbc-ba5a0275ec81", "comment": "Malware payload", "value": "9d800667f8747ae6ed4596ff3e8f702ee6bedfa16493bc53eeae5cb7fade9ad5b723080dd5ba41a21dffbfa205a21f1c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258144, "uuid": "b84056e1-5ba1-4c84-9950-94866bf9e842", "value": "6133F155A518114D8F8FE1DB20F6FACCE6CE7E430EEAF4D0AA6E1745C1970E0492E18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258144, "uuid": "543f3197-9460-45ef-bb10-1719127762fe", "value": "1536:d2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIpb:Yfqhp+g5ru2kmUEt88pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258144, "uuid": "557bede0-30b3-4597-ba45-90a362e31a43", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258144, "uuid": "337d8411-8598-454d-bab0-3b9e765645c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258144, "uuid": "e88347b9-bfb2-4893-9990-7fc8ef63b31f", "value": "catalog-2126650366.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6a5f2d-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263836, "uuid": "1a07fdf3-9798-4a92-acb8-baaa8b409315", "comment": "Malware payload", "value": "4b11060a60f584d03963610ec1a116db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263836, "uuid": "a9fae072-3da7-43c2-a2b6-fa8163e79a21", "comment": "Malware payload", "value": "237f9c1467a9d2fa5844bb1145fc5a7c24e6c6e56b6567374430e4f66ef17273", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263836, "uuid": "407e12cc-b84d-4ccc-920d-8d5858c7b1b8", "comment": "Malware payload", "value": "bf8e63ac208e3e24608121be2599de0afd901293", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263836, "uuid": "bdd81a12-1713-4596-9768-08ff3011f0ef", "comment": "Malware payload", "value": "ba9a56948ddfc2c3ef339c75099e3390cf8abc36799f3434b2cd73afc0ba63a3dad37750e2d7d20c7a056ab63d00411b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263836, "uuid": "5719b134-7cf9-4dd5-b8c7-db7b6ff7f8fd", "value": "BA33F2E09907A087D34DB89DEC6BAE034F3DD95A023D7892013EC0D75EA26F5A649D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263836, "uuid": "f333ada7-b4ab-4ae3-904d-5ea204bb77e6", "value": "1536:nXXtg3K7774iXfEz5lnm/hQMOEYus1Gp/BuOoU:XXma7774mfCyWMB/4Gp/EOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263836, "uuid": "ea3066b2-bb4b-40ec-8c67-3c98bdae8840", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263836, "uuid": "4a2edcb9-4165-4e63-96a0-32b2758b116f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263836, "uuid": "eaa372ff-56ca-414a-a843-7f26d50e1c1d", "value": "statistic-293788763.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a614e9-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259471, "uuid": "00223b58-f8ad-485a-9572-6ee90dd25129", "comment": "Malware payload", "value": "49d273fdf8440970ca236aa810475016", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259471, "uuid": "bbf690fb-88b3-4968-ac4f-ef5af76a5289", "comment": "Malware payload", "value": "2395b7c5114d9d2de0f61e2093c2b2857370e5eb1e8859e70c44da47f53259e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259471, "uuid": "e6c305d9-9e92-45dc-bb9a-81119b1c9e29", "comment": "Malware payload", "value": "a9575a9ceb9f78b1b71f1fd5c7d500dfa3c60e9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259471, "uuid": "b7a2f205-7fe5-4483-9518-f78916edc14e", "comment": "Malware payload", "value": "7f8a4a20e18aaa3598798b0a4a337a441d99fc17fa73a614b2aff51264fcc68a8b75d7e70bbc1913d22aa9218518bf33", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259471, "uuid": "54dc3e38-2426-4e61-8dec-568e0351ac06", "value": "1A33F17547ECCAA76C71E0BFC4C6F805BFB28821C897872245F9B0C8B5E52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259471, "uuid": "020a2c14-a41f-42b0-83a8-7946da288dc9", "value": "1536:+jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w2:2B9wzbqtWb08UscYJhnpjyq9qEK0w2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259471, "uuid": "627a649c-30fa-4c24-9b69-4ca04e282dc4", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259471, "uuid": "095b5a50-1f74-4d65-aa74-b5b82aa39bc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259471, "uuid": "28ebc265-953c-4463-b44b-538d60fe70b0", "value": "diagram-1079269001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaac780e-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264079, "uuid": "4691ba1f-e45d-4ebc-85cc-ab1135f4b7f3", "comment": "Malware payload", "value": "a1781b2cd19c638e3da3152cd9c6e81c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264079, "uuid": "fafa2501-1a89-4f61-afdf-d14477df95d4", "comment": "Malware payload", "value": "239c93f83a1005cb53115cf2132c0762f0526195d64aa3c178a2c6cd3cf3d1c3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264079, "uuid": "303a00d3-bf38-4968-9b2a-fc0a565e8abf", "comment": "Malware payload", "value": "83dc38c98f88adeaa8e2c9944800336a13d8a018", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264079, "uuid": "b25f7e37-f89d-4435-8c75-4ab2dae2cd57", "comment": "Malware payload", "value": "a948a166e32fdc7bdc4dde9b255d481be61cf6c197633300de94f4f36c0ba0a27be296e64e4a2be7cc30cab6f4bfb4ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264079, "uuid": "b89cb35a-1448-4fab-862b-dd154ce6f34e", "value": "9D3302A0A906D087A759B85DDCBA6D038F3DE90A473D6C53013ED0874EA29FC7645E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264079, "uuid": "1fbbc51c-44e1-4d24-a057-01ddf39d4838", "value": "1536:1XXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qHxJ:RXma7774mfCyWMB/4Gp07g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264079, "uuid": "40648cd0-896f-4b5c-8193-6cf822fd3edf", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264079, "uuid": "9bc364a1-72a8-4a56-958e-e80127422f46", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264079, "uuid": "da1a6432-2eb7-4cd3-96fe-a7f84dc73f9c", "value": "statistic-466701087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fbdd44-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260578, "uuid": "60c3a6ec-42b4-492f-826d-63bb02a04dde", "comment": "Malware payload", "value": "c23e12bc480e3bbd21112a6159deed87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260578, "uuid": "9304df51-c8e0-47c6-ab47-33cf0e14e774", "comment": "Malware payload", "value": "23d135070f7f4d589be70923913293a5be0caaa712a617f11adf7bc7cd6d4cbb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260578, "uuid": "14ea6e17-3a07-4c09-89c4-8e6204fa65d9", "comment": "Malware payload", "value": "a8bb452d784fcad79447a3160757e2879d3d0aab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260578, "uuid": "cc63584a-7544-4e9f-a8c8-0d5573641e5b", "comment": "Malware payload", "value": "a6b1bab6595d504f82cf472e106755b8b83bbebdd2bc85560e8c1980384ff15bcc5e8e0e4bb7ab2f20bc1382319da94e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260578, "uuid": "7178e4ef-daa9-40fb-8670-ca2199a420e6", "value": "0933F17547DCCAF66C76E0BF84C2F808FFF28952C987862645F9B1C8B6A52554E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260578, "uuid": "ff54ce3e-3515-4715-b560-66d4c558677d", "value": "1536:KjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wE3:aB9wzbqtWb08UscYJhnpjyq9qEK0ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260578, "uuid": "979131cb-d955-43c0-bbb1-91b424b12e55", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260578, "uuid": "7d519371-f47b-42f8-a55d-6996e1509ab4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260578, "uuid": "f0d70c58-9dd5-479b-a91c-cb3d1d3405a5", "value": "diagram-1882701968.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9e1a9d-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257530, "uuid": "15c28a0e-423f-4bde-86a7-ca272fb03b6a", "comment": "Malware payload", "value": "d4e3e9aa5d0f1854501d5cd7d0bc8747", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257530, "uuid": "31264165-0586-4689-a960-907bee3de564", "comment": "Malware payload", "value": "23f69cb447d5f1b1feb91b171de2cdbca5e78edcaf98dda2bcdb2b82f5c3f343", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257530, "uuid": "0420c598-6991-443d-99af-9ba8ffe2d116", "comment": "Malware payload", "value": "618d5cecd1de508bde820f41372ca4321c513150", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257530, "uuid": "88237400-ad26-4989-b3eb-a599a0524aac", "comment": "Malware payload", "value": "1ed3c5e4810b97ff2ce5ed88433e7ab993ff0f15170b8906c3971bce2f2b7362cc39ce516ea454cbe2208c5eed999655", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257530, "uuid": "0f40d4bf-c886-462e-850a-1fe657e5c886", "value": "DB33F184D164108DCF4FD2EB30F6FAECE1DE7F43099A68C09A6E2644E1520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257530, "uuid": "e96bd0e3-8d18-402c-bf35-8c6138a2f4ff", "value": "1536:d2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAb2v:Yfqhp+g5ru2kmUEt88mAb2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257530, "uuid": "54f42ecb-8079-43e6-a3e6-37a79677b1a1", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257530, "uuid": "353d5730-e983-4fc4-9e0f-eee84353b548", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257530, "uuid": "8b0068da-1fe2-43dd-b943-b5320d57ffd0", "value": "catalog-1664962134.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e39277-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258650, "uuid": "84f5122d-af42-41d1-b5f6-6a4b632f0242", "comment": "Malware payload", "value": "4f1a425f66462c7133188617e6fa6721", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258650, "uuid": "144b6e0f-4d2e-498a-9c71-8ef788806c64", "comment": "Malware payload", "value": "240dcf065496f3a7a78f8765ed705ebb41c1daff0d852bad4d573f9ad9531aeb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258650, "uuid": "70231eba-4ca5-4cdb-93f2-baf3795acb8e", "comment": "Malware payload", "value": "b7d1984357590d06fc4f77a2206001f2d3cf1945", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258650, "uuid": "2ae69c0e-a5cf-46b0-bcfc-830fd3aa1523", "comment": "Malware payload", "value": "9904f42db49e339ac17a41de2900365dfb68347458ab17553b3baccc7167ca8f5fc8e834fcc58df283bd09b647d4f99b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258650, "uuid": "d65a9521-1c70-4f8d-a8e2-edc14d8dced5", "value": "2433F1919554118DCF4FE2EB70F5FAECD58E7E130DA978C0AF6E2B4981830B5092E54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258650, "uuid": "8ccfc0fd-a692-4db7-a58c-af1f3966cad2", "value": "1536:L2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIU1i:qfqhp+g5ru2kmUEt88Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258650, "uuid": "7eed73df-73ff-4882-9c8f-81bfe201281e", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258650, "uuid": "42de99a3-4133-4492-aeec-6ee52b270109", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258650, "uuid": "de710e09-8196-4d04-a787-a992df5db10f", "value": "catalog-466302340.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe2ae9d-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260645, "uuid": "01410830-5266-4a57-afdc-0e6ccf5fa51d", "comment": "Malware payload", "value": "8e34ab8c356f5d2b112773d15fcd6e08", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260645, "uuid": "b1a8f382-e82f-4140-a96f-41e94411bc33", "comment": "Malware payload", "value": "2437f7b70634857fce50d6dfa4f809a11b780ead919e495c92a1139e778e8878", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260645, "uuid": "f506f624-f655-4b32-85cc-49e824f34745", "comment": "Malware payload", "value": "cd5eb2f93dc38cd5c052768591967a6e56b38c13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260645, "uuid": "9eaef0fc-a54a-427b-9725-d38eae5a4ad7", "comment": "Malware payload", "value": "7241bb53ae821e188fff9f4221235f4975de326a87d932d185567782343a0b805ddb4b01e43d2c20779c57676cb655ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260645, "uuid": "a12de737-7d46-49c0-b16b-9f39a620a43e", "value": "0333F17147DCCAE66D76E0BF84C2F808FFF29951C987862645F9B1C8B6A42514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260645, "uuid": "e2a8cb98-a1cf-4e48-88b1-e755c819ebbf", "value": "1536:LjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wYa:/B9wzbqtWb08UscYJhnpjyq9qEK0wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260645, "uuid": "efcc56e8-0a22-4f88-89ec-294d57b2277d", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260645, "uuid": "e4db9242-9398-4ec1-8fff-f3ba6094bdd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260645, "uuid": "e10361be-c108-4e92-aeeb-d25f57fd12d4", "value": "diagram-1944339753.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78f300e-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262382, "uuid": "77d29631-a354-4b57-85d5-04485aa2934e", "comment": "Malware payload", "value": "796158314558d104822d779b21d195b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262382, "uuid": "b8e23103-20bc-4d04-b82c-8054d6091acf", "comment": "Malware payload", "value": "243ad267e4de64d020ccdddbc125aa5371ecbf137d1a8dad2f3efb746017e906", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262382, "uuid": "2087c310-b540-4449-9f91-2d955527ee84", "comment": "Malware payload", "value": "a6538f3dd5608dba45ad11171d6f0315882c8121", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262382, "uuid": "6afc0158-ddb7-4f5d-a882-ff7d7de64c84", "comment": "Malware payload", "value": "5224554a9636a64ad27c06eb34bebc31f54e1114465f70b9e6260811fb7184cee734907e39c861ccdd21e2d107b56c59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262382, "uuid": "a1a34c9c-6866-41f0-aac3-8bad93adebe3", "value": "2A33F2E0DA02E08B9769B848DC6E5D075F7EDA1D077D7882013BC0C75E62AB5F246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262382, "uuid": "8d7f2846-2541-4c63-b73a-20c78fc93ced", "value": "1536:kXXtg3K7774iXfEz5lnm/hQMOEYus1GpE/tz+1UD:QXma7774mfCyWMB/4GpAzkUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262382, "uuid": "f9999a25-eedd-4291-9578-fcab24487abc", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262382, "uuid": "7001469d-16a1-4cbb-be15-3408527ab7b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262382, "uuid": "9ad0dcdd-4753-4878-b4ce-208da2033c86", "value": "statistic-1118183355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49bbb84-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264176, "uuid": "aeffa67c-9c97-47b1-a61f-65e642466935", "comment": "Malware payload", "value": "e3786270d2c937a0d5bf8f00a5364748", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264176, "uuid": "af3ece02-52dd-49ae-b944-f70299d240de", "comment": "Malware payload", "value": "244b0215e2f41143751cb5f58604ba1620fa62b03a983c860ab41ab0d043561f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264176, "uuid": "5ba37dea-1bf2-4cca-a970-e619f2331ff8", "comment": "Malware payload", "value": "1da507b6b338756c1de750d8578164c1295f5b26", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264176, "uuid": "6849603e-9460-458f-bf20-725b1a7dd50f", "comment": "Malware payload", "value": "c7e7f8c295522eb39cb1192d56b3a52619ef053033f349bf8c31011b0f481f5fedcca701506fe40e4bd2aaa595a12e27", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264176, "uuid": "a8304157-2096-4f6a-a085-bf94c5da156d", "value": "9233F2E0D902E08B9769B848DC6E5D075F7EDA1D077D7882013BC0C75E62AF5F246E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264176, "uuid": "75dbaae1-1c1f-4c64-ac78-fcabfb4d4a05", "value": "1536:OXXtg3K7774iXfEz5lnm/hQMOEYus1GpE/tz+AUa:mXma7774mfCyWMB/4GpAz9Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264176, "uuid": "64aa1aea-5cfe-405f-aa6c-309e131c4afd", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264176, "uuid": "62a5fe0f-507f-4619-a729-774a9a439693", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264176, "uuid": "0597bd71-436c-463c-97ed-988d2513c7f0", "value": "statistic-541638163.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7791b2b5-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264422, "uuid": "08b9cb24-7cab-4fb8-8f59-3b5ec187d0b8", "comment": "Malware payload", "value": "1e31ad485f7f625e6d43a6d7267a7d53", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264422, "uuid": "b64d0508-a15d-40c9-9afd-b8dda8f18928", "comment": "Malware payload", "value": "245b09d441a1409e5c5b3525527c9a78cd57c7d91d1c6149c3a1ffd499ffc61b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264422, "uuid": "a892f1cc-5bf9-438f-955e-d187f57706ad", "comment": "Malware payload", "value": "f9fc179f6556e7b926f92510fe813440556f64f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264422, "uuid": "cebd532d-82c1-4f68-89ed-034313a7238b", "comment": "Malware payload", "value": "45a076a4352ea369807d1df3e2c9fd79a79a25f0aa136dfbf7dff69375019eadc570b1bf42f9974ac76e0f55b7400eb2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264422, "uuid": "a97be879-c306-4792-babe-22ce7ba17938", "value": "0033F2E09902F08E9755BC59DCAB9D078F39C91E037D3883017BD0475EA1AB5A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264422, "uuid": "eded313d-a5ce-4eb8-a2bc-2f1b441a4110", "value": "1536:dXXtg3K7774iXfEz5lnm/hQMOEYus1GppZV:JXma7774mfCyWMB/4GppT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264422, "uuid": "e4a54188-1158-4a02-9fa0-fe915894e55f", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264422, "uuid": "f5a5a78c-8756-45f2-9001-17ae2dc0052c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264422, "uuid": "569b638f-b5ee-4420-b298-625791be1433", "value": "statistic-71131822.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d352ddd1-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259422, "uuid": "6d806fd3-5a6b-4f4d-8f5f-70453f5e123f", "comment": "Malware payload", "value": "31b6e75790443b8e0f224f3ec37cc1da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259422, "uuid": "b774b8e9-837b-4bc6-a39e-d0d85ce5bc96", "comment": "Malware payload", "value": "2475fc9a5fa625c27997cc29e161f689d8bbe2b378562620bbcbf5243d3b82fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259422, "uuid": "864f8a6b-9740-4e00-90d3-1986b28fc1c0", "comment": "Malware payload", "value": "b2592776dda4aba7c28b7269f917511e3899e2a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259422, "uuid": "e5bb3280-6532-4cfa-bc7a-2a32777c5369", "comment": "Malware payload", "value": "209f315373d61dd8b1710adf161fd46e5ab27e99b9817fc4040b829b967a3cbd32266af986af08d4ae06954a5da71feb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259422, "uuid": "bffdb904-82e0-4571-aca3-70139c0ae0a3", "value": "F833F17147DCCAF66C76E0AF84C2F808FFF28951C987876649F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259422, "uuid": "0d41d13b-7ff7-4728-81b1-232c228a29d8", "value": "1536:fjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wvG:bB9wzbqtWb08UscYJhnpjyq9qEK0wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259422, "uuid": "7ed12e82-a7e6-4177-89eb-0f2aed1597d0", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259422, "uuid": "5f889cdc-6995-47a1-96ce-8c324658c329", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259422, "uuid": "f934c5fc-d929-435c-8675-fe49351bf3cc", "value": "diagram-1051855775.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9432e420-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261464, "uuid": "0200fca3-4071-4e77-b5da-571a17ccafaa", "comment": "Malware payload", "value": "d397d1b9432bca2a59f488252ced8667", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261464, "uuid": "3907dc94-323c-44c5-b815-43a3a983883d", "comment": "Malware payload", "value": "2486f8182fe8d89d21dc342db2eb8c41aca7bbefb2c7383529537d0007585f91", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261464, "uuid": "8628e0a2-57b7-4d1c-9fed-40d550d161b1", "comment": "Malware payload", "value": "879a60f054f924f14a6f5f6974e2de759ae51208", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261464, "uuid": "b7997467-56d5-4c25-9580-f40f8602c48d", "comment": "Malware payload", "value": "1c670fe3df453b7490f904366b1d88fdd9865b9dea5141b93643d56e666c26a494a884eb14e9738ecb4b83469211dd8a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261464, "uuid": "6392566e-8787-48bc-b0f4-ee7dec5025c0", "value": "F633F17147DCCAA76C72E1BFC4C6F845BFF28861C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261464, "uuid": "d148598e-7500-4d62-9bbb-438a5237fcd5", "value": "1536:qjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wR:6B9wzbqtWb08UscYJhnpjyq9qEK0wR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261464, "uuid": "603d450d-2ce4-45be-8bf3-1b05056530f0", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261464, "uuid": "be9f3151-be39-4bd9-8a60-a97a6bd4ffba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261464, "uuid": "59850c98-7dbd-46b0-aba3-34bf35ae80b6", "value": "diagram-562963877.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1908ec9-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260278, "uuid": "9542632d-bb7f-40ff-b7d7-0d9716bc76b4", "comment": "Malware payload", "value": "f11ece464db718e565169cb50d38be1d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260278, "uuid": "01fc19ea-6657-44f7-abdd-a9f53863d012", "comment": "Malware payload", "value": "2491c4f108d52bc36c9850666fcdcf724bc2f5fdf72d330efa49b8c0af108637", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260278, "uuid": "c58e2ef0-e614-41b3-ad3c-bcf57100efa9", "comment": "Malware payload", "value": "d541b59e450747626b4717c8d3399bd784200443", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260278, "uuid": "71d435ce-7cb4-4e24-ba79-05c1222f2b32", "comment": "Malware payload", "value": "b3293405e2b556c98961006e779c74eaf6b8f70d8603b6b7960ee0208d035ad255a3e6154c687ecf040081222b89c97a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260278, "uuid": "23e2ba27-bb89-47e1-975a-dcfcaa49e9e7", "value": "F033F17547ECCAA76C71E0BFC4C6F845FFB28821C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260278, "uuid": "f65f3125-a1f1-4f73-bc42-1c4ba02e3c63", "value": "1536:YjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wV:YB9wzbqtWb08UscYJhnpjyq9qEK0wV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260278, "uuid": "6de4eb5c-31fb-4303-803f-e65cd3204c30", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260278, "uuid": "610ee118-a354-4a7f-9e7f-4d0ef41917b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260278, "uuid": "5aa12b6e-fb89-49c2-9a95-e5c52083b13f", "value": "diagram-1686407012.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0520fefb-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257358, "uuid": "a499160a-b66a-4b09-b5cc-95fb8aaf0caf", "comment": "Malware payload", "value": "1588743964576f24f1478a1d53a6c749", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257358, "uuid": "93533d44-7c29-48d1-8b92-fb4e6d38d584", "comment": "Malware payload", "value": "249d20329393f5c208aa83ce7008e0290e88d4f70e3ecd8225c9881fc03e3741", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257358, "uuid": "58e49960-a161-4f73-8a30-7d3256e56dfb", "comment": "Malware payload", "value": "cbd74e30db95a7c5450ef04a132fa6356d0f9c43", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257358, "uuid": "1aeef30a-7655-4a6f-b4e8-0a6646156a6a", "comment": "Malware payload", "value": "335023dd20e8b79318aaaf7592a10d979e091c7c401a6efbbfee61339fc45b208face6c6a2db38279cd5140a0e257380", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257358, "uuid": "b8f53296-d1a4-41d7-9fd8-0417a776795f", "value": "4D33F241E615028DCE4EE1DB30F6F9DCE6DE7A030EA974E09A7F2B44C1560F4492A68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257358, "uuid": "7d3e5053-356f-47a5-b9e6-e5da38633d6a", "value": "1536:P2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIeX:+fqhp+g5ru2kmUEt88eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257358, "uuid": "2c38aefc-c2af-4cf5-980a-b53a34dd9a89", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257358, "uuid": "adeb8a72-4c42-44df-b916-ff576c4337ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257358, "uuid": "d959c825-b418-4c58-a3fe-97e2af60aa24", "value": "catalog-1514202094.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fa649a-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258220, "uuid": "a21a01db-3868-47b6-8266-c997e3fcde81", "comment": "Malware payload", "value": "01259e8e598d92f72ffad97b445f0694", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258220, "uuid": "14a35d31-c311-4df7-a3e9-ca0acaa9bb45", "comment": "Malware payload", "value": "24abc0fd874df1229478789275c2e73ed72df6984847e3cf4e417e15962baeb6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258220, "uuid": "ae4f21ab-a442-46c4-8943-944f27d52d6e", "comment": "Malware payload", "value": "b2f9e7216a1b6e6e58d5de55523d42e25f4c9c55", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258220, "uuid": "b1653d0a-a809-4fe5-84a4-7a85e6e51656", "comment": "Malware payload", "value": "193c4e7373a6b34047af3d19ca14ae7e060a4302b6574f8b852b26ef0afee4aea77f65759717cbdc55d92a549f80185f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258220, "uuid": "ecc8f351-2594-40d2-a429-61103fafbbf3", "value": "A633F191A599118DCF4FE29F30B6F9DCE6DDBE830D99A4D09A6E1B4084530F0583E68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258220, "uuid": "c494c041-b62f-4c0e-be40-37ffddbd2ea7", "value": "1536:Z2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIRv3f:Efqhp+g5ru2kmUEt8893f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258220, "uuid": "07ea4921-d158-44c3-9905-6df46c8621e1", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258220, "uuid": "05e01450-acdb-4eb5-87a2-800c207e009e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258220, "uuid": "c9ef0ea1-0efb-4986-b86b-91ac9b418e16", "value": "catalog-254993013.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2d78ee-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257481, "uuid": "d967d0d4-9e81-46c4-91ff-c4db96135e57", "comment": "Malware payload", "value": "2dcd4d9d37e310b847503a142290ee74", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257481, "uuid": "e66e476b-5c41-43c5-a632-c6ebe69751a2", "comment": "Malware payload", "value": "24acef492e9b60adf65cc90af4ec4e89b46955005a8299157fe0022b1bfd1d0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257481, "uuid": "ea052fb3-7b1c-453c-834e-8a90f47622e8", "comment": "Malware payload", "value": "82350c96dc903dc52f9a6d78ced12833655b3784", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257481, "uuid": "d2bbda5f-04bd-4a70-966c-2e326a68eb5f", "comment": "Malware payload", "value": "10872b5b30580ae6918841c51a8a7b8018c3b892d9072ee02ee4861474d3c658d1490f1fa0731749190c3a7050bc1ff1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257481, "uuid": "4ff747d5-4a21-430b-b43a-3ecf4116f598", "value": "DD33F141E658028DCE4FE29B60F5F9DCE1EE7E530DAA78D0962D2B0191430F5482BA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257481, "uuid": "95fb16bf-6ab1-45bd-b620-142d701cf46c", "value": "1536:g2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxr:Rfqhp+g5ru2kmUEt88xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257481, "uuid": "2a6c9238-7656-4ca4-ad2b-3b0ce1f621a0", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257481, "uuid": "6faaa6ed-afc0-4f51-9d46-1658bd08bfd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257481, "uuid": "818b5b33-0e25-4777-ab3d-eb3ce5a4100b", "value": "catalog-1621012003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd67101c-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262875, "uuid": "7f5d2d8c-c3a0-43c1-ae7b-d2e3a761206a", "comment": "Malware payload", "value": "c19c61a9561bee556d01a2a3e329b673", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262875, "uuid": "832c9eb0-9760-4eb1-b363-546a65a5c48c", "comment": "Malware payload", "value": "24b85fba1acbd628e0ecae5ab31b306d59778b6315c58e927f0180f76797c87b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262875, "uuid": "48e16b4d-85c9-4f84-95c5-0860af1d74e6", "comment": "Malware payload", "value": "dd72b3994c0bea80280995639dae6ee32c976a1b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262875, "uuid": "da7e014a-c824-4db0-83d4-22b5de0df55a", "comment": "Malware payload", "value": "7505f70de05a83887bb943f0a72e9659c3af179a475c28a8baee2906be981bcdc909e783712c3d2391c0a6edc1635253", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262875, "uuid": "1156936e-9084-427d-868f-e8c4833efd82", "value": "403302E09902E087A7597C6CDC6E6D079F3DED0A433DB853122ED0874EA15F8A745E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262875, "uuid": "54f09404-67d9-44c6-b455-a8a56ce0060f", "value": "1536:vXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qF8:PXma7774mfCyWMB/4Gp07h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262875, "uuid": "2365278a-1edc-42b7-99e3-612c448bbdb2", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262875, "uuid": "f11ee80e-18f5-4fb0-a9fa-e0b724387fd9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262875, "uuid": "b6126d37-5e17-4ed3-9db1-d61bd5daf474", "value": "statistic-1471066826.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc53195-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263491, "uuid": "7caf5dcb-4f95-4413-aafc-da4f15dd72ec", "comment": "Malware payload", "value": "c1cd3c21a9ec07ac15d1760a29355d98", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263491, "uuid": "8b62523f-a803-44ed-b36f-f75d9e458b40", "comment": "Malware payload", "value": "24f6c2a0baf8cb3e06d8ddc64eacb4bb67ec3bdf5c980634c095d01de9419099", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263491, "uuid": "b4d462ce-9eca-4e3c-90db-9e8672a27924", "comment": "Malware payload", "value": "76100673397b4dcbfa9bd23de27814c28406ccb7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263491, "uuid": "39f4a93c-e86f-40c3-8329-fa3c576a1f81", "comment": "Malware payload", "value": "b06c0568465dff0261668913765eb8132d49195861e8d9b2f68e3ceb2f504719c9ba827f0ee4db001c54598c545dc3f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263491, "uuid": "83889286-76e8-430c-9971-32aa453b3c76", "value": "5D33F2E09402E047A744FC18DCAA9D038F7DE95E477D7853027EC0879E72EB5B24AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263491, "uuid": "48204d17-257a-44a7-9a59-18b4fb26c7cb", "value": "1536:cXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMO35B:YXma7774mfCyWMB/4GpCO3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263491, "uuid": "f8265250-8742-4513-ab39-18a13794dbc6", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263491, "uuid": "b4bb7d09-9d56-40eb-aa56-cb192c935b79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263491, "uuid": "817dbc6e-c091-4197-9283-39f029f94002", "value": "statistic-1946313371.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be120554-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257669, "uuid": "01011277-872f-4939-bfd5-3b34b4bd4cb7", "comment": "Malware payload", "value": "ba44e642eb4476e358709f64a66d18e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257669, "uuid": "97e38d2a-e692-4286-a255-d501e4fd6d34", "comment": "Malware payload", "value": "25210c9e32fb4acbd0cd6fd060d4654ca57b58120c48d33bfaefb5c4e9dddbad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257669, "uuid": "e03ec4cd-2886-46f9-b1ba-b9dfbc9b4bdb", "comment": "Malware payload", "value": "41c6481edfae541450edd5731456901fc444acb3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257669, "uuid": "d9c76a7d-7a18-428f-b261-32a482ab29e8", "comment": "Malware payload", "value": "2091dd6fd94ff5e7c40f0c3214d0628fe5dcd6959eb565bcdb9d922cdee12b961b701d7684877ad918e38e332530e763", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257669, "uuid": "c46df53a-a22e-4723-b47a-66530035d106", "value": "DB33F186D554214CCE4FE2EB20BAF9E8E29FBE530D9D74D0966E2B0196430F0492F54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257669, "uuid": "93f4c93c-1fff-40a7-a06a-c159a3260856", "value": "1536:n2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIFn1A:2fqhp+g5ru2kmUEt88Fn1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257669, "uuid": "be5b6c0a-01df-4eee-b6a0-b56cabcc9b4d", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257669, "uuid": "c30abc3f-65ef-41b6-a946-058ef3618f42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257669, "uuid": "bdcb30a9-b009-46b4-96d8-c80f83b77939", "value": "catalog-1780183536.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b764b60-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259329, "uuid": "a7863078-856b-4ebf-b8a3-83a06ba5c4cd", "comment": "Malware payload", "value": "47b45f0532d7a26385cb909b93db17bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259329, "uuid": "53e85eb3-11b9-49dc-9667-8884ef12256b", "comment": "Malware payload", "value": "2522aabea1a63ba488d87859160c225c605f48be726ce8a739063bb1f3f8f215", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259329, "uuid": "2e84bfeb-5f14-4abe-a431-7b1948f9e9a4", "comment": "Malware payload", "value": "ad21202183fd0927ecc3fcfd4aba8da7285899e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259329, "uuid": "5e9e73cd-73de-441b-912a-17b709dfe3ff", "comment": "Malware payload", "value": "4e09159fd3b8befc4b128f896ec5b913d3a277ddd141a978cde75affb60d8aeb2f63a09bcf1e59d5c737eb727b508f95", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259329, "uuid": "6d77f821-d740-42f4-9a65-4742a73ec18b", "value": "3333F184D164108DCF4FD2EB30F6FAECE5DEBF43099A78C09A6E2644D2920E54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259329, "uuid": "27c0da22-0c1b-4ddd-9d64-3db9f57e2d49", "value": "1536:O2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAb3M:zfqhp+g5ru2kmUEt88mAb3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259329, "uuid": "749f393e-f3f4-466a-8331-bf19becfa6cd", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259329, "uuid": "babb0fa4-0b87-47f7-930d-6c91ad689885", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259329, "uuid": "9fb65be9-8ead-4ea1-8ccc-126187e61d9c", "value": "catalog-960114425.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5a33f9-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258932, "uuid": "b99d0e04-bfaa-47b7-9dc6-8d5f9a462ef9", "comment": "Malware payload", "value": "d9f7bfcc9f2c566c5d1759602d4dc634", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258932, "uuid": "7f3581e8-3290-41c5-88b1-c6aa4220700d", "comment": "Malware payload", "value": "252f6b593c1b8fa0e893699cb0469df29fad27ebf2e45029e3d96ba97d1a8808", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258932, "uuid": "8a4bff53-da8d-433c-b984-504c5ff7865d", "comment": "Malware payload", "value": "19ae57c8dea1de3321095bbff2fc972deb001231", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258932, "uuid": "c36b5fb2-7b25-460e-ba20-0c39f759ca93", "comment": "Malware payload", "value": "60fef37189dc61a027efb1f976693f2703b2072ffe275e2f9defa366d78bd7243201e08dfba9c3db58e5e4113802a630", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258932, "uuid": "31fcd9ea-f61f-4599-bc37-9563a59dfe04", "value": "9133F141E655028DCE4FE1DB30F6F8DCE6DE7A030EA964E09A7F2B45C1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258932, "uuid": "59fd5731-15a7-4ab1-8195-ea610073b345", "value": "1536:+2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIr4:Dfqhp+g5ru2kmUEt88r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258932, "uuid": "a1035a37-9725-4a5a-8179-d5f0adc06cdc", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258932, "uuid": "9093f1b2-f3b9-4a5d-92f6-1127afc03b20", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258932, "uuid": "ea5e2f34-2040-49c8-9919-8f3236275bfd", "value": "catalog-688269726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16989a4a-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259535, "uuid": "4a3a40e9-4c22-4ffb-a368-86d5c5e6e24d", "comment": "Malware payload", "value": "24b23a44d9dd79812bf9b7aa44bc0a82", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259535, "uuid": "f8b48edf-f0d9-4ddb-9872-0c49721d4ffa", "comment": "Malware payload", "value": "253837462ea06f1b81283120d0d8d876f7518ac4752c58badb3b796668301cbe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259535, "uuid": "b411fe73-57d3-444d-bebf-b52d8e4eee95", "comment": "Malware payload", "value": "9552e5dbd02a6e0c2a30b43ca9c0afe1c5a2985b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259535, "uuid": "74cf66ac-f722-417f-b21d-abf8656aa084", "comment": "Malware payload", "value": "275cfd160ef08de0d094855ab8e1a9188b1efbb899b63fe071b1e5bca884b85acc75ede27e90d3db0f7055f9647f6b78", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259535, "uuid": "a53f0afe-22de-42e2-9488-b888e462dd20", "value": "3533F13547ACD9F62DB6D0BFC8CAF604FBB19495C4D78A2249F8B1C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259535, "uuid": "38df178c-42a1-43f8-9842-c41a37bcb104", "value": "1536:sjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXv41:UB9wzbqtWb08UscYJhnpjyq9qBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259535, "uuid": "5acf8bcc-9eee-4cb7-b757-4f05ed0b72bd", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259535, "uuid": "4a9a5cf7-78cd-4042-aa3e-b6ef514120ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259535, "uuid": "3d496bd2-4b7c-47f5-85fb-3237596bb717", "value": "diagram-1122412910.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd18f1a-b734-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621272164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621272164, "uuid": "e9064a3e-b1e7-4ccf-b88b-bdc48c64e9ab", "comment": "Malware payload (SnakeKeylogger)", "value": "5ed55fa3f0bc22426340505e09b72737", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621272164, "uuid": "ac6ad375-11d3-4508-82c9-d17fa917d78a", "comment": "Malware payload (SnakeKeylogger)", "value": "255329b1d2c5539cef659fcfe3bc23a1366dec0ab6f23f299a271d9be21623b8", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621272164, "uuid": "b57497ec-74df-48bf-b53f-8b59006aa78c", "comment": "Malware payload (SnakeKeylogger)", "value": "ad0d056121a5ba712be75c8200e65fae16aa3f20", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621272164, "uuid": "c1d8aebd-ab46-4631-8407-a20d4d60f6b5", "comment": "Malware payload (SnakeKeylogger)", "value": "bef8fe9a240138df49ff9674a4ff2d53175df158fd48e75210e53ed72606703659883f7bd4e27ea55207ebe36fc6de24", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621272164, "uuid": "4e3f1d67-ee96-4915-8a91-ff2f0dba74c0", "value": "67E42378F2069E86DE2F1CF72675152787E2FE021752E516CEAD0027BA3948EBCCD590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621272164, "uuid": "e1157afa-59e7-410d-838a-5fadc24f6d58", "value": "12288:EjEpje0RzDEJ6n4PDwROIuvRXI5CHDrnde+RU9EGfUN840K+hBIZ:EgBeszYJ647Iu5XI5AxKeGfU7Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621272164, "uuid": "8d511a4a-3caf-49ae-99b7-b7b1c78cc777", "value": 661608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621272164, "uuid": "63cf7149-d40f-4b14-9f6e-db5b64b2e123", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621272164, "uuid": "a8f43b88-c542-46fe-834c-d0c159132715", "value": "Ordem de Compra _PO056D_03.R03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6b4019-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257288, "uuid": "2c4fbe91-c97a-4415-8aa7-7b6523a584a3", "comment": "Malware payload", "value": "3ba9f81407d23764056129fea064c668", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257288, "uuid": "d53f3e00-088f-40bb-b994-904365ced881", "comment": "Malware payload", "value": "255887fd7594f51affd731170832ec6f513e393da75a11adfc02432c008bb84b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257288, "uuid": "102d234d-3657-4281-a92c-94543bf62328", "comment": "Malware payload", "value": "b91d298c6d0e26201f170683fb4f698ef8c7f404", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257288, "uuid": "d5a3db45-8a64-4e93-8c68-3b6235b483a3", "comment": "Malware payload", "value": "ef0a610058207afa74c8c0846a0676a5e1c472d41f3cd21e63669bd299e98263176e2a7c0ac4aa1de09d22ed1e3e2d71", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257288, "uuid": "9d7c8347-4b5d-47f0-984e-c6a8f140c916", "value": "F533F185D164118DCF4FD2EB30F2FAECE1DE7F43099A68C09A6E2A44E2520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257288, "uuid": "9eabf511-951b-463b-9093-a1cad323a3d4", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbRK:Ffqhp+g5ru2kmUEt88mAbRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257288, "uuid": "d7f85768-f3ac-407a-b282-2313f751fae4", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257288, "uuid": "e17e24b3-2e03-4c6c-ad8d-678b773f1f77", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257288, "uuid": "33279800-6f17-43a5-abb6-90ca242dc0e8", "value": "catalog-1468477660.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa76f1da-b6cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621227705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621227705, "uuid": "1310bb22-ed64-4e7a-9ef9-bf1d01887f89", "comment": "Malware payload (Dridex)", "value": "263533f248ad89bc73c4af1d52105190", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621227705, "uuid": "47dfba09-9164-442d-87e5-1b995a8567aa", "comment": "Malware payload (Dridex)", "value": "256519d1bedac23bc6b489319db124273dd7d0453619e792a4a69f98dc02e628", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621227705, "uuid": "8f9d953f-7bea-4a08-93e4-22e1f1d269d8", "comment": "Malware payload (Dridex)", "value": "7eba3ebf717689662b8c949187bc1ce54a4e0db5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621227705, "uuid": "ea437fbb-9eee-4634-90b2-813331b619df", "comment": "Malware payload (Dridex)", "value": "a5da425163ecf4f78ba3b352e3c411b1bb1869bc606427118630f7f368d2503cd8b9ff3326e0cd415779836802b65c12", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621227705, "uuid": "7d927846-f5f8-41b9-9570-b11a1bd26254", "value": "6DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621227705, "uuid": "1f5c132d-3a36-494a-9c5e-fa14c869fb50", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621227705, "uuid": "70fa24d9-621a-4ae3-842c-2d393ecac529", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621227705, "uuid": "1a91e341-d2ab-4c2e-947b-654049e05b75", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621227705, "uuid": "e38c090c-b4ae-4142-a313-916873a3e05d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621227705, "uuid": "c8c6ee67-270f-4bda-bc59-51a277701ded", "value": "263533f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18f431f-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262775, "uuid": "3a834b2f-47c9-49f8-8d10-57b273fa8709", "comment": "Malware payload", "value": "69df22e71b9391739b3de2478fac4a8e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262775, "uuid": "d83607ab-5c9a-49b9-99fe-e8e49bb4051f", "comment": "Malware payload", "value": "25726ebaffd50fc45fc752cd56ff136e9c23d8e5fcabb317a18d1d3eee8c6219", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262775, "uuid": "912cf814-9219-423f-b65d-42fde0c05ada", "comment": "Malware payload", "value": "d454b96f2d289a6156274dedfa019d691970c0bc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262775, "uuid": "6fb9756f-4e92-479c-8043-ae04a1fb0a6b", "comment": "Malware payload", "value": "6ee59412f3c12540bb74490298e9b46124f0646d5e23e990cdf7f20be4190fc0753f2391966cdb2c2b49df7c04a8b3ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262775, "uuid": "b9cd4746-8411-4fc2-8ed5-e3bea99ea401", "value": "EC3302E49507E0479748BC2DEC9B9D038F3DE91E033E78D2122BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262775, "uuid": "4f3cf41f-97cf-4606-b3e9-78dec99c1528", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZU:bXma7774mfCyWMB/4GpWvZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262775, "uuid": "0f6b5496-133b-4cf4-abf1-07595f0b72e7", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262775, "uuid": "0cf81b6c-290c-4e92-8c49-41f7753c1efc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262775, "uuid": "d3d8f893-a79d-46c6-8e4a-d219373c90ea", "value": "statistic-1410420799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd89187-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257182, "uuid": "9191759c-91f1-4478-8605-41b8a61b8ba4", "comment": "Malware payload", "value": "fc38b7284f9b51437570c547dc3b1d9a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257182, "uuid": "be220d06-4ab1-4c97-bfda-f4b9b3b44957", "comment": "Malware payload", "value": "257638838df556ec51e9bd8eac35a2cf8811926eb376096b8ef2b503161a2d4c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257182, "uuid": "a9e30d60-92e1-487a-aa65-0819250fa423", "comment": "Malware payload", "value": "a34fdcd842a33e53ec6cf7cc63c0e01416d0c6cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257182, "uuid": "4a466fce-173e-479e-add6-787764350d0c", "comment": "Malware payload", "value": "341784e885e6ef774d171ec7a9e10507fc7d5e2b664fa176f2d5d893d5d05b1f7c7ce66502f08e8830446a43a452448b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257182, "uuid": "53b18a7d-f740-4233-9161-040eb1a27ebd", "value": "38330282E658018DCF4FE29770B5FAE8E67D7A5309ADB8D05A7E1B4591930F1082F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257182, "uuid": "8e907143-be2f-466e-bbc3-a32ca80bd315", "value": "1536:i2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI2ws:nfqhp+g5ru2kmUEt88Ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257182, "uuid": "711dec7a-1947-45c2-bcc1-636c802f0d9a", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257182, "uuid": "62fadda3-560d-4cde-b388-55d5715a04cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257182, "uuid": "f728dbec-97d8-48bb-aa87-c3de30849f98", "value": "catalog-1405972426.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b076114e-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259793, "uuid": "eb5c5a21-8127-40f6-89d0-a084724b2484", "comment": "Malware payload", "value": "9b127fcaabaf2f0eba3d64363b2c8ded", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259793, "uuid": "264575be-b3cf-421e-be91-bd700592b0b2", "comment": "Malware payload", "value": "2577cf940a895f773d214a32f36480712d197563ec2ae7ef45812838b1f65b34", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259793, "uuid": "2e423833-1aa7-4b97-9753-cfddf24af309", "comment": "Malware payload", "value": "7d3844e277d3ff938a07803745ac71f1823a98cb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259793, "uuid": "80a356b7-f11a-42f7-b6b1-0dad29921c38", "comment": "Malware payload", "value": "260baedbbaa64b370efc22b753618e838055a4bce75397161e93d2898a805a5116c0a55c4d8b5c8cc66b37fb163c99c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259793, "uuid": "d793c02d-6c0d-4cf9-8c6e-3f99a0f6af91", "value": "2A33F17547DCCAA76C32E0BFC4C6F845BFB29821C897872249F9B1C8B5E52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259793, "uuid": "2d57aca2-1288-410b-99d4-429c8a105bf9", "value": "1536:cjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wM:kB9wzbqtWb08UscYJhnpjyq9qEK0wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259793, "uuid": "7fd2bf01-24a9-4454-9a40-b3cc57c13c86", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259793, "uuid": "70cbf862-58bb-4130-ae54-ebf211284237", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259793, "uuid": "8dd5e632-c3d1-4fd1-81f0-4419285f7d4d", "value": "diagram-1346464808.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9eeb5c-b6ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1621240215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621240215, "uuid": "e775b5b3-54b1-426c-8528-e35517db4893", "comment": "Malware payload (Pony)", "value": "e17432f162afcdd2432fc78cad5db40d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621240215, "uuid": "a1b7a25a-8b01-4d72-9ef6-5d46e58dd130", "comment": "Malware payload (Pony)", "value": "25832fe49bdd88f0d144932c89d6a0733a6b062e351b85b00d539a073907aaca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621240215, "uuid": "a98f8d2b-91a6-4e80-9139-e24a5677d306", "comment": "Malware payload (Pony)", "value": "a56be04a8f8e5163104fe47af2d24b60207d6022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621240215, "uuid": "6da61df6-1e94-4b19-94d3-f9d71ff45a62", "comment": "Malware payload (Pony)", "value": "7251e004022c5fda002659f4a853bdce20897c5d9f487a9fd860815802e28eb8d21bd5beb103a4540b42edd66b76edf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621240215, "uuid": "227a43ec-f042-4df8-9d4f-6c02ad488278", "value": "5764C282A2604896E7E1AFB016D17BF8DD62CEF21703D6E6D2756EAF0577ED2B400D04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621240215, "uuid": "76cb935c-6055-4fab-b1a1-461d5fac7f0a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621240215, "uuid": "640f3a25-4aea-4bc3-b365-187527ff5da3", "value": "3072:mS8BCfoDaXJkCd2/YFhPmzBRJzlXFMye3kVabaw+KPq2yvDSxu3zhgmtgpoXXFmq:mPB6HdmYnPmzhRyKVe7+Cq2yvPwHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621240215, "uuid": "e875d5f3-915a-4865-98c7-b5e52b7e9237", "value": 326878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621240215, "uuid": "87cddc2b-299b-449b-8c11-4db04c739bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621240215, "uuid": "ffd65956-491f-4ae3-a05d-e2085fa190e0", "value": "ORIENTAL -COMMERCIAL INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52b4965-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256822, "uuid": "3109023b-5005-4b69-86ee-f7f0e499dc9b", "comment": "Malware payload", "value": "6c7f1bb39e15c1e1d56ef6a0b07dad7f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256822, "uuid": "509338ac-c5d3-466c-8259-96cb0568da2c", "comment": "Malware payload", "value": "25be5404fdc12e6cd36c0e0913f7b65aef18d3875ef85f886a8f30b4c63074bb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256822, "uuid": "bf72baf8-4a2e-4379-b694-cb052b9eb76b", "comment": "Malware payload", "value": "d89d6d5326da6cd25b43e9a546eee0ea57665972", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256822, "uuid": "303b9aa3-7d0b-4541-9d56-77bab4a14446", "comment": "Malware payload", "value": "aab4258a1663ede38c6239ce8663cca13232a97b265dcdf3e32dac48310e8cbdec37462be7a68c6aa0ab9d12cbec54db", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256822, "uuid": "0c92956f-78ab-471a-bc78-f70657eb8420", "value": "C0330286D265214DCF4FD2A630F1FACCE5DE7A430DAAA4D0A66D2B0481931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256822, "uuid": "adad9469-ba2e-40fc-b8eb-372963ea64ae", "value": "1536:g2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3J:Rfqhp+g5ru2kmUEt88IxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256822, "uuid": "cbd01950-8175-4628-81a3-c67f514f0800", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256822, "uuid": "9cd9dcfd-f7e8-40b6-989a-590be71d9cdc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256822, "uuid": "889e8539-9fde-45f7-9779-7440c68962b3", "value": "catalog-1120406690.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e5b8ad-b6bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621220831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220831, "uuid": "1a4060ce-68ae-4fe3-a3c7-a502df1df138", "comment": "Malware payload (Dridex)", "value": "eaced49b2b2346df7594918ebb9533c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220831, "uuid": "5d37f55f-3397-4035-9eef-260b086aa6a1", "comment": "Malware payload (Dridex)", "value": "25c8e6064a02b9b12b247fc3ebb1741b2efefb39df59bfc8304f68dd1405345c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220831, "uuid": "46b49f38-1048-4cdb-9e9a-6947fce40223", "comment": "Malware payload (Dridex)", "value": "d8062ae7def2b506d07412af624f72e50af8007a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220831, "uuid": "f9ef668f-cd30-4513-8c9c-76160da68106", "comment": "Malware payload (Dridex)", "value": "64cf826e70b1ea20e97d29a6c8ee919209407d226c2ce815f43179dc54ac8546d351766761877a780fadff067f0cc086", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220831, "uuid": "8d334700-8563-4764-8520-f933b92d3c80", "value": "D4F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220831, "uuid": "46f7efde-9f59-40b3-88be-db4a2c0af3ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220831, "uuid": "7a7f5175-ea3d-4af5-8e27-c253911d871c", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621220831, "uuid": "79924fce-3299-4598-b135-705e816955be", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621220831, "uuid": "157b1f56-9d2f-4421-b016-be98484fb3b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220831, "uuid": "0f624f72-8ce5-48bf-97f7-2fa3c32ffbb6", "value": "eaced49b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87425f6-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258948, "uuid": "70a121e4-9428-4571-a1d8-25c3ff2df31e", "comment": "Malware payload", "value": "b56df5765dcb79ac74981ab3d82b5fbf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258948, "uuid": "a1f9e017-3c3e-4e04-81ee-6cdcacfc6e8b", "comment": "Malware payload", "value": "25d47d34c97cd90134f0b20cef1b8a8eef94a1b9bd9581aeaf802f8f9b0a0b7f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258948, "uuid": "21d72b77-8b11-4c33-8b64-ff3adb2d6956", "comment": "Malware payload", "value": "8e2a79240d004da9f9c6ef9c898563e090471843", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258948, "uuid": "76b906ce-9e5e-4bac-b087-29c633674a3b", "comment": "Malware payload", "value": "df73d86cf2be5ae5d91de6cf10ca33b8e01d0555ab4555880eeb4b543fa61040a77fc6b02b50bce55aaaa136be657798", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258948, "uuid": "b3c62ba4-2314-42f4-9bdb-5260c999902d", "value": "6133F151D645018DCE4BD3EB30B6F9DCE69EAE034A9978D09A7D2B0490978F0892F58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258948, "uuid": "94dd8b05-43f3-46ff-9769-7e199490cefb", "value": "1536:y2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jId4Rf:Xfqhp+g5ru2kmUEt88Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258948, "uuid": "5dca0d54-8c96-4b3e-ad0e-f800ffe29ee1", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258948, "uuid": "3b026c22-7a55-49b8-8be1-2aa7ee415d64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258948, "uuid": "fefae7d4-1e0c-4d33-9b9a-3fdc2cc4bb6c", "value": "catalog-698403967.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8bd51b-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263142, "uuid": "e59e3a88-b487-40dd-be67-b8af7c77a52d", "comment": "Malware payload", "value": "490ace27c183c248f84e4602756f07f3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263142, "uuid": "289becf8-7a8a-496c-af49-73455349ef4a", "comment": "Malware payload", "value": "25eb78226da3fd8fd2570023843dd2cf84efb012f3509bfae9e1a5a8bbfaadaf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263142, "uuid": "cdfa1881-21bb-4d6d-b4a9-d75ed4279c0b", "comment": "Malware payload", "value": "aedab5e7c714328b2a539bd087dceb92238cac0d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263142, "uuid": "cbb4d4cb-a18f-4069-b033-9a5e3293362c", "comment": "Malware payload", "value": "3e4c891870db6db931eef5787cb06a13b781a15dcfb841f2f2fbb0a46b7eff1a40e03b118c88af0bb38c9f6fcae9f43f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263142, "uuid": "0446932b-fbdf-4970-b7a4-cb0ab7f943c4", "value": "BB33F1E0A502F04B9309BC5CEC9ADD065F3DDA4A433D7493157AC0875EA2AB2B649D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263142, "uuid": "ac28a5b3-9496-4e90-a5d0-1c49e572b785", "value": "1536:dXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIGQU:JXma7774mfCyWMB/4GpV5dGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263142, "uuid": "e11699af-91cd-4988-b29a-55655a173cff", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263142, "uuid": "0a2c7e48-10a8-413d-a395-aea87951216b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263142, "uuid": "1e10c4c6-8f32-4453-8fa8-6638ae496f37", "value": "statistic-1673901423.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97d300a-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260694, "uuid": "b28af6f5-abf6-436e-97f5-412ec48891a0", "comment": "Malware payload", "value": "21bd04961d7f7277ae2baf40c44c0048", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260694, "uuid": "3a0fd6f4-54b1-42a0-95c0-1f4d0c9bf64d", "comment": "Malware payload", "value": "25f1a53a9783a40b2961e4e381f7307109f0d6c3c935fc23244e6bbbb68ff500", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260694, "uuid": "fdc0261f-7a85-4d87-84b0-5a77a7118149", "comment": "Malware payload", "value": "757657d0d02ba24be4ad97fde1a69fb14e3e09be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260694, "uuid": "82add4ff-82d4-4460-9635-a2fd16c4fe3a", "comment": "Malware payload", "value": "d44d775855f7f8171f3be75a52a1835ce63c2595223f7110c7147248ce7429fd2069b1aff8a1ab2112a319dc169c3f4c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260694, "uuid": "2ee426b3-bb50-40d5-86f6-c3021b83d0c0", "value": "B73302354BECCAF629B6E0AFC8C6F604FBB1D495C4D3862249F9B1C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260694, "uuid": "fdecccc8-6407-4926-a9d0-a38dd0e64e76", "value": "1536:HjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXBX:DB9wzbqtWb08UscYJhnpjyq9qBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260694, "uuid": "144d63ec-ce79-455f-8c39-d99dfd7269c9", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260694, "uuid": "ad422cd2-2631-41b3-96e9-87e3fc50b9bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260694, "uuid": "d83ce27c-5e95-401b-8e62-ebb1d89f516c", "value": "diagram-1974874293.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3a9759-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261662, "uuid": "da09b9b5-f517-4a81-bc95-424793087e26", "comment": "Malware payload", "value": "9573fee70df532558e9b19c66f506536", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261662, "uuid": "564ab76d-89ca-4b56-b170-7fb78a914705", "comment": "Malware payload", "value": "2612f6aaed1e6539945388df1fc4b98886530e9a065c1e2dae2e2920474ae74f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261662, "uuid": "71931311-9d51-4d64-8096-7c8f07ee0aac", "comment": "Malware payload", "value": "40d4b6e37cd459e0204b5bbeadcb1096cca83dbc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261662, "uuid": "53a77981-a2a5-4880-bb9c-c13e22c6996d", "comment": "Malware payload", "value": "fa3a0f06aeb0eb9774336aa9a86321d4d100a899dc740d64057954174e5f25c3e95c2f7431e2ecb1b30a4139f19bd1b3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261662, "uuid": "d9854ba7-ad97-4354-b8be-d8ad84d8852f", "value": "2D3302714BACDAF628B2E4AFC88BF504FFF1C455C4D7862649F871C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261662, "uuid": "fde7871d-0f4f-4855-9095-68de0f7e347c", "value": "1536:djfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX4b:5B9wzbqtWb08UscYJhnpjyq9qBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261662, "uuid": "f245b905-b044-4f6b-b9a9-07c490755f51", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261662, "uuid": "098fc8ef-4238-4d62-9fef-7f8544130fa6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261662, "uuid": "29b8a320-9c77-480f-8bec-234e32719cbb", "value": "diagram-702206325.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3328a3e5-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264737, "uuid": "41eb86fa-ae2d-4100-8a89-450a024cd4f9", "comment": "Malware payload", "value": "3e7ab4759a260da8fb6be7a2dcf8af4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264737, "uuid": "6d9cb667-0a2f-4fb5-8656-7d182bb50e49", "comment": "Malware payload", "value": "2613167b81138b67ab9848c08296d8bee3aae00e1f3f1bfb3ae3f30e84005185", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264737, "uuid": "fb32ee2e-781f-4acb-9734-d0f3890475d3", "comment": "Malware payload", "value": "d9b4a5de4c4cf2b1d08752e849bf56a012bec7b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264737, "uuid": "56214bd0-dd99-4415-8f86-6d3afb0ee5cb", "comment": "Malware payload", "value": "d8b07693b908fb00767de374459c92475de864bfc6fbb3e05b437e6b8d4374f600fc63a23962d1d07ca1cc9c1f897290", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264737, "uuid": "8b485f1c-1189-402a-a650-315a66363ad5", "value": "C73302E4A906F08BE744B84DDCBE9D035F3DDD5E423CA892413AC0C74D62AF5A715A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264737, "uuid": "62972fad-da19-4d6b-a733-cbdeaaface19", "value": "1536:JXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVhs:dXma7774mfCyWMB/4Gpuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264737, "uuid": "418c0bac-fa49-4d8d-b72a-121406af2076", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264737, "uuid": "f1cd4eb2-942a-42a3-8105-036688cc20b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264737, "uuid": "e9805dfa-a53a-4e44-a672-e88857d1d0ad", "value": "statistic-921998505.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f2a208-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258950, "uuid": "2c9cb563-d84c-4ff0-90e8-444da9dee4c2", "comment": "Malware payload", "value": "6b4e7d766792c2810bf41e4494e70df7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258950, "uuid": "6349c97f-df33-4c42-9e0c-1a3b12e84b7f", "comment": "Malware payload", "value": "261c06b585121368a64c9c6683ef5f0d15c95aeef978132731a8a66aff423742", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258950, "uuid": "e9134383-8259-43ce-b329-4db98a448db2", "comment": "Malware payload", "value": "6f044ae05632f17a1f4083b184bb969c050ce61e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258950, "uuid": "cfa480f0-ba73-410e-a0a8-4bc78332ed41", "comment": "Malware payload", "value": "cfa373f88c9b6fd0e486a558b68cd2decbc31c4c7190727500fe4a869504cc3e7073a6d3e82b7df6f0f9e71bb2fd693b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258950, "uuid": "30001c93-abce-4b57-b9bd-9b237817d215", "value": "AA330186D264214DCE4FD2E630F1FACCE5DE7A430DAAB4D0AA6D2B45C1931F0492B65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258950, "uuid": "d1b8c34b-939b-473c-9b9f-ec815400cc2b", "value": "1536:F2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3s:gfqhp+g5ru2kmUEt88Ixs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258950, "uuid": "59adbd59-8d6a-4ca6-902b-52bfe9be617a", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258950, "uuid": "c5d8329d-4bef-4f75-acee-4f6d19d40c4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258950, "uuid": "fdd031ea-9ac1-40b6-96cb-38bfa8013d9e", "value": "catalog-701853478.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce284d0f-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257266, "uuid": "3f44f723-004e-4d66-be19-2248163a3528", "comment": "Malware payload", "value": "81051234f9865dd3042d28cc01cab52c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257266, "uuid": "f9969a53-7200-48aa-b9a5-2e55b94e93fb", "comment": "Malware payload", "value": "261ce6d6b3fc084ddd623f394cef0b90bd7b71955235e866819b42397352b31d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257266, "uuid": "af4cdbf3-b192-42f7-95b8-c80c742aa1c0", "comment": "Malware payload", "value": "6e09e872e7004b8464de93b901a3dedf798a2942", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257266, "uuid": "4b89dd9c-6e1a-4cbf-8056-aa798765317e", "comment": "Malware payload", "value": "8e929d929a5d7f75b77f593f17c2fd3ae9e3dcd83f9457245407ad196103fad42b56c329e029249d8f5237111ade9a29", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257266, "uuid": "17fb813c-4f2c-4c53-91a2-d1d0bdf32619", "value": "8833F184D164108DCF4FD2EB30F6FAECE5DEBF43099A68C09A6E2644D2920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257266, "uuid": "0d828436-4cce-4d0e-9b12-6e6257de4655", "value": "1536:q2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAb65:Pfqhp+g5ru2kmUEt88mAb65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257266, "uuid": "1505b541-6ba9-4207-8931-1f554953febf", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257266, "uuid": "944f3126-1e8b-4d11-8f26-8afd3ae9a900", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257266, "uuid": "cfacd3ae-bfba-4333-a4ea-1f1b9e634ea3", "value": "catalog-1460347758.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dadb60e-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261399, "uuid": "95d57d7e-2803-4d88-a5b6-d451cbcd98ea", "comment": "Malware payload", "value": "bbe4638be9fb39f270cf39779460dbb7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261399, "uuid": "2e45959a-44b7-4af6-8329-890c0134192e", "comment": "Malware payload", "value": "262a50854fbec038d08e4f9978627dac02e702ada85b3fdbde4358a66d9d5657", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261399, "uuid": "43e06b9f-e1d1-4f0c-86a0-895f02728461", "comment": "Malware payload", "value": "f58cd19e2126bb19ff35000ffe1eb10b2a5b47c8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261399, "uuid": "db73654b-0be4-4523-9761-f84d431bb3c4", "comment": "Malware payload", "value": "6099f2d6be2af190c238d923289319ec058a435f6476a1e6e84369cfdbdbda5261ac27e57e5e527ad0d0a1409e1b002c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261399, "uuid": "8c1be963-a31b-4dd6-bbf7-f0f3e1cdb236", "value": "5033F13547ACC5F62DB6D0BFC8CAF604FBB194A5C4D7872249F8B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261399, "uuid": "8fc0da9b-2052-4216-994e-cb7c8e08591a", "value": "1536:pjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXQ4J:tB9wzbqtWb08UscYJhnpjyq9qBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261399, "uuid": "5798e2d2-a114-48a0-8609-ebbb5a312057", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261399, "uuid": "490a39f0-8d65-479a-b67e-ad6ff6fe0ff4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261399, "uuid": "a27d2c03-a540-444d-8fdf-f8fe6b4b425f", "value": "diagram-518516559.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973cd670-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262757, "uuid": "5104ed6d-1774-4736-99a4-25b40cc64e85", "comment": "Malware payload", "value": "5bbb9bda1a7780fcf22c0ae557d3cc35", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262757, "uuid": "6284d6dd-281c-4d60-b037-89c6bd3f12e4", "comment": "Malware payload", "value": "2639a4bf0477a2d3a2cc938eac3c08ce2bf4681e6572d2bd6add414c82375dd9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262757, "uuid": "3497fd6c-09aa-4414-ae5e-fe66036e1395", "comment": "Malware payload", "value": "538f9454f40dd68b93e2ed9f6157256033a5cbc8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262757, "uuid": "4d5f5192-e4fd-48e6-b26b-c20acb3df617", "comment": "Malware payload", "value": "9741abf2b339e4adddcb842174f9d3cf22b74375b0a33a14278bb21bcbd47ead39ad5912f0e81a7e3a2898fb01f47978", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262757, "uuid": "01b8decd-0afa-4f70-99ee-04d79ed696e2", "value": "C73302D0A802B04BDB15BC59FCABED128F79E54E477DB4930236C0874E629B5B285E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262757, "uuid": "10f44649-e950-4878-94ed-d429d4863a87", "value": "1536:dXXtg3K7774iXfEz5lnm/hQMOEYus1GpDkg/:JXma7774mfCyWMB/4GpDkg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262757, "uuid": "d3c633a0-f159-4a29-8ac0-e123c2c380fa", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262757, "uuid": "483f69e9-358c-4a62-ac3c-1e00ddf97b08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262757, "uuid": "2d085b7c-3535-4207-beb6-8aee89e2ea71", "value": "statistic-1387116746.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e848261-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261025, "uuid": "161b17e7-b875-406e-98da-8d40e600e00b", "comment": "Malware payload", "value": "996c76b3084c5b388f18f3e12c31b802", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261025, "uuid": "6cbdced3-f0e7-4d7f-9b50-1bc938005e71", "comment": "Malware payload", "value": "264c1de29c69a025150235083c6d30fbf5a035f8ed48d0357aa9c6d0a2768a8a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261025, "uuid": "d836fbf8-47ac-4f55-be38-b6400fe3f940", "comment": "Malware payload", "value": "0eb282e0b6088bac7149b248044121547c6d94bf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261025, "uuid": "c0ab769c-ec94-41e6-b6d4-9c951110a579", "comment": "Malware payload", "value": "a94e847706f24b68473a500e41fb8cf3afc0e0e5414b0213f9438d2324fa7b8765d288a1e429c08e3f3f58c5fd8e7f73", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261025, "uuid": "1e171146-46e3-414b-9fb7-4c3d6f191fd7", "value": "813302314BACD9F628B2E4AFC8CBF504FFB1C495C4D7862649F871C8B6942959E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261025, "uuid": "9de57221-0d2f-406e-8c62-dc74601a7d68", "value": "1536:9jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXvS:ZB9wzbqtWb08UscYJhnpjyq9qB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261025, "uuid": "f9c35faf-864f-473b-9545-f77657bbf96d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261025, "uuid": "ec7d9171-8e4c-46a5-8303-6d0e6b7ea5c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261025, "uuid": "042fbc2a-8586-42bd-a0c5-a88d9b46285e", "value": "diagram-266676228.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb89941-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264322, "uuid": "ab71b5bb-60a0-4903-babf-282b411743d1", "comment": "Malware payload", "value": "26541c7a14b80099887dee2d9932cfca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264322, "uuid": "b0198250-cb5d-4c59-87cc-1bfd772f984f", "comment": "Malware payload", "value": "265301743651b0236aa6b41b6045f29396dd3fab6a4520f7f8fb4a1d915637d7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264322, "uuid": "f04db156-12ad-4396-94f2-05683751a4cc", "comment": "Malware payload", "value": "36838f4276370401fbf2a1e435295d453f210e14", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264322, "uuid": "bb735b7e-4b27-4125-b2fb-eb8bfe52b0bc", "comment": "Malware payload", "value": "6fbd8604b9ed22f90755c7ad8a05b47281342ca56223b71b1ded0cdfd2a0902f59f5b59cda696975fb490709b1ed4a5e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264322, "uuid": "d9ebd3b5-6245-4861-ab79-db386dafc193", "value": "8733F2E0D801E086A755F868DCAB9D038F39DE5D073DB852027EC0C75E72AB5B64AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264322, "uuid": "ef91492a-5c98-41ad-93cd-007cf746db8d", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOqP:bXma7774mfCyWMB/4GpCOqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264322, "uuid": "345f572d-1b36-4409-b74d-ea85fba7fbe7", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264322, "uuid": "0d2c82bd-15d9-43ee-957b-9a7e9a80877c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264322, "uuid": "deef507b-e703-45d8-aecd-3e2830c99e9d", "value": "statistic-631772015.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b5eba9-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264332, "uuid": "5ed2e5ed-77e0-4b28-81cf-319928a37fbd", "comment": "Malware payload", "value": "1448b8c08a9b0615cb143ec225ab461f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264332, "uuid": "76e46e6c-658e-4fd7-9d1d-33e15c4a764f", "comment": "Malware payload", "value": "26587d882c76dadfa9a13f7aa117036b9ab1aa731b88c1e99245f1aaf3538e66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264332, "uuid": "8aa0b3d3-4e24-4a36-bc7f-dcf38864e73f", "comment": "Malware payload", "value": "5ca60519c0d70f6c2305cf7ef47c814736e6749d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264332, "uuid": "1a03e40e-e6e4-4a2f-98c4-1d6255a8b29a", "comment": "Malware payload", "value": "ad3cb0ed595c728a15f8016f0f298736aa37a0ad2540b1e7142bef809c7dced7e80ad6a0ab5d3a28af9132e95645d479", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264332, "uuid": "cb7c44c9-e3b6-4086-9de0-d5c34f4131ff", "value": "413302E09902D087A7597C2CDC6E6D079F3CED0A433D7893112ED0875EA15F8A745E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264332, "uuid": "3c30a5de-d01f-431b-929d-e0703becb647", "value": "1536:WXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07q9x:+Xma7774mfCyWMB/4Gp076", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264332, "uuid": "f2099f05-463f-4ffe-8789-86b139e87e14", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264332, "uuid": "5a0d008d-b792-4aa5-ba18-84c90baebe80", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264332, "uuid": "8b854e30-3a45-41a2-b397-ecf39b1daeb5", "value": "statistic-636413409.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1568cf18-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262540, "uuid": "0978e640-06a6-401f-b803-31c8bfdac0a4", "comment": "Malware payload", "value": "2c2bf0a49a82e20b21ee4a0b2d5602dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262540, "uuid": "5ff8e38b-7722-4576-bbc8-e69c070ec1c4", "comment": "Malware payload", "value": "265d2ca91b13a46437cebb5fecbac1a71f23517e3b0d77abdd257e61f06353c6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262540, "uuid": "40bfd6bc-80f3-45bc-9689-8ceff834ac2d", "comment": "Malware payload", "value": "1f48aedb8c512be3220d39485fb6b5f2a883333f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262540, "uuid": "a8e28830-87c0-4541-aa49-e158ab154453", "comment": "Malware payload", "value": "49fd09cc03b16fd22d020f0a81da0226be1ce2ac165f3f4bbd94c59729a7240d1d8aedf0c8408568a419f12ea77b1d59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262540, "uuid": "cda9e04c-51b5-49ec-9a2d-968fb7383f9f", "value": "233301E0A902F08BD744B84DDCBE9D135F3DED5E433C6892413AC0864D62AF5A715A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262540, "uuid": "87b2e4af-feb5-4d7c-8955-3d5d981d9615", "value": "1536:0XXtg3K7774iXfEz5lnm/hQMOEYus1GpuVr8:AXma7774mfCyWMB/4Gpuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262540, "uuid": "6395f92b-7fd0-4718-8724-3dc288322a7f", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262540, "uuid": "069605c1-64cc-4ad3-b542-e7d3d7413c7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262540, "uuid": "2c4b33d2-a360-41c9-be83-46531ab34296", "value": "statistic-1237703912.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be6e4ae-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261879, "uuid": "5eb6e834-d715-4130-aaa9-9f430ed1b7c2", "comment": "Malware payload", "value": "de867467f769e4c79226100e3a00547b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261879, "uuid": "1874ff96-ef8a-476d-bb2f-dbb36087f3a6", "comment": "Malware payload", "value": "266b2dabdec70920543e6a48aacd030b3314d65fb9ee0e5c1f14b89f2975f727", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261879, "uuid": "ceb79c3b-6868-4cb0-bc4b-fb9490db2d71", "comment": "Malware payload", "value": "e06140a9a5aa12af304946cf6f48bb6bdbc49e34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261879, "uuid": "447f318d-dcd5-47ef-8958-692159ad9288", "comment": "Malware payload", "value": "870304aa346ee97b759d8c284dfaa69e6b1bc63b02c1c5145da4cd859f84db1591b6894514da4953437593faa404709c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261879, "uuid": "af296bde-a9fd-4259-a5ee-ea78bcc5ba1f", "value": "7A33F1314BACD9F628B2E4AFC88BF504FFF1C455C4D78A2649F8B1C8B6941559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261879, "uuid": "c03cefca-e136-4ec4-9d90-fd2b65f8ac1c", "value": "1536:fjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXux:bB9wzbqtWb08UscYJhnpjyq9qBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261879, "uuid": "b94729b1-cfcb-4ef0-b3e7-df30490e157d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261879, "uuid": "6f93ab83-7681-44b0-831d-a3a71865bc75", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261879, "uuid": "5e55ae44-524f-4d68-b832-516ce6483bfe", "value": "diagram-849739444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5783d5-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260865, "uuid": "72f8d190-f04c-452f-bcd3-d58d872bd4cd", "comment": "Malware payload", "value": "510d71aa158bc216fd735c2ae41cf46d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260865, "uuid": "63459f37-4eec-4d87-8201-72f9a15cd08a", "comment": "Malware payload", "value": "2672a74640765831b8ba40b9ed94aa80e4aec590e85a5c240da08d1491dbec8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260865, "uuid": "f9b644ac-dab2-46a4-bab6-69c5e1cf5a89", "comment": "Malware payload", "value": "9bbeb7be3c7741063037c9f177a94c9c2edf5bb0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260865, "uuid": "b1a6e912-46ff-4727-bc9b-467a35045550", "comment": "Malware payload", "value": "53d4bc3c31d78add6381d0b99cec4f7096366b77397e8319f642dc014ea58e427a5a2970962716c611437456d6cd53b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260865, "uuid": "2c85d15e-9150-4880-bb77-d8474266b302", "value": "2D33F13547ECCAA62D76D4BFC88AF944FFB1C465C4D787224AF8B1C8B6902855E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260865, "uuid": "17518d87-8739-43e5-ae2d-537e693735e4", "value": "1536:ljfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX/:hB9wzbqtWb08UscYJhnpjyq9qB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260865, "uuid": "e2ae21c5-05a4-4330-a8a3-2fc307140df8", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260865, "uuid": "b42219a2-afe7-490b-8a24-74f3193bec54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260865, "uuid": "52fd1547-f3fe-4ff3-837b-9a1ff611c30c", "value": "diagram-2116383954.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b56eda9-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263596, "uuid": "73ed23f7-9ebe-4219-9a83-177a35daa2bf", "comment": "Malware payload", "value": "1c792675c913e285ea2b65b1ac0d3d96", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263596, "uuid": "3b824353-d7b4-4691-8b39-65ad6ce12eb4", "comment": "Malware payload", "value": "267a360e1fec4bc6c3184a5c49b6b2d3af541123f9450b841e563d4810601133", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263596, "uuid": "5199cc10-86dd-4370-ba0d-3d7b6bbfb995", "comment": "Malware payload", "value": "ce62922350d7cd84d10368711f82d7a46edd237d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263596, "uuid": "7deb1ced-2b78-46d7-b15d-a1f37a791e1e", "comment": "Malware payload", "value": "51ee73632c89c30f660eea59ec7b57ec287f01859b84f64bb0633556e038fc2369bdc8a6872a2892e68cef583022a194", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263596, "uuid": "fd320e18-35cd-418c-8263-e0300dd62a16", "value": "C63302E49507E0479749BC2DEC5A9D038F3DEA1E033E78D2112BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263596, "uuid": "d962b8d7-5df7-4eed-952d-1ff3435570df", "value": "1536:QXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ5:UXma7774mfCyWMB/4GpWvZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263596, "uuid": "313cb041-7b1e-41a1-b377-68a54b6891a5", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263596, "uuid": "6ac81f64-d0a7-4019-b6c4-32e92b1dfa2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263596, "uuid": "b00447b8-0c83-4e9b-96ac-519fc52936b7", "value": "statistic-2031882793.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23cb94d-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257649, "uuid": "cb31281e-cf76-45e5-9d99-e306faa0da19", "comment": "Malware payload", "value": "f8b43c694a1aa6745da5591f2791343e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257649, "uuid": "9b3afe0b-f766-414f-ac59-ae74889a0b2e", "comment": "Malware payload", "value": "26a6e8ad75b41ad2e62b07b438ec2c9f8346a617473e910a55ab84041248ec20", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257649, "uuid": "dc5529ab-167d-4f2e-90ae-39cb3ed096fd", "comment": "Malware payload", "value": "b725b0e0cd4e841f0fdee8f0eff277fcb376e078", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257649, "uuid": "075d0f56-6575-49d4-b6b7-55d13919531f", "comment": "Malware payload", "value": "531aec51a260481635705ed74b99afa2a5328b46242a9a806aa140d6e29e7ed1e6e0932ab1bdef1668a5b542c2022312", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257649, "uuid": "321fffb5-ed2c-4acd-bbc5-a434e58e3b26", "value": "E233F1A2E544018DCF4FD2EB20F6F9DCF69D7E130A68A8D09A7E1B4581530F1182E25F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257649, "uuid": "70396afc-c0e2-45f2-b6dc-c680116ef986", "value": "1536:x2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIqdXsYs:8fqhp+g5ru2kmUEt88qdXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257649, "uuid": "7d6d7ac0-5b98-4429-915c-4035760dda00", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257649, "uuid": "3616646e-4608-4bd2-9ffc-ba2839d1c339", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257649, "uuid": "64bf6be7-e431-4d7d-b832-4c360da70377", "value": "catalog-1764620413.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d475023b-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260283, "uuid": "407f6eef-39b3-4162-9f57-2f11f82d4c6a", "comment": "Malware payload", "value": "d98eff203dff0a2a05305b8586fbc98d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260283, "uuid": "b5e45a0a-e124-4b16-8c21-4778ae24ccb7", "comment": "Malware payload", "value": "26b96510bc21f71e24237aca78474664e2ad22eb670946bd6d92f111cc63aa1a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260283, "uuid": "b30f2241-06c4-4cfb-b253-cf98b2fb1fdb", "comment": "Malware payload", "value": "e62313d89e61518b30d3f23f6de6be9fa506f419", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260283, "uuid": "d4f7e52b-85e3-4b8e-8eb6-d4ddaec6a782", "comment": "Malware payload", "value": "ce3a2634e29e7f2966c7bf72e1c2e2c7f5eb76a1d00d5ac79fc7061d2aef21bcaeebe52e04ceca3ea5cf3b3d759669b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260283, "uuid": "fafd9eff-1a51-44ad-9efd-80bcc50767c8", "value": "4433F17247ECDAF66872D0AFC4CBF504FFB28495C4D78A664AE872C8B6D01455E32E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260283, "uuid": "1bbec071-be6c-4266-b3f7-1e73ab7b7f33", "value": "1536:kjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXx2:MB9wzbqtWb08UscYJhnpjyq9qBx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260283, "uuid": "409a9afb-c7d9-42f9-a85e-2ba4e47e1eeb", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260283, "uuid": "59ba9dc5-254c-44ac-97ac-94081fc7e491", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260283, "uuid": "ba2e1cd1-1a15-4307-bfc8-01170ee8f796", "value": "diagram-1693618296.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3772ca-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257261, "uuid": "1f4334d9-6911-45d3-8e0c-54f2620e51cb", "comment": "Malware payload", "value": "03aa918c38b66a8e572a6757d292d69d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257261, "uuid": "f73a4b2d-3304-484b-8397-c198977f69b5", "comment": "Malware payload", "value": "26de69175cadffbeda4fda5a3bae5cdbffbb31e30a9d035f86f27ca6069aeb00", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257261, "uuid": "46da1c17-4d8c-4ab4-90fc-056260dffea7", "comment": "Malware payload", "value": "f7eff225dcf78da65b5a70d433b72d5a5ffba644", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257261, "uuid": "08ec63bc-587b-4ab8-9c5f-ada80b3f2320", "comment": "Malware payload", "value": "71e418436aa7780c76c74acc10bd4da9627be88d8573e1c7a796cc5a24301d860490f5e9717c6ac3359df6f28538fe05", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257261, "uuid": "f3a0ba3a-d8f7-4e27-b1d2-a9183e57a290", "value": "DD33F141E655028DCE4FE1CB30F6F9DCF6DE7A030EA974E09A7F2A45C1560F4482A68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257261, "uuid": "07fcc2bb-a4a8-4749-b6e2-a91b54802e43", "value": "1536:K2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIGh:vfqhp+g5ru2kmUEt88Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257261, "uuid": "183ba255-7cd7-4f8c-88e9-8dcda408a465", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257261, "uuid": "8e58b945-46db-44a1-bbe0-e38a406867f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257261, "uuid": "2dfb540d-8b6c-461d-b96e-75928d435724", "value": "catalog-1456760483.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ca19bd-b6a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621209712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209712, "uuid": "45c232b0-0832-4287-9651-e81924e0c557", "comment": "Malware payload (Dridex)", "value": "2238d78548e558650d5cf79a67f7c53f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209712, "uuid": "46e74ed1-ceb0-4f33-bf4c-11a43823aa09", "comment": "Malware payload (Dridex)", "value": "26e7ff5a6348c6ef210b8188df3392db22c73df2cc8e97fbffe9493f30eef715", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209712, "uuid": "3f2cadb8-b068-44e2-a355-783cbcde3d7e", "comment": "Malware payload (Dridex)", "value": "1fa070f15427e29c799843794f359be4504572fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621209712, "uuid": "19901976-d10d-4f94-9cd2-8d04da6b8835", "comment": "Malware payload (Dridex)", "value": "e1b22f5d4e86317f827460cf5164dfb99885fe4e82f30076ea66e005576ba4bb829c8a7a18ac86cfbc80cdf903fc183e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209712, "uuid": "22be8ca8-48ef-493f-8bd0-5bb0dbc65baf", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209712, "uuid": "f7676c63-40c6-4094-9a60-a1830a9c0223", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209712, "uuid": "9d2d8e54-11eb-4662-a73d-07f18903969f", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621209712, "uuid": "2131e497-0ab4-4ac2-a72d-d38056e52ef1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621209712, "uuid": "a7afd55d-4a24-42f2-b9b1-72fc86f1aa77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621209712, "uuid": "3b6a3bce-91b1-45e5-93af-2e9e151e25fd", "value": "2238d785_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1757fa4-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259365, "uuid": "19acd33a-4513-4252-9ec5-6fa76407b47b", "comment": "Malware payload", "value": "456b0c8342ecf1bc7a93e88b9acba833", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259365, "uuid": "24ee7563-6eff-4a57-81db-ec76ec746cff", "comment": "Malware payload", "value": "26f3c20afb0bcd39e63c340f935d97c4c49c1f7b26b462b8b0635847744259bc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259365, "uuid": "227a3d65-c8b2-4fad-86ca-acb3114e2831", "comment": "Malware payload", "value": "8765848ff194e2ec994bc4a4b4379215a9656961", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259365, "uuid": "8b3854c1-6fb9-4567-9122-cbcfc809cebd", "comment": "Malware payload", "value": "1eaeab487160b57075e0f82a212ed4cbfc08de54a214770759430c348789f122c76ef55fb26549d9f75cb5bde7d0316e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259365, "uuid": "8d3f8995-1499-4f97-a932-929176c7bf69", "value": "1033F141E655028DCE4EE1DB30F6F8DCE6DE7A030EA964E09E7F2A44C1560F4492B68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259365, "uuid": "abebbb12-335c-409b-bf90-b532bff6478a", "value": "1536:k2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIwT:Vfqhp+g5ru2kmUEt88wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259365, "uuid": "63cfd59e-a85a-4e1e-b449-1de9c31a50c4", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259365, "uuid": "aa52dca9-b168-48b5-bf27-06947b3b412f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259365, "uuid": "1970ce78-4c08-4243-93e1-d4d2bd3881ab", "value": "catalog-99693028.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5da957-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260033, "uuid": "5f95a8a0-9a04-4422-b34e-04fa22fe86fb", "comment": "Malware payload", "value": "a5b611637d20dd0c011464d1b3742bab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260033, "uuid": "86c162ea-a5dd-4a82-a6a3-333f751eb9f5", "comment": "Malware payload", "value": "270eed7567a09391f19a71fc6157bae8c634cb15775aa9ab3d812479242a9d73", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260033, "uuid": "5f8c4cb5-6a22-4b05-8ed0-ff075c9810c9", "comment": "Malware payload", "value": "aa61fefd0c831bdd72d2c16b258b038ad2ef3a71", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260033, "uuid": "d2660d37-15aa-4237-8e6d-c53d3d510abb", "comment": "Malware payload", "value": "c36bd1a220458136b655b4da9b798f581c10169eeefa87ea749cf68925aab60a9e720316de4e0c7b5797dc9f128edaf9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260033, "uuid": "3192ec57-f32a-42bc-bffb-910457710ee1", "value": "4A33F13547ACDAF62DB6D0BFC8C6F604FBB194A5C4D7866249F8B1C8B6D02845E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260033, "uuid": "910f6add-3a2f-495f-9ccf-08d3e1c9b56e", "value": "1536:ajfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX34Q:KB9wzbqtWb08UscYJhnpjyq9qBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260033, "uuid": "c83e002b-ec1f-403f-9623-4e869c497eb6", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260033, "uuid": "516d1f46-50b1-417d-8efa-e9badb076326", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260033, "uuid": "22518744-09e7-4986-b213-4e2314c029f4", "value": "diagram-1537590053.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35261949-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259586, "uuid": "b4f1bf53-c8e6-4079-a25c-5a9397badacd", "comment": "Malware payload", "value": "28683b2d404bbcf7ca77afac51128142", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259586, "uuid": "c94b2534-d690-40fc-9636-2e9976632c7d", "comment": "Malware payload", "value": "271c1c4efef68c2f0fa1dd8ad703dea86f55b370f679d415857a59b1df2fc26a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259586, "uuid": "7cfb507c-a595-4595-b1f2-b639cb063e9b", "comment": "Malware payload", "value": "d886ad5c2261ebbea9c5ed5ce1e9eb932837fa03", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259586, "uuid": "c898a8c6-8bf9-4c08-bc97-420ddc796593", "comment": "Malware payload", "value": "d9eb0a1749b69aed75d07f82d5f3c77f904992634782c765e310cfe95843d0f4927d7475d4b6902759e4747e2dc551d5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259586, "uuid": "9be24aa1-e1f4-478a-b977-45864bba0b1c", "value": "5A33F17147DCCAA76C32E1BFC4C6F845BFF29821C897872249F9B1C8B5A12564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259586, "uuid": "33d2c41d-690c-4c9c-b1e9-dcc286935390", "value": "1536:LjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wK:/B9wzbqtWb08UscYJhnpjyq9qEK0wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259586, "uuid": "ad4ed4cb-626c-4821-8614-94ab59919a2e", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259586, "uuid": "6268ddd1-d903-46f4-8dea-0a46d8b46478", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259586, "uuid": "bfde6fc2-99fb-46ed-97fc-28a7877526fe", "value": "diagram-116820296.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73429a55-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256684, "uuid": "abc2f32e-7b3e-467f-b98d-0fe95a73a8d8", "comment": "Malware payload", "value": "dbbeae29cad7ee2648517891085d4651", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256684, "uuid": "7741ccd9-30be-4b37-a385-9d9ce8c29121", "comment": "Malware payload", "value": "271ed6c82674384a8f7295fe7c2c997ff8fec0da60c01c47624866897c1c2f78", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256684, "uuid": "1d24ac13-158c-4a67-b361-a38dfc83c319", "comment": "Malware payload", "value": "635014379bb1298c9e28cbd06e61486e59245586", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256684, "uuid": "9c3685be-0773-4235-bbe3-683be28329c0", "comment": "Malware payload", "value": "35204ca5927b39954f68198afad30fd4a7fe5b38d4548393c57a1b1264640c79b80523f0a93f9ca6ca3dc6f62c3da7a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256684, "uuid": "e464a27d-9e63-4fec-bc33-a972a875793c", "value": "C1330286D265214DCF4FD29630F1FACCE5DE7A830DAAB4D0A63D2B4481931F4492B65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256684, "uuid": "b9bc8dae-9686-4c85-b521-ac33963caa56", "value": "1536:r2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3D:Kfqhp+g5ru2kmUEt88IxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256684, "uuid": "eb705158-b63f-47f8-9fe8-3ec1c8616995", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256684, "uuid": "851bbc38-8bb7-4ad5-b022-6fb00ec46c30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256684, "uuid": "50c85747-5f12-4452-b6b9-ab16a80ffee3", "value": "catalog-1023873177.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0873ddcf-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258223, "uuid": "c6f71790-8a52-44ba-ada5-5f432a3cb174", "comment": "Malware payload", "value": "076831a4a72dd0ef672572cd7171f3ba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258223, "uuid": "1284d54d-2bf7-4f77-8caf-fff4d1de8c14", "comment": "Malware payload", "value": "2739cab7a68b9f9be365a52c41df0d9c4b344742931dd699ce91c6d0354c679b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258223, "uuid": "0e4c260e-5b8e-4a91-8f06-f52f796664b9", "comment": "Malware payload", "value": "bb1744edb7b45ef85d638988a9549e426d6ca0d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258223, "uuid": "3b1d3d9e-6c1b-4045-b9d1-8c8076155916", "comment": "Malware payload", "value": "7ae7f2c1c15a5672fcd14aa8774e02350e6d53b4b85a55ffc4aa48be0e23b5a9fa4002b9371cfd7cf988f3449b8cb6ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258223, "uuid": "037e8359-09d6-4b19-aafe-534828fd4bef", "value": "27330195E524108CCE4ED1DF30F2FADCE69EAF5709A968D09A6E2B04C4930F1082F58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258223, "uuid": "47481af5-1707-427e-acc4-58447176f55f", "value": "1536:62fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIlDC:/fqhp+g5ru2kmUEt88l+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258223, "uuid": "0dfb086f-58ca-400e-b507-cfaf096d4aa3", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258223, "uuid": "86b3b40c-63a8-49fb-8f2d-3687cb37a60f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258223, "uuid": "a3e2495a-e75b-4296-9255-6f5f5c5b0754", "value": "catalog-259663309.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b62b53d-b6e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621239035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621239035, "uuid": "b7c8162d-ac7e-479b-9217-fe9297131bf5", "comment": "Malware payload (Loki)", "value": "27bf780e3c0b6a5bb77a1760c2d08273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621239035, "uuid": "6dcf9715-ed2d-4738-b778-72b682877797", "comment": "Malware payload (Loki)", "value": "273c4ab7a5dd082982ea664bda0061e81e3653f855c2b1811455eae024c00243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621239035, "uuid": "7c6a8150-d7af-4371-96b8-83c7f6b38098", "comment": "Malware payload (Loki)", "value": "0344f1fb095b801beeb26192794ab4e712c7b5be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621239035, "uuid": "d6041b51-978b-426d-bea2-3d930f8ca0cd", "comment": "Malware payload (Loki)", "value": "32083d613c15360690bb77b37f11b65bfcb3db758b23d5534d3065102ac113cc80fa6bdc7742cf2a0702485eb5fe9aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621239035, "uuid": "f937537c-6a08-4e4d-8723-596ccb3724d5", "value": "42E4DFA122F8CF66E03C43798474E5214FF1AC47D76AE609BDDE32AA6FB67504527302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621239035, "uuid": "4061475d-fb9d-439d-9530-50b7bc99a4f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621239035, "uuid": "97cddbe8-836b-4c63-8941-93a936c3e40c", "value": "12288:kql87+3gvgWPY3n51dRhbytU5T005DoqQIoYyqKz7aJIh81M:700nTdRhbGU5g05MhIwz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621239035, "uuid": "5ed75d33-f7be-4620-8613-3fa2ebbdf49e", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621239035, "uuid": "90e61a89-2828-469c-a254-0f6cddacdd73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621239035, "uuid": "8140b3ea-0dbc-472c-a013-71026d98c147", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5912b6af-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263942, "uuid": "714cf53c-0e42-4c28-820c-61d8a4dcc09f", "comment": "Malware payload", "value": "8b3efc7ee27986da4e043c8675e46be6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263942, "uuid": "6e7b814e-119f-46d7-a6e4-f0f77bd4f5db", "comment": "Malware payload", "value": "2764cc888b6b2a36b2ea48fc6a750a1f9ef61abf3625ada503830d0c20216837", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263942, "uuid": "c3196bcf-406e-4d70-bb75-1b3bc34ba9cd", "comment": "Malware payload", "value": "27672392ad0445401aebfc9354d90db9e45e593b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263942, "uuid": "bc0996db-c6ff-4994-9253-275abd382489", "comment": "Malware payload", "value": "dedce420ab97ec4ca52c7a9e483d53d0669b36dbf8cd41df2728a025fccb35eb4007e0f1001b65aa65bc03ae45e3a64d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263942, "uuid": "6be953f1-e52a-4322-82a5-0bf5a4c53f04", "value": "2933F1E0A502F04BD318BC5CECAE9D024F7DDA1E433E7892457AC0875E62AB5F749D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263942, "uuid": "2dec15dd-9b9f-4166-9db0-9fd2dda60924", "value": "1536:kXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EI5o:QXma7774mfCyWMB/4GpV5d5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263942, "uuid": "747bf138-ba7f-44be-a077-1bbf0c6b9ed4", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263942, "uuid": "5a3de573-51aa-4dc7-8d35-6bed1a9ed3b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263942, "uuid": "d17f7997-00b6-4730-852d-3d76211347cb", "value": "statistic-376797464.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5afa68-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259255, "uuid": "42efcb23-b9f5-4917-ad07-e016c383c388", "comment": "Malware payload", "value": "1407c8a8ec01d7901ccd8152f57e5799", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259255, "uuid": "d05a02e4-0c8c-49e4-a364-36f63c6c4a0d", "comment": "Malware payload", "value": "276a76ebcb3aece3e89da8548a44b300fc1f7f600b287ac126a239c5f7d835d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259255, "uuid": "e45ce80c-bb9b-4a1d-a554-aadd00276824", "comment": "Malware payload", "value": "b27a641d52e393ebbb386cb136744767dbe5c7f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259255, "uuid": "4843ede3-0ab9-4df4-b1d9-d5b01deac92c", "comment": "Malware payload", "value": "bbea7db92b1fd3a837a6620f91da8cf2b5dd3763be4b60cafe535d144976577041a291de57c93a5ddb4635970c3df5f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259255, "uuid": "2bf81f1c-0200-42af-b255-cabe1981b654", "value": "52330282E658018DCE4FE2A770B6FAECE57D7A53099DB8D05A7E1B0591934F1082F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259255, "uuid": "bf426102-389d-401b-a01e-900c08450961", "value": "1536:X2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI2dG:Gfqhp+g5ru2kmUEt88+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259255, "uuid": "eff4b536-6cc0-438e-8ecd-2932da7feb33", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259255, "uuid": "a5f59ed5-6b59-40ff-ba97-e8abf6a823a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259255, "uuid": "e5d45e97-c95b-4053-9d21-598a58842969", "value": "catalog-900196819.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdbdc13-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258074, "uuid": "c17b2ae4-1a4c-43c0-8a14-58cb5323a055", "comment": "Malware payload", "value": "6dc02f2ccf2ee72384de502fa9bbe1d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258074, "uuid": "288bb10b-d19c-4b9e-81f0-0d2e3f4b5e17", "comment": "Malware payload", "value": "279e372aaa0678c042263d740564ec9e87ff96c09fdc2f12069e2b7513f26102", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258074, "uuid": "09ab6be0-2c74-4b7b-ac7e-5fca725a6e70", "comment": "Malware payload", "value": "f60b016d74539ea4dd2ff23c0f9ac5e28e44d886", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258074, "uuid": "d28c8e68-6f22-4118-bb70-5decb95f33b5", "comment": "Malware payload", "value": "430089d11893695d7b16462258b6ec25e8afea8d49ab10c390ee216f743ec130262a805dbbd162475379e7ff2477982c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258074, "uuid": "a96c2077-458b-45dc-b704-fcc763c4daec", "value": "0233F241E655028DCE4EE1CB30F6F8DCF6DE7A030EA974E09A7F2A44D1560F4492B68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258074, "uuid": "5722f613-61b5-4d02-9781-13cdb3c9bcc8", "value": "1536:12fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIPt:wfqhp+g5ru2kmUEt88Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258074, "uuid": "f07eaaec-7e00-409c-87cf-7b620224f9db", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258074, "uuid": "7a4d3bf0-e457-4a36-b9a1-0182e3755dd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258074, "uuid": "e6de4eff-dafe-4e38-891a-3d1f994a12b8", "value": "catalog-2078183232.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f20a87-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621260638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260638, "uuid": "7c06f26e-e5a7-4be5-b495-f1f52f8654b3", "comment": "Malware payload (RemcosRAT)", "value": "a2ff4eb7391183b63277e0d7dd37a45a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260638, "uuid": "f83331dd-8620-4859-a760-73e3a35c83c0", "comment": "Malware payload (RemcosRAT)", "value": "279ef40d413c9ce6dd519c1fc71ae55a5af3f7b14c789ace904a66fd4ea8fc2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260638, "uuid": "74c5ac19-8516-4bfa-aafa-d56ac550917a", "comment": "Malware payload (RemcosRAT)", "value": "3ed1017c9afdf3daf485116224e9c5c8f26c9cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260638, "uuid": "fe40905d-26ba-418a-a362-f197bfa2cec7", "comment": "Malware payload (RemcosRAT)", "value": "e5bf2a4b5554f77d53f3d1571156c12e290d341feb7b17c6c1d5f40495e458cb79aa317ba470315dce8f1bccdca581fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260638, "uuid": "0b5a56e0-c35a-4b6b-859d-3847b2808a6c", "value": "BDD3E927766A81A3E85141B053647B228DFCFC76CA095D93E3C5C1811DF4EC6E06ABBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260638, "uuid": "1dfcfde2-cec9-473b-8727-219950e33316", "value": "fa1107e773796a494c44045d5372098c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260638, "uuid": "c24ea067-af71-48f6-baa4-f47d7e384d7d", "value": "3072:W4XgM0gTUJNFbnOabI/JZ7k0qvo7wvdbnrlSl26FaqmrzqhETA2hr5:pXgMtwNFbOabI/qxlSl26FaFrzqhEZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260638, "uuid": "aa50c4b9-877a-4a5f-9fd6-c64b5cb8827d", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260638, "uuid": "4508d170-7720-41a5-8d95-df2f16ba5e49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260638, "uuid": "676ea236-dd8a-48ac-928b-85e6225d7a39", "value": "TEEWIREremcosagent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee44da0-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259415, "uuid": "7ebee847-853c-4ccf-8415-8fb1d89e6798", "comment": "Malware payload", "value": "7692fc0bb6686d9ff251baa69d309448", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259415, "uuid": "08ae9875-7b18-4706-9042-4383e3591d6e", "comment": "Malware payload", "value": "27a157d7bb17b4be663d5255013993983d6ec9e702369b751f3025bb3bdb366a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259415, "uuid": "90a21d8e-7702-40dc-a9ad-e2060e9bd788", "comment": "Malware payload", "value": "dcae10ef2b562b4826a51a3a0d67d349c473de7f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259415, "uuid": "ee9504d6-1d16-4f54-8100-432bd8794f51", "comment": "Malware payload", "value": "a7f7faa5afb3aa5ceac0a4983f49d737e4ca5e8595a5ab474d0d5304727230299deec2425d495a50b3c80cb1f60af7fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259415, "uuid": "d0694bce-1909-47a6-bd4d-871d9df21b08", "value": "D133F17547ECCAA76C72E1BFC4C6F845BFF29421C897872249F9B0C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259415, "uuid": "7f9d23cc-bf43-4b2c-a7d6-a881cd7fec08", "value": "1536:vjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wB:LB9wzbqtWb08UscYJhnpjyq9qEK0wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259415, "uuid": "a381961d-ed7b-4aeb-aba3-cd1d635fc4a9", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259415, "uuid": "666f3b8a-c7e8-4f25-8ba1-dae469a5d3ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259415, "uuid": "88d7b466-c307-432e-82c8-0f3e9b669770", "value": "diagram-1048143349.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70547ae0-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262263, "uuid": "89666e8d-810f-42eb-9d92-c5249f97dd3f", "comment": "Malware payload", "value": "2fe57ef7de15e92e06895bc80ed80814", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262263, "uuid": "d98b7bdc-e6e0-412d-b369-941b1abdbcdf", "comment": "Malware payload", "value": "27e3698ee2b5ba22698208692fd120dddbdd2c20f3d439b38f2ddc2bf75e8f25", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262263, "uuid": "a89f5f9d-ed06-4468-9fd0-78b77ff55767", "comment": "Malware payload", "value": "8869c2218036bdd8063564a47a75a2db73224c0f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262263, "uuid": "e8dc92ed-6b6e-40ae-a214-df8b00aa0c2f", "comment": "Malware payload", "value": "5f7762788b3fdbef1a1a144942a45d10399a1108d274fd76cf550acd3ae2e41cce4994a5751f707b84f619203ca8cc8a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262263, "uuid": "3ff8704e-6454-44a5-acc6-5d68dc0a2ffc", "value": "423301A0A902D087A759B81DDC7A6D038F3DE90E473D6C53113ED0874EA29FD7649E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262263, "uuid": "0f82eedd-b59b-4818-aa29-688fd4761b1b", "value": "1536:uXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07q5xe:GXma7774mfCyWMB/4Gp07KI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262263, "uuid": "5750a9ee-b743-49e0-b7cf-854f8b1bc65b", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262263, "uuid": "02d20ebe-a725-4921-895c-b2b6a3e4f757", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262263, "uuid": "5ef46d57-b921-4adc-ae1e-f2e53b6e0cf6", "value": "statistic-101294066.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23737b7d-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260416, "uuid": "f2ed9ec4-304c-4004-870f-d85d92e2ca0a", "comment": "Malware payload", "value": "361a75f3b8a8473466c9ea10db0e49f7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260416, "uuid": "c9a73f84-2d59-4484-94e9-4758bff5d5ab", "comment": "Malware payload", "value": "282ae4db39c92b328cc16f4a911bb1d884831a57c7881701653d3abdce4e6916", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260416, "uuid": "075645bd-bdce-4591-a649-d96a22b97956", "comment": "Malware payload", "value": "596bcaa236db7a4ce580e2667b2894041e5a5a04", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260416, "uuid": "388dd634-7353-4121-a5c4-f96d9cf13da5", "comment": "Malware payload", "value": "966aca45778cd3c4880640045bb6bfc8c2bb3b351ed44ab366078675257aef9da019fb920b4af561923246a1942d8a14", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260416, "uuid": "b12b5e3f-1a05-45dc-910f-2cee11ed3e58", "value": "1233F17147ACD9E668B2E4BFC8C6F904FFB1D499C4D78A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260416, "uuid": "b78bdae6-7e8b-4493-8016-079185fba474", "value": "1536:7jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXl9:PB9wzbqtWb08UscYJhnpjyq9qBl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260416, "uuid": "0f6e07ad-bacc-4c1e-ae2f-237179c48324", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260416, "uuid": "9e8ef6e7-b559-4d1c-bd78-164834f852d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260416, "uuid": "a7814f00-cff6-48fe-a77c-91ca03e2cced", "value": "diagram-1762221878.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe29afe-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261644, "uuid": "c751e03b-a318-4582-8dfc-422000010a21", "comment": "Malware payload", "value": "ca89886642903634c8f4d68e3fd7a9f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261644, "uuid": "fdbcbdf5-83b7-4da3-8da8-15171d007b61", "comment": "Malware payload", "value": "2836e08ade551a0dc4ee8a7c93920ea9e8d780d598d45ff2dd99936b0e50b260", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261644, "uuid": "b8a04178-dbe7-42fc-a680-e97b1c23639b", "comment": "Malware payload", "value": "601ae46ae8cd05ddf45d9f68dba90284dd47b711", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261644, "uuid": "eec1bbc8-5075-4e7c-aff9-f144c9d1d0df", "comment": "Malware payload", "value": "69f33ec79bacb4421fb26e9830bf953dfc48748ed4d2a724a8bfa4f83b069dc7f10e5e538b52d31d3b301cae47b5528f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261644, "uuid": "0e74e6b2-7df7-4db3-971b-f7d82ef6c75a", "value": "C333F13647ECCAF62972D0BFC4CBF900FBB18465C4D68A2249E8B2C8B6D01955E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261644, "uuid": "5031fbde-353b-41ee-b8bc-05cdf1f05ea8", "value": "1536:njfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX9h:jB9wzbqtWb08UscYJhnpjyq9qB9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261644, "uuid": "0e91977b-41f8-4bcc-80a5-152f7f8c52ab", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261644, "uuid": "74d2060a-f019-4ac1-b843-5ae7fbb7bf39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261644, "uuid": "6ca7d55e-d2f5-43d1-8d75-6ca7b3c3996e", "value": "diagram-696904890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38dabd9-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261490, "uuid": "64285517-e350-4ae1-9e34-edbfd59842ef", "comment": "Malware payload", "value": "4a660429e3079049b7cd86496a1080fd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261490, "uuid": "32804147-75cb-4314-bce2-a1fb92495765", "comment": "Malware payload", "value": "283badfb7bc3d919be558afab38a24168bdfb3f3fb6bed8eac88ae474e6ea0a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261490, "uuid": "586e8a5b-2d81-4ecb-bdcc-e6dc9017304d", "comment": "Malware payload", "value": "949b23f902446dcf0d88c249c739d23d9ee9c5da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261490, "uuid": "e80f2a40-c31b-4ad6-b4ef-ea722bed6319", "comment": "Malware payload", "value": "e7c409231dd8ceaf4551ca796e8d17849497ff1c9d695cd281eead7665064d236f8e26fc847637df553ec796af64c282", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261490, "uuid": "ab15aef4-0195-49e9-9adf-a94ced198196", "value": "1033F17547ECCAA36C32E1BFC4C6F805BFB28421C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261490, "uuid": "0c6d7346-7c4f-4332-be31-a41699ec0b07", "value": "1536:kjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wm:MB9wzbqtWb08UscYJhnpjyq9qEK0wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261490, "uuid": "5b218955-274b-4026-92a4-6b2f6e73f046", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261490, "uuid": "640adae7-2151-46e6-b485-c740fdb15c4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261490, "uuid": "8187d6e5-a5fb-4cef-9358-e08ef61a54b6", "value": "diagram-58895225.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef0c698-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262395, "uuid": "dea1e402-9f93-4bcb-b4a6-9e72c5bb196f", "comment": "Malware payload", "value": "305bb948bc1c0138d83395ee61917fc1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262395, "uuid": "381f2437-5a0d-4ca3-baea-94deee2c1807", "comment": "Malware payload", "value": "28417a7105b6ef086b095a2ef3f85e9f22b2981b2848fd392f14c2e62788a1c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262395, "uuid": "b297dc0e-4a39-46a5-b0ea-1d77a4835cab", "comment": "Malware payload", "value": "f57374b1f1bae74d6c9627d0186bd225c9f30f95", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262395, "uuid": "67b62f5f-05f7-4645-b4e9-1c520c99fd4c", "comment": "Malware payload", "value": "04aca1d8b612d3897f4582e5b83efc77657f2555669ba0d4612f7398a038b49aa5315d1d69509bc05e7b5dba042d37a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262395, "uuid": "36419b30-ef0c-4a8d-9ee4-4094ca481c16", "value": "023302E49507E0479748BC2DEC6B9D038F3DEA1E433E78D2112BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262395, "uuid": "c9bb1347-f2dc-4c87-a5c8-54e0959d313d", "value": "1536:kXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZV:QXma7774mfCyWMB/4GpWvZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262395, "uuid": "a2a0f276-fb74-449d-bc3a-cd8ffbe9d9f5", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262395, "uuid": "ea090bcd-87a9-467d-b471-78d199caa34e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262395, "uuid": "94996d59-56b8-44c4-ab03-340523bb38d7", "value": "statistic-1131916127.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42aedea2-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257032, "uuid": "9f861ae9-46cb-46d0-8ae4-e8ac040255af", "comment": "Malware payload", "value": "97400f07fff9e87af8e18739cb0faebd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257032, "uuid": "fd0483eb-b763-47c9-b2f3-39ef361c2e16", "comment": "Malware payload", "value": "284367b7b3c4ec20c052df41f7c9b87dfcdd36ebe502b39fda5e1609c8ec49cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257032, "uuid": "d50ad6e3-c74f-447d-9bda-26d3b3d9bd51", "comment": "Malware payload", "value": "ae797c37418b6c06c5570c41385a4a4ae06d6a7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257032, "uuid": "4822b3c0-5f04-486d-a440-6cb9fd221dea", "comment": "Malware payload", "value": "8b58e49dd6761e7b7c389122150fb8fc57d4aab6a52cc249cc58ef07d11f4230d791b6f83b490bf75c7c9107098e7d37", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257032, "uuid": "c8b82284-134a-4d54-9eaf-b05f5de3f39e", "value": "9033F184D164108DCF4FD2EB30F6FAECE19EBF43099A78C09A6E2644D2520E50D2F65B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257032, "uuid": "eb5be248-6b24-4ee5-9ddb-e07b24c6a023", "value": "1536:H2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbvI:Wfqhp+g5ru2kmUEt88mAbvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257032, "uuid": "0a0a1f83-0cfd-4944-88cf-aa973f864401", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257032, "uuid": "a0242ec7-5f57-460b-8545-075d20a2c187", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257032, "uuid": "fb9d26c1-c91c-4d6d-93fe-fd3fc1ed649a", "value": "catalog-1309651221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbfce33-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259225, "uuid": "cd3f30fb-d3a9-464f-9228-2912427b5c49", "comment": "Malware payload", "value": "ed6e3062dbf7bb233d943528076ffa87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259225, "uuid": "0d0cf0ee-9351-45e1-8913-23a66d086bfa", "comment": "Malware payload", "value": "2852045f293ae753c532d79e9105a2b88ab98d263518798158055d0909e45f87", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259225, "uuid": "c55e95d7-41cd-4616-b601-38ff610909d3", "comment": "Malware payload", "value": "9ff777a08848f1c430c871a86d8db2fe4bb360ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259225, "uuid": "05a56042-39f6-4a87-a054-906727cf720d", "comment": "Malware payload", "value": "c13bb811315ad0ab5658456823ad3ce5430b2f4ce669d882b9621d8bdb8c5883e732f73557a19a93af4d4d295fb1100f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259225, "uuid": "928b7eee-8274-42f2-81bd-9bb221e9ffb0", "value": "9633F146D664018ECE4BD2EB30F6EAC8E59EBE47099E74D0977E270582534F04C2A2DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259225, "uuid": "8359fa9e-f155-4d84-8052-fe74ddb93b08", "value": "1536:p2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI6iMo:0fqhp+g5ru2kmUEt886E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259225, "uuid": "9f4edc49-8e37-4124-bb03-7060d47b5695", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259225, "uuid": "33267c19-ee5a-4b49-aece-44f33062c5ef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259225, "uuid": "901a22dc-f413-4865-bef9-e54a480932bb", "value": "catalog-877581906.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93817556-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258027, "uuid": "0a503074-b507-433f-a265-4321cae87198", "comment": "Malware payload", "value": "7f32b1d306ae531ce3fad1392923e284", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258027, "uuid": "c5c46d6b-b9d6-493b-b48f-dd57e91a4519", "comment": "Malware payload", "value": "28571b98cc8a6f8c53a8cd6ccd841e9e5d0d34c8d161a90f0ab08b92199f3bdd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258027, "uuid": "e8919ca5-3259-4e36-8e81-9e1d9209d95e", "comment": "Malware payload", "value": "b1f55180835597352a88ee375ab330c9dcb2c103", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258027, "uuid": "3ea39ad3-129e-4f7f-b610-1d3d63ece009", "comment": "Malware payload", "value": "a48f96ff2f84e6d1d7e2fb9dc30232cba116500b8bd4d64fc892c44c8f0a5bf374b86ad5e63b20e7fd66af4f030dbd7d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258027, "uuid": "47053f6e-79f7-4b2c-8245-78c4cfdb6d84", "value": "A633F184D164108DCF4FD2EB30F6FAECE5DE7F43099A68C09B6E2644D2920E54D2B55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258027, "uuid": "832bc158-49ed-4396-add0-1b017fea1c8f", "value": "1536:e2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbWy6:jfqhp+g5ru2kmUEt88mAbWy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258027, "uuid": "d3467172-d234-4aaa-a987-af2e869cbb22", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258027, "uuid": "b73cdb58-e8d6-437c-8ceb-815aa8d23076", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258027, "uuid": "5cbdba65-09eb-4c2d-9ba9-b83484093f32", "value": "catalog-2048236211.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bce8622-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257557, "uuid": "e048a596-45fc-4365-b441-0c8efe880753", "comment": "Malware payload", "value": "eaae48f927bf6183d1302f6c04500c27", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257557, "uuid": "6e40c367-3caf-447a-b28e-0abe8a510ee1", "comment": "Malware payload", "value": "285bf9b937108ce529d06351b8dc4e4b1d481d9b7460c8d5f4afb8499dddc840", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257557, "uuid": "8532bd46-fa81-410b-a279-98dc50c9c98e", "comment": "Malware payload", "value": "4573eacf7ced80f2e1a518c4654d9d1ffcbedb9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257557, "uuid": "9e720fcc-91b3-4d24-8b11-855a6a70e396", "comment": "Malware payload", "value": "867c05564b3ca168798ecee3024d83ee9f765bcca889a716b6fd78a87a782b95e35a10ccf5c9386a80c4eb76920e2937", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257557, "uuid": "3ed62ab8-badf-4edc-9491-45ea9b243c35", "value": "A1330186D264214DCE4FD29630F1FACCE5DE7E430EAAB4D0A62D2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257557, "uuid": "1d994a08-7a40-4ba0-8d03-3f7ed574f516", "value": "1536:r2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3x:Kfqhp+g5ru2kmUEt88Ixx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257557, "uuid": "469a708f-845a-4e42-aaba-977cd9fdb842", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257557, "uuid": "4f3c17bd-40fd-40a3-8008-ab58945d0df6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257557, "uuid": "49befbd2-c082-4e76-8c4c-4d837fd4dba0", "value": "catalog-1689756378.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20ec70d-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263742, "uuid": "04dff3dd-a321-46a8-a455-09bf995afa8c", "comment": "Malware payload", "value": "7a4a5f95f8ccbe1171c2635148c830ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263742, "uuid": "62b4c7b4-9220-4a4d-9418-6e824112364f", "comment": "Malware payload", "value": "285ee977f0995e4b4afb53b5a26be69d82d51e0834972e91c3d8f2185ac281f7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263742, "uuid": "54dd54e8-85c4-470f-a116-8ab97e4c8889", "comment": "Malware payload", "value": "19cc9df8e26f1f6694b18fe28e19963ece98b6a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263742, "uuid": "78519c14-6a90-4917-94b9-1db739baa4c9", "comment": "Malware payload", "value": "eeb88cdbb7effe6428c585e9fd3c17fb083aba34ea048cb0dfc7ff4580863ba7a74661ced9cf42dc8300a5242c7c4e2f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263742, "uuid": "5cea4fca-fdc0-4e92-b452-906bebbf3210", "value": "6A3302E49907F047E759B80CDC6FAD078F3DDE0E43BC7892026AC0839E51AB56549D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263742, "uuid": "19f3e9d1-f923-4258-b239-5ba2ffa7100a", "value": "1536:YXXtg3K7774iXfEz5lnm/hQMOEYus1GpFK:MXma7774mfCyWMB/4GpFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263742, "uuid": "25a9ae35-2362-4656-b97b-664e1060cd8a", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263742, "uuid": "47813e4f-92ed-4010-b37d-22b4dbd5077a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263742, "uuid": "5ad8a773-f9cd-4815-bb80-500a2e88f3e4", "value": "statistic-213333897.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c9d9b2-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257520, "uuid": "a2debc07-5f40-4055-8a26-07054ed6e216", "comment": "Malware payload", "value": "fe173a5cab765839d528ac15ded3c1a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257520, "uuid": "04d29a3b-0b17-4f1e-9799-3e7d43372de4", "comment": "Malware payload", "value": "2860705ab2ee8b73057ee723c32f50e80a30be67bae0a37baa78f7efb751d0a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257520, "uuid": "2b31f6b3-d7fa-483c-9e13-e2754d871864", "comment": "Malware payload", "value": "69cceff8504dcfcce6f888c62747ab2742ab7542", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257520, "uuid": "8bcd653c-9d1d-4b23-8544-f4e061e31bd4", "comment": "Malware payload", "value": "d512c043c6abfab5b51d9df8629c8417c3f9437d8872138e1610840752a7dcb2f8dce875990ce5383080f463643ec0ec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257520, "uuid": "0f287b67-39dc-4f60-aa96-2112f5649666", "value": "9E330282E658018DCE4FE29770B5F6D8E6BD7A530D9DB8D05A7E2B0591534F1082F09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257520, "uuid": "277de87e-bf61-4a20-b733-8147c897b29e", "value": "1536:U2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI2uD:lfqhp+g5ru2kmUEt88hD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257520, "uuid": "502e12b7-ffa7-4f39-81a0-e496f54d088e", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257520, "uuid": "73bfeb07-cdbe-442a-a590-8541d399c763", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257520, "uuid": "b58fc2ca-9f9e-46ee-82f7-249c32e9eae2", "value": "catalog-1650923787.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2584054c-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259990, "uuid": "394e9c0a-cae5-4d28-8a4c-2f1304bf2c59", "comment": "Malware payload", "value": "9886ae5a01268dfa281ce1370b659395", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259990, "uuid": "fc0c4c39-338a-4661-be05-d45e3a364d7e", "comment": "Malware payload", "value": "28692902c7014bf6b2a65ec326ac6ebbfe948fbf55bda1aa70d9c27a21904675", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259990, "uuid": "48c33e20-db3f-4252-a79c-2c25cca19097", "comment": "Malware payload", "value": "eebae073119e660e705b8c8d39b61ec432f1875d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259990, "uuid": "3a1e3901-16f6-429b-a8b2-302b7212ceac", "comment": "Malware payload", "value": "7f20599caa66cd030f0ae66237f41876551d9a5b1b20c43aac5329e683f28a1ec495e88200b2d0325ebc89ee39a72a05", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259990, "uuid": "6f083b8f-08e6-4860-bcba-57e74e06012b", "value": "583302354BECDAF629B5E0AFC8C6F604FBB19495C4D3872649F9B1C8B6D01855E32E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259990, "uuid": "5c6b682c-419f-44df-b791-63654747a9e3", "value": "1536:ejfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXin:WB9wzbqtWb08UscYJhnpjyq9qBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259990, "uuid": "6645aef5-6bf9-46cd-b1a6-b68b7e01b8df", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259990, "uuid": "7dc1a358-d568-41d6-b533-dc2b399c3407", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259990, "uuid": "1aa3a49c-eb5e-4cfb-874f-d3990be68472", "value": "diagram-1505382303.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc09535-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257940, "uuid": "4469f908-dd23-4d41-97a0-c7b0c9ee8dd3", "comment": "Malware payload", "value": "188c265eaaef28bf19ab2798b93086f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257940, "uuid": "df8bd8e8-98fb-41dc-82b8-aa145d536d7e", "comment": "Malware payload", "value": "2899edba3800490c1840e503b69357cbd9a54c55a63078e2bc69c0b7e2e8a431", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257940, "uuid": "ef25fae9-d2fa-41ab-aca4-9bca5cb8f93b", "comment": "Malware payload", "value": "7f9f10851254b9a7f98ff3c5f3d48974dc71b5c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257940, "uuid": "2e16d778-ae0c-4a77-b44f-e4e838dc6d6c", "comment": "Malware payload", "value": "1c2ec936657a2835c25b1ae2c35a5db7e07c8be9b422065f6dd0945906780e2f856bf4ad040e0b7e7eb3bb0f65402dd3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257940, "uuid": "5a6aec12-911e-4f2a-96fa-095804000f56", "value": "27330291D694028DCE4BD3EF20F6A9DCE59EBE53099AA4D09B7E0B0191530F1482F69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257940, "uuid": "db4af7c6-f4e9-44a6-a331-2acfd98b49cb", "value": "1536:k2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIB7bS:Vfqhp+g5ru2kmUEt88B7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257940, "uuid": "b2986ef2-2543-4f3f-bccb-cfca5e157d19", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257940, "uuid": "e2a7c4a8-8dd3-4459-9de8-138b205ec452", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257940, "uuid": "03ad9a7a-7fec-478e-9cd3-94dbe08dad4e", "value": "catalog-1987932018.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b33e762-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259704, "uuid": "d3f509cc-1cda-4f28-8bb7-bfea09d45aaa", "comment": "Malware payload", "value": "de565f1fdce5dd66f3efc2d6f7dbd4cd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259704, "uuid": "21ca69ba-213f-45a1-a2ee-f40e7e45b357", "comment": "Malware payload", "value": "289dfb36e42996dfdb17aaaec1ea3d6466542b7722af5b5422747567ac36f62f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259704, "uuid": "0192460e-8267-4699-a81f-026507d22da2", "comment": "Malware payload", "value": "a0479167250ce4d5894861149f2e60a9e914fb47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259704, "uuid": "7e94af20-56a4-4efb-92fd-2a626b0dbfbd", "comment": "Malware payload", "value": "877252d4ad8d68018d929231c24bcace5052d129b889f53426fbc1112bbdf6da30038dfbf1d879c4baf123134bb14f77", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259704, "uuid": "0ad225c2-6407-423e-a523-1fe623a6e0fb", "value": "B333F1710BACDAA62DB1D47FC5CAF904FFF2C8A4D5EA861645F870C8B6D42558E31E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259704, "uuid": "5639bf44-57c9-450b-9ba6-4ac327441553", "value": "1536:OjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67kK:mB9wzbqtWb08UscYJhnpjyq9qawN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259704, "uuid": "b093eebf-d55e-4f57-a311-3c36845d0646", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259704, "uuid": "9227a5c0-cdd2-474c-ab9e-c22f5a821fe1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259704, "uuid": "101abf5c-3ed2-418e-9b76-4055af04b1ef", "value": "diagram-1258492232.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa00fc-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260104, "uuid": "8a38466f-5ec1-409d-94e8-a2f0d5830ccf", "comment": "Malware payload", "value": "fe8fcefe6f62f83014c9b0ba2018bf56", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260104, "uuid": "a19eeb53-598c-497c-bcf8-b74e6ae5fff8", "comment": "Malware payload", "value": "28a5804209fd3161e4acc33933f4098da3731b686caa8a5578257d1e6848008f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260104, "uuid": "5b3493b5-99b5-4b05-b8e1-be62c82123be", "comment": "Malware payload", "value": "b20f084fc65d9954f12ca13455e67f5ccc833a96", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260104, "uuid": "2e938c93-2537-467f-9861-8cd0c0808203", "comment": "Malware payload", "value": "62f51ec2d5c29c13928422c2f43602e9462adde15b4ee96c1b72beff99d2272acd67bdef31c96f84c163b9bcd0b37ba3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260104, "uuid": "dae1b008-de96-4393-9ffb-29efe50bc72c", "value": "8333F1354BACD9F629B6D0BFC8C6F604FBB19495C4D786224AF8B1C8B6D02855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260104, "uuid": "42792c04-ef95-4342-a81d-8b2283e445ee", "value": "1536:NjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX34V:JB9wzbqtWb08UscYJhnpjyq9qBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260104, "uuid": "f8d6cfbb-0dbc-4d1b-831e-7cb28f3e4d91", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260104, "uuid": "a4b7d87a-97ab-4709-a4bf-301e86bd4f9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260104, "uuid": "72ffcac6-7938-487d-924f-658e289b2e16", "value": "diagram-1572316101.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a790eeb0-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263214, "uuid": "de3ede79-db1b-4d18-8990-080b0d4d3daf", "comment": "Malware payload", "value": "d7559c88ce8ec1b7e99b4b9ba6dd5d8b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263214, "uuid": "60a20133-c0db-4beb-962f-54e9d3dac4db", "comment": "Malware payload", "value": "28c5dd49864e18c638d095c77930472017a1614bf43e29e02844bd1f19fc8eda", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263214, "uuid": "9bf9b18f-89e4-4bdc-9043-c87397d1403a", "comment": "Malware payload", "value": "12a14c214e708b3aaa5656ffbd989f44a2a2ccbf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263214, "uuid": "63fb3157-1bec-4410-ae5d-bf2eb96b84df", "comment": "Malware payload", "value": "5597e94227b3bcb2b4050ffc3708fbe67fc5c7f474e0aa9d0f2114c165ef156db06ab34b092e8d1bbf1cf05959c1ed32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263214, "uuid": "e25cf76f-8b50-4c3f-b161-221cf0bd39ca", "value": "1533F1E0D801E08AA755F858DCAB9D038F39DD5A073DB852027EC0C79E72AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263214, "uuid": "2ee1f943-c58b-42a1-bb3e-6bd2d57d9e5a", "value": "1536:uXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOBH:GXma7774mfCyWMB/4GpCOBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263214, "uuid": "8f0e1202-a874-44ed-acfb-0b717a06e9c3", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263214, "uuid": "af6e8ff1-9d29-41db-873d-b83de3e4bfff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263214, "uuid": "ef73472d-4d40-41f8-a9de-80976b90a848", "value": "statistic-1738243406.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce2bd4f-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257291, "uuid": "a57465fc-b2bf-4c65-944f-3503b884bfdb", "comment": "Malware payload", "value": "e5346e5b1189e8790ed74062978cba84", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257291, "uuid": "02a007d8-6ff6-44c3-b56a-fbbfd6081ebc", "comment": "Malware payload", "value": "294d3379c0ac7a4b5890352583ca631d58a5755f06e3b7fefec0ac3aab886111", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257291, "uuid": "3773e97e-f7e8-4f8d-9699-e15af70a75a6", "comment": "Malware payload", "value": "e9af85012b912b220f7e1792c0f1deb8312d7b41", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257291, "uuid": "96f3a7e7-c174-4c44-aed8-ef3554609fcf", "comment": "Malware payload", "value": "c1bba4f2b7defd34a8216d965f7d8bf357548634245dad5cbc6d514e5751d9155764db17c214ff3557bdb46a7a758281", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257291, "uuid": "c2fa0821-3784-4a56-9b40-50a991c5f6b0", "value": "78330186D264214DCE4FD29630F1FACCF5DE7E430EAAA4D0A67E2B0581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257291, "uuid": "c4514b8f-a8a5-4d9a-8189-12c05307f97c", "value": "1536:l2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3Y:Afqhp+g5ru2kmUEt88IxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257291, "uuid": "de391e1c-eb0e-47b1-a98f-477eb1db5cb2", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257291, "uuid": "34f50d9d-613b-421c-bab4-693ad45bca66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257291, "uuid": "50572b13-fb30-49e1-af26-d3cc2e732ada", "value": "catalog-1471635119.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01736687-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264654, "uuid": "ec9e9dba-6e56-4f5d-abfb-82dfe77d38e8", "comment": "Malware payload", "value": "3fb3a80f8c1097f97a5610bea72c0c56", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264654, "uuid": "c53b9dd6-23a1-4e52-9589-34b109b6e2ba", "comment": "Malware payload", "value": "297188954a784ea72e7252f7e835febb09f325a29015d9523be2ab26e0b3041a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264654, "uuid": "24fa123e-86e1-4830-88e5-1abf50670707", "comment": "Malware payload", "value": "74de3354021247ef54d639d75dd697d4cbcb9132", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264654, "uuid": "afe9cdf2-4ae6-4a98-8bb8-0c0d5626cac9", "comment": "Malware payload", "value": "9ecde1cc112071b6f853377aca10cf3743bc48bdd9b93064ea4fc962e3462d892bdc7cf6fd259db8f28664a4e43758f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264654, "uuid": "e723f50e-3319-4055-aa0e-ef58b32155bf", "value": "DC33F2E4A507E047A349B85CDC6A5D038F3DED1E427E7892022BC1D74E62AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264654, "uuid": "287f8292-9dd5-479f-b85e-d4dbca9e51e1", "value": "1536:nXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ0J:XXma7774mfCyWMB/4GpWvZ0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264654, "uuid": "99be116f-a924-41d2-8075-dcb669f647ad", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264654, "uuid": "21a33063-2ab5-4b00-ba24-19dd91cc81e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264654, "uuid": "9bcffd33-1de5-4a7c-81c6-8c697c9a22b0", "value": "statistic-876616672.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e318ee-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261732, "uuid": "aff0d8ba-6a03-469f-b18b-8583dd29194b", "comment": "Malware payload", "value": "0743c9d02aae95bb1bb2cb75059178ae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261732, "uuid": "7747f310-49a1-4c7d-b2a9-ccfcf640b483", "comment": "Malware payload", "value": "298205fba03932d8f81421e5a1905238d5a5c3d16fb65b9a84d8aa05ced4c55a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261732, "uuid": "5511760d-a0b8-4bdd-8ded-e5a75c07a508", "comment": "Malware payload", "value": "6f3edfbd9c7d6e26bd727bb9ad58aad70a22e78f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261732, "uuid": "642ee51d-b479-4f56-82b8-fad1d2a80000", "comment": "Malware payload", "value": "d5419425312beb9f08c6a542075a68e2160404c54280ae98c0c6a437c29687aaf41dddd557e35f3aa3c53b07f7b58f24", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261732, "uuid": "af0c7089-f806-4eca-8331-4da3df2bfd9b", "value": "2D33F17197ACD9F628B2E4BFC8C6F904FFB2D499C4D78A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261732, "uuid": "d694ed84-bee6-4d26-93b6-8936bb833974", "value": "1536:4jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXAV:4B9wzbqtWb08UscYJhnpjyq9qBAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261732, "uuid": "a37f2b69-4db4-4de3-9d06-07e7bb4d0ebd", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261732, "uuid": "7726b5df-ebf8-4606-9374-d03b012ecfd6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261732, "uuid": "c3c58e40-3d20-4f0d-8e83-4b0847e42c3d", "value": "diagram-761466462.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6501c8d0-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257090, "uuid": "b21c5e4b-0e82-4ecd-8152-5e443713e51e", "comment": "Malware payload", "value": "7894f0ade3403edf8cc7e7650c569d52", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257090, "uuid": "c256bb18-6547-4298-908a-4f9c62a2a01f", "comment": "Malware payload", "value": "298a2f1519c1112b8575908f4432fd2b7a70a0de0eb2c269c3000e0aeaacc50e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257090, "uuid": "d018161d-7918-4390-a617-6838bc873888", "comment": "Malware payload", "value": "cc6e4dc9ad913ab36f7a6dfd6a4b0b42827af7ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257090, "uuid": "a1a08b4b-3fb4-470b-aa00-0b814ee0e9e4", "comment": "Malware payload", "value": "f0169ab4c2facfd99588b2293a8946c1d2b04e5eed8b7a90ee47788568137dfb18f3731de9ef5639eba82b64010b66f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257090, "uuid": "d5875e18-8229-464e-b784-bc17ca6fac89", "value": "1533F1469218118CCE4BE2EB30F6FAD8E6DD6A430EA9B0D09B7D2745C1A30F5492F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257090, "uuid": "26bec5ee-a648-462f-8ffc-1cc975193053", "value": "1536:j2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuZSC:ifqhp+g5ru2kmUEt88AiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257090, "uuid": "5bc1c036-1878-426e-86eb-e01c56eae321", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257090, "uuid": "2f060bf6-12e6-47d5-8fb8-73484819dde5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257090, "uuid": "652a18d4-2bf5-4ccd-9ab5-0f00f12be379", "value": "catalog-1353974852.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355c2f28-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261734, "uuid": "dae0008a-d565-4710-9e74-b07c8b29da6d", "comment": "Malware payload", "value": "8e5ac4805f827ee08cab4b7d4f4d666c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261734, "uuid": "4f32ca71-0289-415b-a996-7c6b7585bc58", "comment": "Malware payload", "value": "29a6cd3b4f767e327c25abe3ebd544d7163746cca63cde9e9299b37de60235b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261734, "uuid": "d69ea3c3-4464-44cb-a87f-a320fb4787a7", "comment": "Malware payload", "value": "e50adef15b91c31fd9659f7353cb254d24b79d81", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261734, "uuid": "eabbb33c-6590-4055-894e-9764f776b884", "comment": "Malware payload", "value": "f9093e38a31cef27b6cb3efc26a386e12e75c0f3a996e9a1c1f2d2e803d469f9b1d860783b1e899e566b5f128647ce80", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261734, "uuid": "0a212f72-0f7c-4ada-8ea5-1cd0a89b34dc", "value": "B333F2714BACD9F628B2E0AFC88BF904FFB1C495C4D7866649F871C8B6942555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261734, "uuid": "d9b44439-d816-42ae-aef5-da931ea22614", "value": "1536:pjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX0C:tB9wzbqtWb08UscYJhnpjyq9qBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261734, "uuid": "2bf4478a-08a1-4cb4-bb61-3101c2e4495d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261734, "uuid": "7536ceb5-19db-481f-908d-dd1f2ac81e01", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261734, "uuid": "4e81281e-9247-4324-82d9-7cc509c4f73c", "value": "diagram-761725387.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f144e28-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259200, "uuid": "69d2b3d5-fef3-442c-8983-ddcf659708e2", "comment": "Malware payload", "value": "a57333da7bc1d0b05d10e149cc7629f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259200, "uuid": "c27e2098-e5f0-43f5-8c15-1881bcec8a98", "comment": "Malware payload", "value": "29b69a480bf4672e6276e295590699ab2e9cb0fbb164bb1d0484dc68081d1094", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259200, "uuid": "6d1bf84a-06bc-4845-82a3-9af3786952f7", "comment": "Malware payload", "value": "ebf0a1820f9b7bdcaa04d912fff4438f71773c31", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259200, "uuid": "356254c6-81ec-43b8-802b-a4fa0b7cf80b", "comment": "Malware payload", "value": "886f78bde18e24d66288839e3dcd19c0753feecb7778bc7bb91c612feac2335806baea0dce459e693ebf65bd10a8d4cf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259200, "uuid": "0594dfa2-00ed-4515-afce-0c0d92b02206", "value": "52330291D694028DCE4BD2EF20F6A9D8E55EBE53099AA8D0DB7E0B0191534F1482F68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259200, "uuid": "5884b6d3-7b32-468e-b92d-9cfefbf4e5a2", "value": "1536:52fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIB7bK:kfqhp+g5ru2kmUEt88B7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259200, "uuid": "dcb2c180-9077-4cbd-b3dd-ad115a9e100d", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259200, "uuid": "41ece29a-7552-43e7-8c88-0a2bba545222", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259200, "uuid": "d7448e76-2df7-4dd2-9e8b-e6a11a366531", "value": "catalog-857616920.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1684b9-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260086, "uuid": "c53ae57c-a8a3-4c57-a2d0-68d3d94bbb4e", "comment": "Malware payload", "value": "d5a7eee8ef44083d77fd1da85ea8ea4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260086, "uuid": "ef19b92f-c7b5-4e5d-989c-3b6a664dcaa6", "comment": "Malware payload", "value": "29b7ec858ebbddc6e26633ad0f3c7d15b8f9b902dff8b23b72aafdc43b74ec95", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260086, "uuid": "ca55ceac-5684-41f9-9677-1b36a0ec7075", "comment": "Malware payload", "value": "7996eedc7994fcb588073af9f36d99da9a44ded6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260086, "uuid": "e128e3b6-6838-48f3-a718-8c7c135acfb3", "comment": "Malware payload", "value": "737a84be154ce9cc3e9945655c82dc9687ba8b9d33a72d82ff32f9d114dc7dda9e60be0b8f1332b2d80f36c3e34ae1f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260086, "uuid": "12770b46-fca0-4a59-9d4c-efbce3e2c44f", "value": "4933F13547ECDAF629B5E0AFC8C6F604FBB19455C4D3872249F8B1C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260086, "uuid": "ef6a37cb-d70c-49ab-9fdf-2d3c01c42afb", "value": "1536:ajfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXCE:KB9wzbqtWb08UscYJhnpjyq9qB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260086, "uuid": "251d71b2-53ee-4f0d-8927-517fca8a1e48", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260086, "uuid": "2e333a65-81a4-4fe3-ba0b-5d43ad21df2e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260086, "uuid": "aa131d05-bbc2-42d8-bcb8-a5ec504730ed", "value": "diagram-1563064031.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d639db-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263537, "uuid": "18adf2cd-1523-4588-a6ce-b6f64261f520", "comment": "Malware payload", "value": "18590fab4545d5d07b5911a6feb63c10", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263537, "uuid": "cabb223b-81c1-4fe1-a677-27a98f1a7aad", "comment": "Malware payload", "value": "29fd1f3f87bc1224704e198351297b51c35ef72ef191eb0906910409752b6f67", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263537, "uuid": "203e9f40-b2c4-4d26-9360-6a07bda6612e", "comment": "Malware payload", "value": "001cc4bbea1a5292cc7b7e28a4c1fc8784fd9af4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263537, "uuid": "020b1386-1e37-49f5-af5a-3a228cdd2038", "comment": "Malware payload", "value": "8beaaf05c7c06c460aaf9968ecab3a22ac522029cad14b3c90ee1a919cf64901d0d7437fa1beb8b9feae1a228383bebd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263537, "uuid": "226a2c82-4cf2-42dd-ad70-3247c242d2cf", "value": "DA33F2D09902F087D745BC49ECBA9D124F79E98E47BD74D3027AC0834E72AB5A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263537, "uuid": "ba0d6e76-4bec-42d2-8460-f1daa600d740", "value": "1536:/XXtg3K7774iXfEz5lnm/hQMOEYus1GpDk98:/Xma7774mfCyWMB/4GpDkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263537, "uuid": "e54b22fd-1e44-4173-b5f3-f34ef3d3abb3", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263537, "uuid": "7df68999-488b-4c60-bfad-203acb63667e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263537, "uuid": "1dfc6d4e-b5f1-4456-bb75-ffc3592085d3", "value": "statistic-1975439491.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934ce6da-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258885, "uuid": "9edd2f09-654b-4a38-ad15-31c250e8ac57", "comment": "Malware payload", "value": "1a548f701d7ec46345cdc5f5496a5596", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258885, "uuid": "17abf1ef-2f62-4ca7-937f-6af1367d8f3b", "comment": "Malware payload", "value": "2a0021a7ae3778e836511f7ddb92fc227882c0ac41f3e9e3a2b29fb5d8458433", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258885, "uuid": "da00ef5c-5f13-4538-a4ff-e805949e0415", "comment": "Malware payload", "value": "eb55abeaff8d8063ae984da655cda062559f5b5d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258885, "uuid": "346cc9b9-0b55-4d07-ac17-daf4dd5dab4e", "comment": "Malware payload", "value": "6eb5841bc4f578c2c55b5169f13d2d49b4238d9b955adbb992852d4f5a7aa20a919a3bd453ced0bdc3cb735b5fec279c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258885, "uuid": "d1e7958f-0251-42ae-bc79-46f84e2a0928", "value": "A7330142D144158DCE0FE2DB30F2BEDCE59EBE43089A74D09AAD2B86C1934F5592F18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258885, "uuid": "e445d749-6889-4431-84b1-878aa8a4f53f", "value": "1536:lr2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIgqf6X3:gfqhp+g5ru2kmUEt88gCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258885, "uuid": "f5d35afb-31d7-4316-893f-9ecb2978867d", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258885, "uuid": "735157ea-18e7-42bd-954e-c3612b363a3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258885, "uuid": "dba6eb81-7586-41a7-9bf4-71d19e85592e", "value": "catalog-643560970.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bc49ca-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263552, "uuid": "af85dd60-6cb6-4165-9a8d-db38570947aa", "comment": "Malware payload", "value": "12269d26420cc3e3843dd8a1c3d99724", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263552, "uuid": "13889702-93ec-4358-bad5-fdf46a230a41", "comment": "Malware payload", "value": "2a08806225b0e832c9b07927a28cb66fe86656c149b0b213f6dd0d36906f6022", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263552, "uuid": "58c83b44-c6db-4f02-a88e-82eb2c1e8a79", "comment": "Malware payload", "value": "f8cd5f03269d7150eb9791d8057bf2f5b9a401b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263552, "uuid": "2dedac26-8d74-4022-8b7f-84280d57c88e", "comment": "Malware payload", "value": "d61426dc6a204fcd32a0a9c0b1e0ac832b6770057c90ec249448a13f6ee55883b799cbd4c982ac1ffee758de40339ce9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263552, "uuid": "19c04539-3103-4bec-bbdc-2f9736cf060e", "value": "1E33F2E4A507E087E349BC1CDC6A5D038F3DE91E433E7892022BC1D75E61AB6A645E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263552, "uuid": "727fe508-ed6e-4c16-b0be-acbd9606ccee", "value": "1536:jXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZVz:7Xma7774mfCyWMB/4GpWvZVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263552, "uuid": "dd40e4e1-e246-468c-9b83-68ddadead519", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263552, "uuid": "8aa5e8ee-8131-4fd0-996f-144ecdfc4860", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263552, "uuid": "5ed19164-234b-4fb4-b413-7ce67ae6526d", "value": "statistic-1991782289.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b2449a-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262676, "uuid": "d1029014-770a-47f5-b130-66fe1a99a879", "comment": "Malware payload", "value": "08d56ca440d142cee26974c36343a15c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262676, "uuid": "65ae1abb-6905-4263-9d4c-e77eacb4f83a", "comment": "Malware payload", "value": "2a5cfa98fd52e7d4b5ad9deb463031c0c17479526a0c69aad6bae460d8fcc0f1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262676, "uuid": "19ae9dda-86d2-4010-8140-69a408fd4c8f", "comment": "Malware payload", "value": "39c1feb3401186281611a063300da7ac7a331e87", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262676, "uuid": "e654030a-8752-4183-9668-d6f79f6e1331", "comment": "Malware payload", "value": "9187ba93c63527ebfe5ae971b49a103d851983e4bb5c2c3ecbedab6c7cb260a4450e5814d5563e8c9ded70595a8ce7f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262676, "uuid": "ef504a14-3e85-4ff0-85ff-3fe448d90674", "value": "0F33F2D0A905F0CBD749B84CCCAF9D078B3EDD1A473DBC92013AC1871E61AB96745D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262676, "uuid": "39b2f207-e20d-41d9-9359-63aebad5041b", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1GplItHrR:bXma7774mfCyWMB/4GplEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262676, "uuid": "04637a43-2785-43b6-9ee4-382d6a21876d", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262676, "uuid": "6dfbad3d-3fb0-4c69-b4d4-c60ef5619546", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262676, "uuid": "6534d3fd-5150-4492-b199-9d9cee83f4aa", "value": "statistic-1331472737.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2a31ab-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257528, "uuid": "c4da42b3-7dea-426f-a54b-650388227d80", "comment": "Malware payload", "value": "6ef01b713c358d75d9c5136a8ed0266e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257528, "uuid": "49f5dad0-273f-4701-b27a-d36b94763748", "comment": "Malware payload", "value": "2a62ef7f342cf9fa868abc89fd47fcd74169932f6fce824dff2b158ba7e103c5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257528, "uuid": "df03af5f-026e-469d-8e3b-c648225ffd2e", "comment": "Malware payload", "value": "4350e0dfddb054b9e0a694c85be92054804b7701", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257528, "uuid": "3ef39e41-1e5d-4e33-8bb9-ff29b46e4551", "comment": "Malware payload", "value": "88b3a1e5039965b86baf3e543ebc54293f52c681b32527f5eaa505f782611ab650c1d91b008ac0e577d6e140048370e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257528, "uuid": "4db91d5a-83c3-421a-97c1-1af3e2f5cf5b", "value": "95330186D264214DCE4FD2D730F1FACCE5DE7A430EAAB4D0A63D2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257528, "uuid": "7c90fd9b-e1e4-4b60-baef-d5aac48ce122", "value": "1536:I2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ3f:5fqhp+g5ru2kmUEt88Ixf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257528, "uuid": "9bf71c7f-b515-4865-880b-298a1f50196a", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257528, "uuid": "fa9145aa-d2fb-44e9-a1e6-efd3f845eddb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257528, "uuid": "01e02417-a6b0-4d2d-9a55-f540397838b9", "value": "catalog-1664380794.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05be677-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216897, "uuid": "423ff50f-69ea-4f47-b74a-6b3233347f7c", "comment": "Malware payload (Dridex)", "value": "c35f84d110253e93338f46eb7ce6e2c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216897, "uuid": "363bb220-600f-450a-a052-b67c4df093d7", "comment": "Malware payload (Dridex)", "value": "2a66af4b509d5018c6dcbc6ee48037ea82584a1b7fe5c455f4100f0df5111a4f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216897, "uuid": "79bfa307-22b9-4e7a-bc42-4972b36db175", "comment": "Malware payload (Dridex)", "value": "3db698431a9b3d45c1ec5561424e6c4bbe477a5a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216897, "uuid": "54f946a2-219b-480d-83ee-a654ba64f0c9", "comment": "Malware payload (Dridex)", "value": "5ea4605e95da01f9cf2f044ff77f844826c4d8b76df0f9d21701536124adc4a065baa5e316f51e3f149d4e6dde4e52d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216897, "uuid": "dede62a0-4d83-451c-affb-937260b7ebbd", "value": "CEF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216897, "uuid": "6c063068-e86f-4b3c-bf2b-a6311fd2ce16", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216897, "uuid": "cdbd2729-1fd1-43b4-bf8a-010e69b58431", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216897, "uuid": "ed76f078-d10c-43fe-81d5-dadf6027654e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216897, "uuid": "67d19cea-6127-4b66-9abc-52f7458188fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216897, "uuid": "634a46ab-aee3-4416-a9d1-309a83120a66", "value": "c35f84d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d9a118-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263042, "uuid": "8fc4cc5e-4938-48a2-be84-b15b8e6cd175", "comment": "Malware payload", "value": "ebad926f19f71e8b49ba12cdc356e7a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263042, "uuid": "a55e7edf-04bd-434f-95b0-fbe10cb56191", "comment": "Malware payload", "value": "2a6c18418e3a35301f57cb83eb13960c276888af6a8a8fdbb43001831837e4e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263042, "uuid": "3919fcc4-a59e-4a4a-b1b1-88d02452e68b", "comment": "Malware payload", "value": "12f6c273374bf8718e765e716249de824baa0201", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263042, "uuid": "38cd0904-1bb3-4dcb-b7dd-5b6464fdcfcc", "comment": "Malware payload", "value": "8a4b809cad71965a34cd5e0c51bdccf2f35ecc0e8433493355def8133c83fbace11160959ed6a653aead5c95bba08a22", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263042, "uuid": "e7c17354-a79d-4d4b-b2bf-eca539461098", "value": "C33302E4E902F08BE744B84DDCBB9D435F3DED5E423C6892413AC0874D62AF5A715A2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263042, "uuid": "493756f1-022a-4537-b166-fed1b9fac8b7", "value": "1536:0XXtg3K7774iXfEz5lnm/hQMOEYus1GpuVZ8:AXma7774mfCyWMB/4Gpuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263042, "uuid": "89c15ac3-60b0-479b-bc73-36166294e437", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263042, "uuid": "7ae5d223-cf0f-4309-85bf-bf53ec85dab6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263042, "uuid": "373ba420-43f2-4e72-92fc-aaacd3c61122", "value": "statistic-1576980284.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6244bba2-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264387, "uuid": "40d1acaf-bcc0-4384-b81d-1343fc33968f", "comment": "Malware payload", "value": "7cf89b1dd3545cebece86b751ccd2f02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264387, "uuid": "8147c23f-5c10-4766-a1f8-4769562785f3", "comment": "Malware payload", "value": "2a73fb5ce6d20027b4884a93f11b5eae5dec8200b8e13f615a6501db84392611", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264387, "uuid": "f9b2708a-2bbe-4f51-b7e0-1d25f5449e29", "comment": "Malware payload", "value": "dbfdb10c1b97ea0ed6bc82ff685b7c723640734d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264387, "uuid": "ac9bf2e1-d773-40e3-b0e4-781c2635fbad", "comment": "Malware payload", "value": "fcf12e6784ccf4659b13577e57259666e60b260af0e0c5598352388c6779d310b37f8a38613b93c85ec4bf0dbc9331ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264387, "uuid": "c53866d6-89f1-47aa-b79f-e46ac31aea28", "value": "EB33F1E0A502F04B830DBC5CEC9FDE064F3DDA0A433D7493157AC0875EA2AB2B649D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264387, "uuid": "07a7d7e3-12f0-4a38-9db5-c104ad485e52", "value": "1536:1XXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIaQa:RXma7774mfCyWMB/4GpV5dax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264387, "uuid": "20d3cd0f-1848-4e46-b646-c6195521ae53", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264387, "uuid": "356717ed-d61a-4af3-be81-d9163c358be2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264387, "uuid": "4f355d6b-fc62-484c-9b39-aceaebe2baa9", "value": "statistic-696241503.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff7dfbf-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260249, "uuid": "82821999-bc70-4102-8bee-e7af1e1e6d43", "comment": "Malware payload", "value": "df7bb3b5157358bed4122995163436b8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260249, "uuid": "f3d91f91-e5ff-4167-a9e6-e7d560d02266", "comment": "Malware payload", "value": "2a77f2995319bc7cfcbce8e1a4a27158f1af0ab54887a280e9c836722f6d1acd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260249, "uuid": "42e58f5e-0da9-4a2f-8b38-72165d9fbc30", "comment": "Malware payload", "value": "6a7cfa79c8dfb2f27cc1d71ac0f7120438404ab8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260249, "uuid": "c77c391d-8100-41e1-be7f-083b0125de4c", "comment": "Malware payload", "value": "c1c2c9dad6e36e42efcefd8dd64a37f0225611151dec813a29297d2b2c80f5fdf7df562e988232c8d3cbbd1663183602", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260249, "uuid": "ab4ab21b-1b99-4995-81ee-d03fd2f4310d", "value": "CE33F17197ACDAF628B2E4BFC8C6F904FFB1D499C4D7862246F871C9B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260249, "uuid": "b2a5a223-c6b1-4c78-b149-114f02a3bf63", "value": "1536:SjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXrl:iB9wzbqtWb08UscYJhnpjyq9qBrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260249, "uuid": "013bb7f9-97b5-4edb-866e-e0729f53a5f2", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260249, "uuid": "3ff0c932-4ae6-44bf-b816-b50426b208bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260249, "uuid": "767705bd-000d-490d-a59b-8f239e9c2e9d", "value": "diagram-1663308610.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a62ede5-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256669, "uuid": "f138dce7-299a-44e3-876c-4876c0d37af9", "comment": "Malware payload", "value": "5067cbb5826f1399d5ec8734c05ac731", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256669, "uuid": "ac29cd99-c0c7-4e70-a05c-1560725daec7", "comment": "Malware payload", "value": "2a78e7f22d12f806e47e3b34be993995a4fcf3e97f402d75b790135bf6b39cbc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256669, "uuid": "efca8d86-7b0e-412f-a38e-1987e8a9c5f5", "comment": "Malware payload", "value": "40a087d75e1033eefa76757660fbe6f0915de7fa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256669, "uuid": "31682ea4-72a0-42c0-b89a-cc6719145e97", "comment": "Malware payload", "value": "91d8db6277d1f6caa8a81f1c6b6cc33d48c17f415231f154c410e20e85840bbdd6358e009c38bccd5b2805276b5bb666", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256669, "uuid": "310fd0f3-161a-4889-b9b8-2e9d6bbd4ec0", "value": "2233F1469218118CCE4BE1EB30F7FAD8E6DD6A430EA9B4D09B7D2745C1A31F1482F65B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256669, "uuid": "895b8f03-203b-474b-8e39-00e26ed37734", "value": "1536:d2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAutSv:Yfqhp+g5ru2kmUEt88AKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256669, "uuid": "fe59e336-3ec4-4748-92f6-a980696f999f", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256669, "uuid": "219a5b75-d266-4a99-8635-4056505d8ce1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256669, "uuid": "321d506c-ae61-4400-97cb-f6b762e4640c", "value": "catalog-1015809923.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80d314c-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263242, "uuid": "f2748f78-d876-499e-b4de-bfc463bc2edb", "comment": "Malware payload", "value": "eac15ee22a450142554ac92f06d6f7fa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263242, "uuid": "2be2f0b3-567f-4cd7-883c-be3873ee1ab7", "comment": "Malware payload", "value": "2a812f6b39c9b3fe8552f5e8658651f52532b488b6e7b627da70d5fcdb1d1c74", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263242, "uuid": "b26e5e50-24bc-4071-bc79-58a9d330b010", "comment": "Malware payload", "value": "15a46430a52474f44e06d3a24af78a6fbd354046", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263242, "uuid": "930b22fa-75c2-4085-ac74-54bdca1e2c10", "comment": "Malware payload", "value": "14ca921d5d44d9f1089939206792b20a5c9d17ee880ef3bbba4d4579139c06559c9f34070182f3bc6781407c841575dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263242, "uuid": "cad77e67-563b-40cf-8642-99d10dd80a4d", "value": "AA33F2E4A507E0479349B85CDC6A5D038F3DE91E433E78D2022BC1975E61AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263242, "uuid": "61658844-a1dd-47b1-bcf1-f0dac060dd03", "value": "1536:mXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZiZ:uXma7774mfCyWMB/4GpWvZiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263242, "uuid": "1863151e-3644-455d-81c2-1036b34581e3", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263242, "uuid": "e2ad601f-5240-484a-83cc-26dfaa5a0a8f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263242, "uuid": "575012f9-377e-4c94-9032-24e708611638", "value": "statistic-1767642933.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdb5f8c-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264404, "uuid": "73e3890e-62a7-46ed-bb05-52a785ba679c", "comment": "Malware payload", "value": "02ab07c5b6471597f055f71ca096dff8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264404, "uuid": "9b5fbd4a-cd0d-49aa-90ae-b2e72d99ddf6", "comment": "Malware payload", "value": "2aad0e5594efffd4d00b96663b99bb58ee9d1656e64af53f1949ac3a8b5310a8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264404, "uuid": "86702d68-605d-446a-b2ca-72f0ee7c1a25", "comment": "Malware payload", "value": "8ff4a5e1eb283770d62e6b1afd47d6c6a98de59c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264404, "uuid": "5c3435ad-95a2-4cdb-a6e6-b03b17d602d7", "comment": "Malware payload", "value": "bb3870627f96e6b5b7548f4eee2770f476337664aad19d4b83a820fc1d56b09fb3a4f081f07df3a045e0a9f97e103aca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264404, "uuid": "549de2a3-d62a-4158-92e3-0d378af059d8", "value": "A633F2A09402E047A354FC58DCABAD038F7DEA5E477D7852027EC0879E72E75B24AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264404, "uuid": "637f849f-2dcf-496c-91d4-a45a9d0a7444", "value": "1536:BXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOb5r:FXma7774mfCyWMB/4GpCOb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264404, "uuid": "fdd947ad-539f-4cd7-ada8-fc2f8470b322", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264404, "uuid": "fe727297-77c2-4c06-b393-8ee291b0685a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264404, "uuid": "65a72079-1edb-4195-afa8-9bf0dff65aec", "value": "statistic-705886833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58e4a2a-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259855, "uuid": "ffb584f2-37a5-4b88-a8cf-2ce5437d025b", "comment": "Malware payload", "value": "0decd0321b5ed5fa8f7490ea1b886902", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259855, "uuid": "db47f25b-27d2-488b-93c3-52aeef0a9cd7", "comment": "Malware payload", "value": "2ab7310c534e58c1dbf491523bf62ba77dae6dc4f32ba30ed9afe6752fa97b13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259855, "uuid": "bcf880bf-ad88-4c9e-a7b9-c07f33046a32", "comment": "Malware payload", "value": "e406f468f5d24b20640d74731b75fc3e5e4a6bf2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259855, "uuid": "3840e1e7-2ea4-401f-865b-80b7dddbfc0f", "comment": "Malware payload", "value": "991604e0394a1b2b4d5a31424a26b6ea8263c1710b77575067701c996259903c2e3eb909e40f034143609ff1fc9f91bc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259855, "uuid": "8676ede6-a317-457e-970b-548d9e4a56bc", "value": "6C33F1711BACDAE66DB1D47FC086FA05FFF1C4A5C5AA861285F8B0C8B6D12519E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259855, "uuid": "67be07b5-bf9f-4175-a9bf-de7cf5123a45", "value": "1536:RjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67Z0Q:VB9wzbqtWb08UscYJhnpjyq9qawD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259855, "uuid": "ccd44862-af75-48f9-ac63-9f45a99d1da3", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259855, "uuid": "5e179067-a22f-4cdb-aa29-b7393715c5fb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259855, "uuid": "d5435151-2a28-4413-94ec-95ba9dcd502f", "value": "diagram-1406372884.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c87642-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260925, "uuid": "1bd5d278-23a5-4cd8-84a5-94ac1d932e71", "comment": "Malware payload", "value": "9d7685e117516352dbd48a49ad70b41f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260925, "uuid": "96ab4a1b-4ea1-45c4-bab5-7917f500c40f", "comment": "Malware payload", "value": "2adccb19a747943ea993a15252b4cef71f62cb11d6062723c784e0f5ed7a4d8b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260925, "uuid": "c60bb578-d319-4fa9-b87e-b208368ccb47", "comment": "Malware payload", "value": "0dd926d32ba2522a6a92a3d2ccead3288baa5220", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260925, "uuid": "c807b47f-75db-4362-8111-19c43ba34d01", "comment": "Malware payload", "value": "c64ca32cf7321ac63220041d287033cdee12e07bbc046d0a5e87c0b5e3ce64147d50e895ecbb7589505d59dfa1f829fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260925, "uuid": "48193a57-3776-49fa-9c1c-386a4134dbaf", "value": "EE33F1754BDCCAA76C72D0BFC4C7F845BFB29421C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260925, "uuid": "92526ac3-eacb-4ff9-aa87-9eae42d2c781", "value": "1536:BjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wM:lB9wzbqtWb08UscYJhnpjyq9qEK0wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260925, "uuid": "ed9d37a2-6b27-4b49-b48f-7f981b1dbfda", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260925, "uuid": "9a367041-2cc4-409a-a1bb-40bbab550902", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260925, "uuid": "d6682afb-5d12-4044-bc2a-1aa0542ae317", "value": "diagram-217816651.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441e3c49-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258752, "uuid": "9cb67fd2-6d2a-4279-9610-ffeabd06428a", "comment": "Malware payload", "value": "5042bb53ca73a3c67d66785a79ba22e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258752, "uuid": "386f5b0c-8680-4675-9d48-867d1d3b825b", "comment": "Malware payload", "value": "2af4befa7560afd42a0a7d8228817277cebba0f5b8904c7daaebc4a36eedb338", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258752, "uuid": "c7471bc1-697a-4d5b-b278-095cc9bcd5f9", "comment": "Malware payload", "value": "565e1b1659b129ec74e8807abab2032a914929fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258752, "uuid": "6e1958c9-7e5a-4d9e-b083-8620deb52bcd", "comment": "Malware payload", "value": "eafbd899dff5043725ba90965a1c1d659da3574c67e7b041412433575a6b979185d7169f6ab980d1b104716e025354fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258752, "uuid": "a801bc6b-ea85-401f-ab30-ba05a87bbca4", "value": "C833F1A2E544018DCF4FD2EB20F6F9DCE59D7E530A6864D0966E2B4581930F1183E69E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258752, "uuid": "0a5ebf3c-2b63-46fe-94d5-e73320bb7f13", "value": "1536:c2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIqdXnYk:tfqhp+g5ru2kmUEt88qdX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258752, "uuid": "948cadae-eec3-490d-a63d-b61564042730", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258752, "uuid": "bf912db1-4040-4552-81cf-b67bb7e14936", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258752, "uuid": "f64faf28-2c5f-4260-bde0-dc14f012b467", "value": "catalog-533906710.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3d2037-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262529, "uuid": "ae9ce203-0cd6-470e-8948-4019b80a0939", "comment": "Malware payload", "value": "de834f498c3ad32cdeec417b9c028320", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262529, "uuid": "6448bdfc-5b99-4189-bf9e-709b4eca6f91", "comment": "Malware payload", "value": "2afbbdc9e36ff63b4eea3064784479a039886dcc6a749f3b420f182063f7c73b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262529, "uuid": "8ee3aaca-c4bc-4bdc-b412-c6742f8da910", "comment": "Malware payload", "value": "6a6ae40c173bb5f3c0def4a24b645763bb8dec6a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262529, "uuid": "e6f4a1d4-a75a-4a61-8764-b6a71e065b91", "comment": "Malware payload", "value": "c7ae317d10da19c744012f398ba8fe36143b021cf459042a43711e7e8f72a3872a03440b8432ddf7c8b99bb49361c0f1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262529, "uuid": "db2abe8a-4a2f-44cf-be85-3d6e9193f166", "value": "F43301A0A902D087A719B81DDC7A6D038F3DE90E473D6C53113ED0874E629FD7649E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262529, "uuid": "084f3572-0151-4674-b471-a1fb02655041", "value": "1536:nXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07q6xX:XXma7774mfCyWMB/4Gp071R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262529, "uuid": "76572935-9dc7-4a40-95ba-3729bcaa6351", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262529, "uuid": "06692895-2391-4985-ac84-91037563fd5f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262529, "uuid": "4b29e86f-df25-4819-9e2f-4155aef698a4", "value": "statistic-1230170478.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fab742-b6ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621213278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213278, "uuid": "3d4c71c0-3dbe-4e2d-bc07-02d395667f69", "comment": "Malware payload (Dridex)", "value": "98b45d065b37f453ba1faa4e7b431137", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213278, "uuid": "89c832e6-2ae5-4e4a-b6f1-f723f206d11e", "comment": "Malware payload (Dridex)", "value": "2b097635ac8736170b93027830a214cf615235e13d73bea235dcd6b2ef0aa2be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213278, "uuid": "bc95f1a0-743c-4de5-820e-71f41657f6dd", "comment": "Malware payload (Dridex)", "value": "78caf095b813e1b79fddf5e2afeb040d23f6f7c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213278, "uuid": "b164074e-aaf9-480d-b804-885edab89de3", "comment": "Malware payload (Dridex)", "value": "7804cdaaccde9e02aa9bfb918b22356ccceb6d140a57a45a5e1c19cee1baccc87c0bdca63e8bd8ce74b136ce64355ee8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213278, "uuid": "6cd24459-9d80-41d2-8795-a5e84ca27454", "value": "6EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213278, "uuid": "db7834fc-4b7d-46f8-9bdf-90c9fd287d2d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213278, "uuid": "859b96b2-23cf-4d95-845d-bf5d4b26d90a", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621213278, "uuid": "037f9489-03a5-4290-8fa2-f20701979db4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621213278, "uuid": "c84a4cd9-a259-4a87-bea7-836891c6a58f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213278, "uuid": "792db368-4fa9-421e-9562-17f208182316", "value": "98b45d06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4840687b-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263484, "uuid": "c0e3cd17-439c-4940-9ac1-d460792ef5c6", "comment": "Malware payload", "value": "af90f41615d068a9c471beaa1aaa1afe", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263484, "uuid": "9ba97ffb-c450-4539-bb5c-019a7e3b9b64", "comment": "Malware payload", "value": "2b29dfa785cf535fe89200d09b70f8b66f472c16c571a69c9fba1f1c0fd64fd1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263484, "uuid": "68a19783-87aa-4013-9da9-959325227cfa", "comment": "Malware payload", "value": "3e4e12dfbe4a4c0a9efc49929df519af4da23df1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263484, "uuid": "d3f2603c-1af4-46f8-a77e-0b8b04759c02", "comment": "Malware payload", "value": "1e032ad6dd0692167f2ae80722aea707f149a26ad7d16ebf228cb8806aaadab970eb703574318fbd6b02022d91eae247", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263484, "uuid": "48e25ff0-1142-442a-91a7-6ec1d98e8f7e", "value": "4B33F1D09906B08B9B45FC18ECAF5A038F39DD19427D7882117ED0C39EA1AB4A749E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263484, "uuid": "16ffe72f-2eaa-4140-aec2-3320e145c451", "value": "1536:KXXtg3K7774iXfEz5lnm/hQMOEYus1GpyumS:KXma7774mfCyWMB/4Gpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263484, "uuid": "c6cbc693-3cfc-4087-8f67-2004de8a4bfd", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263484, "uuid": "38ec32d0-d5a5-451f-ad27-ba38411d618c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263484, "uuid": "2ea60482-78d3-45a9-a3e5-038835c7e377", "value": "statistic-1941498820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8e42e0-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259896, "uuid": "3329be95-3da5-428b-b6e5-ee9b5a1339c3", "comment": "Malware payload", "value": "a569bce0f53e4d01d7a9845552419a51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259896, "uuid": "22a9c343-e37e-4316-9a03-ca05d621c8a2", "comment": "Malware payload", "value": "2b33333f87be27e00084603fbc6e2bd73fcdb85a1259057ad847e4ce4ad129a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259896, "uuid": "3ff764a8-668d-408e-a529-995637466d16", "comment": "Malware payload", "value": "3b4501b2ba18f70c7ff8030cc2ff3bb0f8d612bc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259896, "uuid": "398204b9-0693-45b9-8076-cdc9d85bbea9", "comment": "Malware payload", "value": "c4056b3bb703ef429e3155d9fa7a1a56a638bcbe2fd81ef70853d96d38d823481bc0e180371e9683434f4792aef9835c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259896, "uuid": "99fb4b5c-bb30-4a32-a16c-1080f5aeb1d9", "value": "9433F1714BECD9F628B2E4AFC88BF504FFB1D495C4D786264AF871C8B6942459E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259896, "uuid": "ca44195a-3f22-4c27-9dff-271177f78a18", "value": "1536:jjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXRv:XB9wzbqtWb08UscYJhnpjyq9qBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259896, "uuid": "e38999a9-faa3-4259-bc87-709b546b1f3a", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259896, "uuid": "d3712cf4-32ac-4a11-9173-b2028e11c0e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259896, "uuid": "5f3bac2b-4a74-43d2-b84d-63815670919b", "value": "diagram-1440749283.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1826f9cd-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264692, "uuid": "cbd6e1d1-31c7-41fd-aab1-a2dc508abcae", "comment": "Malware payload", "value": "9513594fb2d07c7bc03c787f05f408c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264692, "uuid": "ccd59531-77d2-4aaa-8477-0c458961fe07", "comment": "Malware payload", "value": "2b4447f60852e62cf8c2156a4143d1e74cb5c5134ad3ed39482de114bb4804bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264692, "uuid": "940ffeae-8c0c-4b7b-983f-14f2640f131e", "comment": "Malware payload", "value": "d30c6b8274426cc1c93934b08be9382241856e2e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264692, "uuid": "2802f6de-7b90-43d8-8e5f-3ae6f92072e1", "comment": "Malware payload", "value": "5ce905ba8a7cbe3c3595665a17f179544a8a3b9c2b894b43d5a3071da2c006444c794c186b3dcc1fe1e9f6a6b224d754", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264692, "uuid": "f8af36f3-053d-4eb4-944e-3ec2c57411e9", "value": "543302D0A502B08BA754B84CDCAE9D134F3DDD5E433DB892413AC0C74D62AB5A709E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264692, "uuid": "87d7ae69-5c33-4a81-9f19-f191af402aaa", "value": "1536:0XXtg3K7774iXfEz5lnm/hQMOEYus1GpuVu6:AXma7774mfCyWMB/4Gpug6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264692, "uuid": "0c68758d-b5ee-4a49-a710-0a251cab74f4", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264692, "uuid": "78f99284-c2bc-48d0-95a4-0b2a5c0891f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264692, "uuid": "8e8a01b4-cb11-4def-a2ac-962a0ca4a93e", "value": "statistic-896111714.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a610f01-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261233, "uuid": "defa162d-7946-433a-8b31-45afaba698ba", "comment": "Malware payload", "value": "3bdbf4904f41590094886fcf29baf9d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261233, "uuid": "b5eac70f-9a8d-486b-bf7c-9cc4e32506dd", "comment": "Malware payload", "value": "2b4d2f89dd4db9db70e9dcd06e662a71de0ff47feb2175e27f236cf57ead09da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261233, "uuid": "f61647c8-49ce-474c-843d-083f38daff7b", "comment": "Malware payload", "value": "3ed988c18ac7f310b99610cddef3367e48540d40", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261233, "uuid": "8474f81e-9fd1-405f-9846-b96dc3961cb3", "comment": "Malware payload", "value": "ca426f5cd99097985af0700e226a14081e62da4474912c474493698855b288d69f1cfb46e3793ea32211ade64ec5b8da", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261233, "uuid": "cb83596e-92ee-4553-82e5-b3a0113fb146", "value": "1433F13647ECDAF62972D0AFC4CBF505FBB29465C4D78A2149E8B1C8B6D01955E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261233, "uuid": "df74f672-2464-41dc-886e-dae78998f219", "value": "1536:BjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXR0:lB9wzbqtWb08UscYJhnpjyq9qBR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261233, "uuid": "a6988cc6-bb1b-4b66-8d2e-8a65680178c5", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261233, "uuid": "16063d8f-af55-418e-bf98-9ad0d92b67a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261233, "uuid": "3e3d9140-d5ff-4aa0-810e-5f315bfa60bb", "value": "diagram-422639426.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1057a61-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264546, "uuid": "00190d80-30e6-4992-b9ac-3fda8b8e72ca", "comment": "Malware payload", "value": "de0156c7543f795cfb3e77d452ea1a26", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264546, "uuid": "b77406bb-f93d-4646-8286-175315216086", "comment": "Malware payload", "value": "2b60b7d80e8070cea92e73491223d846c6b5cf96ab004166d374f3bda0c4a7cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264546, "uuid": "421d430a-4547-47ce-98f7-0ef6ec42c210", "comment": "Malware payload", "value": "339bb1e185fd0a504fd5f56a15ee749a082a360f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264546, "uuid": "6a6a041a-8e04-44e7-9ed4-420ce764764c", "comment": "Malware payload", "value": "ee75cbf1754f4cd8658709517187f72de90af69a39dd12c7754e822d67a40a8d759c34d4d1116c0b1184edc9332359ec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264546, "uuid": "9589a058-d798-4798-8574-b3cce26574c8", "value": "893302E09902E087A7597C68DC6A6D078F3CED0A473D7C53112ED0874EA25F8A745E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264546, "uuid": "17119156-1948-469f-aeca-5feab2a73e0e", "value": "1536:iXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qCUu:yXma7774mfCyWMB/4Gp07Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264546, "uuid": "ca513282-e588-4bee-a330-17fca752a987", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264546, "uuid": "a3535fd4-584a-4137-a033-1cd70109de62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264546, "uuid": "11afeaa1-1ef0-426f-98bb-beec782ac8dc", "value": "statistic-799510008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49804a3b-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260909, "uuid": "c5951ff2-c7b5-41dc-aa94-60093ad2f5a2", "comment": "Malware payload", "value": "63e223d371937bcc25b954d4138ccd61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260909, "uuid": "d11672fe-cea0-4c21-a494-c18de865fd63", "comment": "Malware payload", "value": "2b776c8dbcce94a514c9354e9bb1739a64a8d3e747ad195bc3e039b60a9d727f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260909, "uuid": "6f2c4473-5528-4b9e-9b85-930233e6d14b", "comment": "Malware payload", "value": "9c78614d1c32b0b35948979133e992419658417c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260909, "uuid": "a4a75931-2fcb-4a2a-bc20-d0dc786c470f", "comment": "Malware payload", "value": "013763980244d107358f0b708329fedc24dd68b98750bc65fa12b9e372f562b70c189d94369bd745d6d70a2050323382", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260909, "uuid": "30a883e2-386a-46f4-afe1-4fb5a80098ef", "value": "4C33F17547ECCAA76C31E0BFC4C6F845BFF29861C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260909, "uuid": "3d459ca4-181d-4f20-989d-16f20344f12f", "value": "1536:IjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wb:oB9wzbqtWb08UscYJhnpjyq9qEK0wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260909, "uuid": "54073075-b7e4-42fd-8f5e-0cf7af7422e9", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260909, "uuid": "a17dd6b1-da53-42e9-8e25-702f0f28fe98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260909, "uuid": "7eede2be-0eab-4ae7-9eaf-41d0b234cf94", "value": "diagram-2142534069.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294648ce-b6e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621238521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621238521, "uuid": "4022ccbb-5543-40e4-b3d5-d9012219f571", "comment": "Malware payload (Dridex)", "value": "903670fc8067616db01348407202fb1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621238521, "uuid": "6ab659bc-96e1-48e4-a254-3e62efb8e341", "comment": "Malware payload (Dridex)", "value": "2b813e643fe2f3c2828afe619fd8cda6356cade98cea4853bf3622a895e0402f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621238521, "uuid": "72c268b9-1588-4098-a565-6bea31c0bb36", "comment": "Malware payload (Dridex)", "value": "4216e9e4c8647fb54a277f13a35e249e10348a3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621238521, "uuid": "6bfb1654-3c3e-417a-8231-c83aaae1961e", "comment": "Malware payload (Dridex)", "value": "dd13f0ad50eeb68e5c3ffbd13f09b1df632511af1f95a2f1a4e9b18879eddf60afa3dcb87715e5ba77d70638cf72ec3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621238521, "uuid": "cac3811d-4f29-4f56-a8b8-a8e96d85cacc", "value": "FCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621238521, "uuid": "0da72a03-ad43-476e-8fa0-161390cf59dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621238521, "uuid": "893661a8-abce-4619-b137-6163e08de93e", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621238521, "uuid": "26c904ef-c120-4837-b91c-bbbc71a4fd81", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621238521, "uuid": "0522f8e7-ffc2-463e-8876-c313b447f43e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621238521, "uuid": "1b924b8b-c327-400a-a6ed-8a5b9ad63b45", "value": "903670fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b2f9a4-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259933, "uuid": "70207a54-e133-4b2f-9874-0b0f202fa0ee", "comment": "Malware payload", "value": "91e1f9d904dde70526456f1ddb837786", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259933, "uuid": "db7f7863-daca-4f07-993f-2ed5aa20ae10", "comment": "Malware payload", "value": "2b8c766aa6df25b0f9c0fa54bc1a0c640d8aa6c25160ae59dad14a1f2d46f9d8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259933, "uuid": "f417fe95-69c5-4bb0-a6d8-b474b77e7579", "comment": "Malware payload", "value": "83eb7365ad846d57474679aca93e00c38b608620", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259933, "uuid": "daf414bf-26c7-4f60-a84b-efc8aabe198e", "comment": "Malware payload", "value": "f269cb701a7bf94cac9ef647350b1ee7029d0594965701ef145ef703220dea18f81db7bfa1fd7d79c980c6d8937268ce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259933, "uuid": "455c714a-bc6b-4a82-a1ec-f9b895014512", "value": "5333F17147DCCAE66C76E0BF84C2F808FFF28955C987866645F9B1C8B6A42514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259933, "uuid": "e46813ca-d660-42bd-b547-0b81daddecb2", "value": "1536:JjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wQ8:NB9wzbqtWb08UscYJhnpjyq9qEK0wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259933, "uuid": "14197237-3d67-42e4-b804-2ff91938b320", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259933, "uuid": "9df5a9ac-aba2-44a5-bf95-5a864b5db23c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259933, "uuid": "235d040b-067d-4ae4-b377-a3abce84a10b", "value": "diagram-1461276768.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4884ca2d-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260048, "uuid": "c7cf83b9-0fa6-4365-8818-c63a3c5deb7c", "comment": "Malware payload", "value": "2442d9c3df9c97c50531866ce01aaaac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260048, "uuid": "af298774-ac63-444e-8a57-47cd8c064aeb", "comment": "Malware payload", "value": "2bb2371b8b0ab983fad9a894b5c0c30e449f57639461bc6d71e2cca7593be82d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260048, "uuid": "2c92db42-3c60-437c-b0d9-87f64cb46d12", "comment": "Malware payload", "value": "164e3cc3fd03dca4d79a71e556ece88d35750adb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260048, "uuid": "ee372f8e-95a7-4cf3-8237-e989863aa89d", "comment": "Malware payload", "value": "05c5d582c4a6b9daf37e1e153ea27edda0949fc0399e835ef2f785f4833f9bd54ff36cdee63fc6fcb85a3d47e6198cdc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260048, "uuid": "88163c22-16c8-4125-b414-366347314fe2", "value": "AD33F13647ECDAE62D72D0BFC4CBF905FBB18465C4D68A2249E8B2C8B6D01955E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260048, "uuid": "5ad25970-279e-4f83-a953-ed6fa87f4467", "value": "1536:DjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXWw:3B9wzbqtWb08UscYJhnpjyq9qBWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260048, "uuid": "5d1beeb5-d381-455a-bfc2-71d6b8463cc3", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260048, "uuid": "b68f031f-f404-4a4a-909e-b24aa48d174f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260048, "uuid": "fc1bcf80-f423-40e4-b4d2-ba321dbc78fe", "value": "diagram-1547562276.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f14dd81-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258019, "uuid": "8e13e448-07d4-4981-82ef-a2ca2c458fcd", "comment": "Malware payload", "value": "1dca8bf8d6fa17b9e6a204edd447e0a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258019, "uuid": "7ae86b76-6eab-41b9-9a9e-40d3a206cf08", "comment": "Malware payload", "value": "2bc5c4bf5e11307ab956442e81fdc9184ebc917c90012450b7febd12e862e288", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258019, "uuid": "bb66190e-b50f-415d-a022-dab1450ea397", "comment": "Malware payload", "value": "504889d62b51147b2cb6d6b7a78e5e444a65a15e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258019, "uuid": "39b5cc4a-5b62-49fa-9d61-88e332aa7eb2", "comment": "Malware payload", "value": "e3d2fef40382961f8c054320be5d8f4fcc7c5a528714188575aed9016efc310384b35b31f5e662bca896dfc5fb72bc37", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258019, "uuid": "1507ee2c-25eb-45f8-8e07-5f3bcb570de0", "value": "7533F195925412CDCF8ED2EE30F2F9DCE29EAE170D9DA4D09A6E274081531F5443B58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258019, "uuid": "89c66f78-4f0c-4a65-b381-e2ba2154bb24", "value": "1536:s2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIjSqY:dfqhp+g5ru2kmUEt88jSqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258019, "uuid": "da4e7b03-143c-4672-9e01-6d7e55c144f0", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258019, "uuid": "1d1dd75a-d764-4a07-a763-98c0cc752ccd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258019, "uuid": "137980f9-228e-409a-9700-e9bed9864f8b", "value": "catalog-2045160767.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17714df9-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263832, "uuid": "e6f13ebf-11a3-4b51-a80e-b28ee699a20e", "comment": "Malware payload", "value": "db45656587ae62ee516fb3eeae189102", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263832, "uuid": "25f05a20-912c-4694-84fe-01beea7112b6", "comment": "Malware payload", "value": "2bc78790a4b7359c357bc652573ef5c6b9adb4b37f01e6c7fa139885b69048e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263832, "uuid": "56910502-b9b9-4995-85bb-da733df4163c", "comment": "Malware payload", "value": "b5af5984d91fa3fde31dbb458052a6b8bb02587d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263832, "uuid": "3dfecd8f-ff89-4b39-9275-4a0db7a40e8f", "comment": "Malware payload", "value": "16977cf5d7d046f17b098b16ab82c64bffccedfe1d364e68843e3111256bea451f4057a767c3ce371fe453adc919aaec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263832, "uuid": "e7fbfec7-66ae-4b9f-bd2d-791ee4ecec63", "value": "C333F2E0D901E086A755FC58DCAB9D038F3DDD5D073DB852027EC0C75E62AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263832, "uuid": "f10b7959-d6a7-4de5-8dba-dd4dc85cf231", "value": "1536:oXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOjY:8Xma7774mfCyWMB/4GpCOjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263832, "uuid": "c96caae1-8e2b-4013-91ec-fbe9b7a8ab89", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263832, "uuid": "ebfd4de3-c240-41ef-aca1-7b9217f14690", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263832, "uuid": "e6cd54bd-aa1e-46ad-b7c5-4fa02a8b3e3b", "value": "statistic-29094338.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1982ef52-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259970, "uuid": "eceacac5-d699-46d7-a417-4fb95dd66007", "comment": "Malware payload", "value": "06bcf452edf7ea11635d820a81ca2b3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259970, "uuid": "4e8db5ea-5d4a-4a25-b2d8-f004389890c1", "comment": "Malware payload", "value": "2bca8ff7a634868c0e364177a65282a32bd4f7679440f0047e3cef0c6fec94bc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259970, "uuid": "1fdce340-50bd-4e8d-9979-f766c59f0154", "comment": "Malware payload", "value": "0e23bf118ed9c67b3169c53c9a95268b1dcac7da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259970, "uuid": "31b0e602-9342-4810-85a6-36d667104cd3", "comment": "Malware payload", "value": "272eb4a8dbae693092da0681e4998f83b0ed60b2fbd0c7f9b66dda6755e9ca1369963c459d64322679d22558229439de", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259970, "uuid": "d1175e40-b5a7-48be-9120-c4f75a912595", "value": "553302314BECDAF629B5E0AFC8C6F604FBB19455C4D3862649F8B2C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259970, "uuid": "06adea81-701a-47f5-91ea-df1fcf4df20e", "value": "1536:xjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXQp:1B9wzbqtWb08UscYJhnpjyq9qBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259970, "uuid": "639734f8-9ff2-4daf-bad9-6c9753c3270d", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259970, "uuid": "fa89c4c8-280d-47b5-aa38-9297c92e9f60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259970, "uuid": "eb3e7e09-87a9-4455-81d4-90aa888bc461", "value": "diagram-1495545836.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12779dcc-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257381, "uuid": "9e86a110-a922-4282-8d98-ca5643ee0eb9", "comment": "Malware payload", "value": "de0c5b5030dc8be6b81868999cf2cf57", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257381, "uuid": "0d1d13a3-0575-4342-9585-b11a203354a5", "comment": "Malware payload", "value": "2bfad101dabb7583b978092f987603366839d564ea569aabb1305600c3fe1a24", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257381, "uuid": "a3d92bb4-eebc-4e8a-968d-6bacacc0bbbb", "comment": "Malware payload", "value": "c4a4543f2e761e4337d6fb129fdadb3d22c03d52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257381, "uuid": "69092cd9-2230-41a5-a017-09e62b405252", "comment": "Malware payload", "value": "d50ba90999ff260760ce5f07b010a899832f95f0903b86230b7b5fe57188b06b558bb5474777b8d4fb3408fd20f44a0d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257381, "uuid": "2f412581-8841-410f-a59d-ee46649b9e49", "value": "4933F141E615028DCE4EE1CB30F6F8DCE6DE7A030EA964E09A7F2B44D1560E0482B68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257381, "uuid": "8b27f42c-9dcd-432b-81f9-1b68d564e3e3", "value": "1536:U2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jINM:lfqhp+g5ru2kmUEt88NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257381, "uuid": "62111244-5ff4-4da1-983c-e4d61304825d", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257381, "uuid": "817e458c-42b5-4a0c-8a13-ee19a4fcc535", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257381, "uuid": "a300173f-a275-4758-9bcb-91b784a2f239", "value": "catalog-1542748938.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c76d66-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260259, "uuid": "614a41dc-c957-443a-b474-f41f414ce6a7", "comment": "Malware payload", "value": "88066b926362bc3597a422c8c622f3cd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260259, "uuid": "0a21c8b2-5bc1-4c97-8e6d-14ff41a2d296", "comment": "Malware payload", "value": "2bfdff665a9b6400e88c9d89a380e7b6a35566a0d6677efc1d50e49cdb86dc85", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260259, "uuid": "7d7ed5ed-e4eb-49eb-b443-78ab1f2e4818", "comment": "Malware payload", "value": "ee7d57f69520f4df8d9d57458aacbd2ec5479d65", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260259, "uuid": "09ff01ac-064b-4b46-a751-52aa49e4ff46", "comment": "Malware payload", "value": "21f8912d0a3d5fa8dee2ef0ea2d6f4b2faf6f28e5ff5dc568014a3ea6ca851165bf51ccb6d83a99aa176a304996bd653", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260259, "uuid": "259fce76-510e-4af4-b60a-1a3b9879b650", "value": "6B33F1354BACC9F62DB6D0BFC8C6F604FBB194A5C4D7872249F8B1C8B6D01845E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260259, "uuid": "3ff49cee-5c0e-4281-86e0-78505dfc000a", "value": "1536:hjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX84F:FB9wzbqtWb08UscYJhnpjyq9qBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260259, "uuid": "38a830bf-a00f-4d7d-919d-ebab03bc490d", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260259, "uuid": "6f5d5241-c467-466e-9442-b88410fe2e9f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260259, "uuid": "5666fd76-c1fa-44a6-a3f5-0f65095712f6", "value": "diagram-167066830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7698eacb-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263132, "uuid": "346a6ee3-0a08-45eb-b880-4c52a630a57d", "comment": "Malware payload", "value": "03dad8c9475f46e184ac1e07b59b1699", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263132, "uuid": "3c3e4d74-8461-4a3d-bc1b-684d345b5321", "comment": "Malware payload", "value": "2c0696ec2405b9e53ff5555626413b316f6d9694edd104a9bf3223ce5fb0f8f9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263132, "uuid": "a4cb03e9-3b33-4f5b-9b2e-c44276f503d8", "comment": "Malware payload", "value": "18d467aeee30d66105cba1c3d057448ed43d39ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263132, "uuid": "93733644-7af8-4de7-bf1e-dc907826b810", "comment": "Malware payload", "value": "f4bb7e990b836a456275856a96a94459962794af007de2f0ef607364fb71605afd7747b45653ea757c1a6e875a70741b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263132, "uuid": "122ea762-f634-443a-8e7d-43ec97d28811", "value": "583302E09902D087A7597C2CDC6E6D079F3CED0A433DB853112ED0874EA25F8A745E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263132, "uuid": "db10642b-ead0-40a4-8173-a63f6c7183f8", "value": "1536:/XXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qyv:/Xma7774mfCyWMB/4Gp07j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263132, "uuid": "87ce566e-e5b5-4442-a18e-6e506b2df811", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263132, "uuid": "d69a0336-8b41-4548-abd3-9a30559bf883", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263132, "uuid": "af5c219a-dbe5-4ecc-a2a6-c8a4ef2ee719", "value": "statistic-1672363975.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f2670e-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256662, "uuid": "ddbb1864-2edf-474f-bd87-e8d5d1068ea3", "comment": "Malware payload", "value": "cf9a8505e869aa39b35cab760db9c158", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256662, "uuid": "524118c3-a0bc-4337-8fdc-2234715ab8b6", "comment": "Malware payload", "value": "2c07742d0ea51f06753d597d86adb2b05e9ac726a847460b19e2ded196ce4e4f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256662, "uuid": "c7be926a-b3e0-4aed-afec-afa8b572500b", "comment": "Malware payload", "value": "da00df4f6f5708c06b076fef266154fc903b7292", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256662, "uuid": "027f6de5-8de1-422c-866f-9f6277e9e640", "comment": "Malware payload", "value": "e774fd7480d1d21db8ca805b324e873a079974c53119ae56c06dc7ae90e243fba8fad60cc750e36725c8130c9d061a03", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256662, "uuid": "3e1a08b4-a5b1-4304-9f54-31621f349e91", "value": "0333F1959558118DCF8FE2DB20F5E9DCE6CEAE430E99F4D0AA3E1B05D0970F4482E18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256662, "uuid": "f2602e98-c227-42e0-a728-e7dc34344be7", "value": "1536:/2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIpSG:Ofqhp+g5ru2kmUEt88pSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256662, "uuid": "b8061015-1960-49a3-a16c-98f88d08881b", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256662, "uuid": "6c1d72ea-5c8f-4fb8-94c4-31d7ec0270ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256662, "uuid": "97e63337-4c12-4601-9436-ecb164062685", "value": "catalog-1011637529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94b3dd0-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621265043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265043, "uuid": "acc48b86-89d1-4d66-9c57-843ea03064b5", "comment": "Malware payload", "value": "7992e8fd6d8565cba56291547fb5c686", "object_relation": "md5", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265043, "uuid": "6202bea1-d0e7-4c09-aa89-e43c874536be", "comment": "Malware payload", "value": "2c07afad8543fe5003bf9c82a7fb128e88dd8646900d7025d28a21309b65d8b4", "object_relation": "sha256", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265043, "uuid": "33656b07-4448-48f8-84bb-143b178c79d4", "comment": "Malware payload", "value": "37da46b49a6f29fc65c8204d152ca77bd57f1776", "object_relation": "sha1", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621265043, "uuid": "e7e1623c-caba-498e-ac4f-c5f7bd0de9ee", "comment": "Malware payload", "value": "bd917144675ce3fde587e7e7c6bc30ef9b28b210f353f2bdbfb63bdf6558cfbda9f7d8fe59bfc2092bcb28ca67860bd3", "object_relation": "sha3-384", "Tag": [ { "name": "Konstant LLC", "colour": "#3AE11C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265043, "uuid": "07bed3b6-a312-4038-b3e8-7c2ae4af7da7", "value": "EEF47D52FD839533DC275A359D2786B84836FE102F64A9C73AE2792C1E352C175372B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265043, "uuid": "daa5788e-5a5d-4302-acd5-f51ec4c3b958", "value": "9ba19d0b3312ca4b0a2b018e40f9de68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265043, "uuid": "7496119d-b415-41c3-90fe-d30919b93e19", "value": "12288:3ePgpdPxVngwm0XyHKv3Ov5dJxx80S7/M0uW:GgppxVnTm0XyHaev53803W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621265043, "uuid": "29c57e1e-39d0-4c53-bd10-3309d2929853", "value": 777080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621265043, "uuid": "c18a35e7-eead-407b-a104-1c88aae89088", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621265043, "uuid": "ed1b7f34-ae7a-4f6f-8112-cc2bbabaabd9", "value": "2c07afad8543fe5003bf9c82a7fb128e88dd8646900d7025d28a21309b65d8b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b85a12f-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264483, "uuid": "d3140c97-c51d-4138-8336-a4b22b0a999d", "comment": "Malware payload", "value": "85ea7803ac0111ecd69d47d394e659f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264483, "uuid": "2e04e2db-ffde-41cc-8538-2a51427196ca", "comment": "Malware payload", "value": "2c0f440934dd0ea99e6a225cbf5f98816963de20384e0f3f65b4cefd645a53b2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264483, "uuid": "1fa1b84e-56b4-4cc7-80cb-da59da37722d", "comment": "Malware payload", "value": "c8bf55ef739222bce97ad9481646eeaf2939f00d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264483, "uuid": "062c8b32-cca2-4af1-8e12-dcd069d3fdda", "comment": "Malware payload", "value": "862a89e33fc544cf14ce04f28f67cd759aa90a8255618a06406f519ed25adbe91ad44c9f92763614749c011cf43570ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264483, "uuid": "ba98d5bf-bba6-4e6f-81d8-8b6f19049c0f", "value": "863302E4A507E0479349B81CDCAE5D438F3DE91E433E78D2022BC0974E61AB6A145E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264483, "uuid": "2a6912b5-8d39-49fe-8d29-fefd28935430", "value": "1536:oXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZSG:8Xma7774mfCyWMB/4GpWvZSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264483, "uuid": "6c24c448-144f-4f63-ab79-d5eba33d731c", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264483, "uuid": "19c10f53-2d22-4b93-85bf-25ba272a8f1c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264483, "uuid": "3f320cd4-92cc-41fb-ad27-599ad59a74dc", "value": "statistic-752299839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04789778-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264229, "uuid": "f39f4714-64d7-4fa3-8394-75e1bc564efd", "comment": "Malware payload", "value": "bab3732b1bd15c4fbee2e26d169cb0bd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264229, "uuid": "c7d5c198-8d5b-4de3-b491-c42d32759b16", "comment": "Malware payload", "value": "2c223bd4298c859c2d487520aea05df018220efb36447c5b343a9bb24524794d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264229, "uuid": "4543eda0-17f9-4362-a179-4553fd54b8cc", "comment": "Malware payload", "value": "dee9cae53d711ecb39ec9a62c632c582df44a67b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264229, "uuid": "d5eac01d-d942-4ae0-b7ec-b97970995501", "comment": "Malware payload", "value": "0afb29cf5bc56c54a48ef44c9d6c7bf4ec16b0199be7b4ae9a5c92d5290ad00766411cd42c268b95631b4aceae7ce11f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264229, "uuid": "0c626298-d9cc-4cff-a8b0-3fba219fd4c5", "value": "4E33F1D0A906F087E349BC4CDCAF9D134B7EED1F463DB892023AC0875E61AB56605D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264229, "uuid": "f4fce0cc-f6e8-4322-980c-63edecff2acc", "value": "1536:xXXtg3K7774iXfEz5lnm/hQMOEYus1GplItz1:VXma7774mfCyWMB/4Gpl+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264229, "uuid": "77085125-6480-400e-86e0-36c7040a8f80", "value": 52861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264229, "uuid": "23ba90d4-53b9-4f11-9902-733d6d53ad82", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264229, "uuid": "5c9d5a8d-f1f7-4753-a323-b063e761c525", "value": "statistic-567665842.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e130e52a-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261593, "uuid": "c71b054c-8802-4fe9-96db-3b2bf26a70e2", "comment": "Malware payload", "value": "6aa72f6d60350f00d9a38467936e16d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261593, "uuid": "cf4e2a1e-209d-498a-91b7-bdc46e6a4bc1", "comment": "Malware payload", "value": "2c25cae461f76497c99a3c951df6bde88cb22afa054f02c761622b0be4942494", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261593, "uuid": "38f93e7b-9037-4510-8485-adbf0ed2544b", "comment": "Malware payload", "value": "53f4d4b6f0a95d156d6720c1d7458615c9036f8e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261593, "uuid": "47716aba-be60-4ab2-b7ad-f48aa519a8fd", "comment": "Malware payload", "value": "ecc554365561eafe89d9bca0708367c3f3c838514dc38797d1c260648b7e20cbc062c97badc98a6e2a6291bc962e09ae", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261593, "uuid": "e406c0a9-0130-478f-9e7d-bc9494330898", "value": "633302314BACDDF628B2E4AFC88BF504FFB2C495C4D7862649F871C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261593, "uuid": "f50af08b-899c-4c7f-ada8-e1c053fe854e", "value": "1536:VjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXHE:xB9wzbqtWb08UscYJhnpjyq9qBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261593, "uuid": "e73ae1fd-dc44-4af1-b4d6-7e66408c616d", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261593, "uuid": "78276af4-5dd2-4507-a5f6-2c53d75d0c44", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261593, "uuid": "43126049-9efa-44a6-9744-1011ef7bcbf3", "value": "diagram-657404021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9d941a-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261859, "uuid": "52bccdaf-5360-4bc3-b491-5fd2553d818a", "comment": "Malware payload", "value": "ff81b1b117f9d85d32ba656af1336407", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261859, "uuid": "cd402bca-95ad-466d-8d2c-317d3d58cfc3", "comment": "Malware payload", "value": "2c2a9e519f616b400755488c578cefb66a67fea363a26cb41d2c537b23982997", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261859, "uuid": "b31c3a60-db01-4718-9fad-35e3619b1c91", "comment": "Malware payload", "value": "c98bfee2c7b512bd65abd60f4132b51f6228e719", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261859, "uuid": "6d3e413b-4859-4739-ae85-bad389a49db4", "comment": "Malware payload", "value": "816318541b7b157555ddc2af9b213c5e4c61e99f27eb562ab2193903023d3232df9bc5ed3d3be5bba677ff6a9abad974", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261859, "uuid": "aee6541c-63ad-44f8-8000-e99b561b02db", "value": "A133F07147DCCAE66976E0AF84C2F808FFF28955C987862649F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261859, "uuid": "7310f1df-6c02-40a9-9e8f-fed7197eea54", "value": "1536:/jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wYM:7B9wzbqtWb08UscYJhnpjyq9qEK0w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261859, "uuid": "86dd016a-265f-46cf-b0da-40c8c624cae1", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261859, "uuid": "b943f271-8e9f-455b-8006-f4c76aa23cf6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261859, "uuid": "7cec6d45-e21c-4ada-8cf1-e056dc4329e7", "value": "diagram-837122131.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a015c936-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262772, "uuid": "68288ed8-65ee-416d-8dd6-402fc8cf8d82", "comment": "Malware payload", "value": "eef61f8e89f43bfd62b0c7d7d2380bcd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262772, "uuid": "2337eafd-7a4f-45ce-9353-5234736308ae", "comment": "Malware payload", "value": "2c30d70cc32be84d754b1d81e219880d4bf0c702a1dc974cd019d0e6adf51f68", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262772, "uuid": "fe0e571a-d940-4e70-b193-62b6491b2fa2", "comment": "Malware payload", "value": "5312ece5517d5444425b6ebd26290723bf678268", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262772, "uuid": "98c8a484-dd82-4729-be96-a0464c6edad4", "comment": "Malware payload", "value": "58372de9c40bc5ad20db6d5e4f330a58b58ad1d5eed680f42346d3ea55699b1be695f1454aba72b9d399856a555266ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262772, "uuid": "6458f0e1-be0f-467c-a24c-0c4e513e3202", "value": "6233F1E09502F08B9319AC5CDCAE9D024B7DDA1A433D78A3453BC0875E62EB5B749E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262772, "uuid": "28d5c069-ae69-4e93-9776-42931a5f1a1d", "value": "1536:SXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIw9K:CXma7774mfCyWMB/4GpV5dw9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262772, "uuid": "27b865a6-2bfa-4320-9fc8-d37a998935dc", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262772, "uuid": "3cfbd2a6-675d-464b-998f-1e90df3e8f46", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262772, "uuid": "b9910bcc-ee23-4853-8c7d-720fdbbe2350", "value": "statistic-1409342528.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f082e56-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259173, "uuid": "da2cd0e1-f9f0-490d-93f2-a15fe4275020", "comment": "Malware payload", "value": "690a1edbfc0117fcd971d633b1886d40", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259173, "uuid": "ce9ebbf6-cd4a-4125-be2a-c7df196c2319", "comment": "Malware payload", "value": "2c50c575d108643989d548e261a30e9ce93d6b2a11a1377ffe159a360c80923f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259173, "uuid": "99b2e1e1-a50b-44be-8c5e-09d09924cb80", "comment": "Malware payload", "value": "5e438f3449da2a560c00f4c355ae784d5b5570ef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259173, "uuid": "c9254cba-92ba-428d-b126-f601e3185830", "comment": "Malware payload", "value": "4e75f3faf0a74dc68402f6da87db240594afd2a9ac0dfcc95908e24f2ba9dd9245c2cb92d5f09fce8e7523cd42435bfc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259173, "uuid": "c5fa7613-dede-41ff-9bd4-5554f6a0bfb3", "value": "0C33F184D164108DCF4FD2EB30F6FAECE5DE7F43099A68C09A6E2A44D2920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259173, "uuid": "90152c3f-e417-41b7-9fda-9c4d7b766154", "value": "1536:D2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbDM:Cfqhp+g5ru2kmUEt88mAbDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259173, "uuid": "203b2579-d610-4555-92db-0c8e110dad24", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259173, "uuid": "6922dc40-8282-415c-a116-34107dd77d39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259173, "uuid": "d28602c1-9592-40bf-927f-1f34fe042d44", "value": "catalog-837756299.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83aa357d-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256712, "uuid": "99e32ec6-bf41-4333-92b2-ddcdcb3f8ed9", "comment": "Malware payload", "value": "92cbb1d2da0a1a3b71dbc6abca6b7f4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256712, "uuid": "0a3e688f-13c0-491d-98d2-c86d2b5ca3d7", "comment": "Malware payload", "value": "2c855afa69f6b9e006ebab54c8350f91f1e2aa1478f0954c1143b5952afba597", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256712, "uuid": "7710f5e0-1518-41fa-a772-503ba8a9cdd1", "comment": "Malware payload", "value": "831f5643d3cf57d88a29c9cd8dc1f3a07d2c8bc7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256712, "uuid": "2355e90e-8f4b-4f70-8841-400fd4430ca6", "comment": "Malware payload", "value": "a5352caa8d7838b36cae50d8c0b15bcc4dfb791fd5e4be031c1b98550155ff1dea34a7a0b5a1ccaebc25165776234664", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256712, "uuid": "9508d1fe-09bc-4844-bc3a-d62775a76bdb", "value": "E533F151E655028DCE4EE1CB30F6F9DCF6DE7A030EA964E09A7F2A44C1560F4492B68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256712, "uuid": "51cfbfcb-1bfe-4078-b6f3-29604e4db70f", "value": "1536:42fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jImZ:Jfqhp+g5ru2kmUEt88mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256712, "uuid": "c74a98ed-581e-4ed6-9d73-78a9d2ce20f9", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256712, "uuid": "8ade1fcf-5a6e-4fba-b4cf-bddde519d4d2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256712, "uuid": "fd099d9c-d773-4e5a-87ca-1e79a046d86d", "value": "catalog-104120524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b902dabf-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262385, "uuid": "1ad77889-c7f0-4dd2-bf0c-a347ca007e03", "comment": "Malware payload", "value": "35854558d68b8960e58a168746712bde", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262385, "uuid": "0cc4e086-8c5e-43c7-8e75-42755fae6afb", "comment": "Malware payload", "value": "2c8c812d81e026007204ebdf09487eeb00981bb47a32b4e07d6943c8769957b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262385, "uuid": "e3571fac-61cc-472e-bf30-762e14d05da7", "comment": "Malware payload", "value": "85e90c8b648bff8a8ae060f8d84c031d31a4c5ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262385, "uuid": "848d838a-697b-4656-aeb0-9a210f6c92b2", "comment": "Malware payload", "value": "28c5d3a13e6bbe50c1d37722710aa66a4f49ae550971be58a462d3f444a2d6eef5e8116ff840e13061523c27c9ec821d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262385, "uuid": "919273db-d592-4d20-bc58-3a24af654c5e", "value": "C133F2E0D801E086A754F868DCAB9D038F3DDE5A073DB852027EC0D65F62AB5B646D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262385, "uuid": "c2ca3424-fe7c-41cc-b083-5b353bfd6040", "value": "1536:4XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOC4:sXma7774mfCyWMB/4GpCOC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262385, "uuid": "abbaec3b-d5cb-4cc5-80d9-ac7facbc9676", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262385, "uuid": "a02b2b5d-caa9-479b-aedb-31c2017ca0bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262385, "uuid": "1027bb63-efe9-432d-a36b-ab391cb35634", "value": "statistic-1120143915.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e98044f-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257589, "uuid": "12b10a1e-b6f0-4ef9-9756-0dfe7492d7c8", "comment": "Malware payload", "value": "9f9e003635876bc5c5013c08bb5355ba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257589, "uuid": "559d8f72-64cd-4cc2-9a44-a5bab1265dbf", "comment": "Malware payload", "value": "2c8e6415511cc65e41fde795c76b99ab08e2cb96d5e91f584ac8212f4dcd74af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257589, "uuid": "f5a23031-9036-4eeb-bc5a-6bf26bd02762", "comment": "Malware payload", "value": "f87a824357b52ebd20408e092ad2278f856ef330", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257589, "uuid": "858c6850-9fbd-4aa8-86df-b8dd5add62d8", "comment": "Malware payload", "value": "e109c6325ddcc0deb0c15739f9a2eb57adfa0d4212448b9153d4062c4b525087686cf2235ad754428579a9837e3edba6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257589, "uuid": "78ae5b33-7109-4039-99b6-60a34c0b8cec", "value": "E633F141EA58028DCE4BE29B70F5F9DCD1EE7E530D9A78C0962D2B4191530F1482BA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257589, "uuid": "5c173a34-b217-4d73-9705-f21d301d5ea7", "value": "1536:52fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIxc:kfqhp+g5ru2kmUEt88xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257589, "uuid": "42bd34dd-e52b-4c09-9c3e-86c2d4123e9a", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257589, "uuid": "551be017-d47f-431c-b042-8e35e8755259", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257589, "uuid": "a877b1b7-bc76-43ae-945e-6775c18714e4", "value": "catalog-1707951410.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65e48f2-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258568, "uuid": "8690717d-8162-4407-aa7a-c4f76218b632", "comment": "Malware payload", "value": "014896e4800fcc94214530343a5284aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258568, "uuid": "91ff558d-5588-446f-841b-9f25e4f2b373", "comment": "Malware payload", "value": "2c90f1b62b4b08b665974c88db3dc5632199471723dd0ab42691ba24f2c87ac3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258568, "uuid": "44dd454e-d247-47bc-bc78-9b484cd30301", "comment": "Malware payload", "value": "a152ffa94c4d58f716db92612cda6eaceab13def", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258568, "uuid": "6504666d-71d6-4b04-8caf-841d3ef32d66", "comment": "Malware payload", "value": "34f06b02ccbf1479956121fb45a8845f91c8cff036187653f98b03986273b99b84ba559b98c1e5aa9ae43cedb4c46f5d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258568, "uuid": "b3060f3e-1de0-4498-b21e-08fa0d7c0452", "value": "8833F151D645018DCE4FD3EB30B2F9DCE69EAE034A9978D09A7D1B0490938F0892F59F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258568, "uuid": "39567098-099f-46df-99e5-2ab2584379d7", "value": "1536:K2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jId4Ru:vfqhp+g5ru2kmUEt88Wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258568, "uuid": "5459c107-94ef-444c-8ac8-4320aae16a7d", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258568, "uuid": "82951936-4c23-4101-a2a4-11ca959317d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258568, "uuid": "beab435a-62da-495f-8d4a-7706f71295bf", "value": "catalog-408767075.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d124b5f4-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261996, "uuid": "6360a4e1-6113-45d3-8ffc-9c2c3bf7e706", "comment": "Malware payload", "value": "b8ce14c35c1577d0077df689daa465ac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261996, "uuid": "9f6476a6-1fa3-4184-a1c1-39a64b171bfd", "comment": "Malware payload", "value": "2c917f3bd212d262af41061e56ad191d4e946866783b8a6c5dde1e39ff9e5005", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261996, "uuid": "bbbfbe67-518e-49d9-a642-2e1425180ef1", "comment": "Malware payload", "value": "159a26570c08dde3e69d90b21879ca4a1f87c9b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261996, "uuid": "a8c5a7f6-1829-451c-9cf2-9546be416713", "comment": "Malware payload", "value": "1a3729034309a065cc244a5a117bd0f1bcc789d99c18aa09cf0d8f81652918106147470222a53f4448b71a7fb79b59fc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261996, "uuid": "7a8bd175-f7d7-4500-bd6f-2d69a33b16a1", "value": "873302314BACD9F238B2E4AFC88BF504FFB1C455C4D786264AF8B1C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261996, "uuid": "e0133407-957a-45eb-b245-b4bef5b9fd64", "value": "1536:xjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXjs:1B9wzbqtWb08UscYJhnpjyq9qB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261996, "uuid": "81a1d760-3161-4d65-91fa-796a7e32f55a", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261996, "uuid": "3ac51e60-f0ca-4d48-905a-f7d13ddf52b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261996, "uuid": "bea38174-f6ae-450e-93be-feb18fec2d80", "value": "diagram-934633170.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3686d9-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261021, "uuid": "b870f255-4472-4370-9c9c-d87120340107", "comment": "Malware payload", "value": "47505b044bc0136e34e73105693857d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261021, "uuid": "cea8a4ac-bd9f-4b44-ba95-19f225c1b093", "comment": "Malware payload", "value": "2caf90f377222f12fd6284664a07abf22994b225767fc44a2d4a681d02dc93b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261021, "uuid": "62d547cd-c722-4da3-8ef5-dd4f980dd1fc", "comment": "Malware payload", "value": "889e89a0e426ebd26350807c890a78cb2e12ec84", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261021, "uuid": "477fb13f-d334-4047-90d0-19ab35287bb4", "comment": "Malware payload", "value": "23a3eb2cd324730e5c5efc823ddf1f98672ee21187c50e257eddc32232922a0ee97067ffddcf3d423c0cfc6024e60a60", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261021, "uuid": "267b9369-622d-46ec-9ca3-55e9c048b36a", "value": "B033F17547FCDAB62DB2D4AFC4C6F504FFB1C4A9C8C78A2649F871C8B6901959E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261021, "uuid": "8b048c42-25b0-46c6-a26f-3d3e402d2081", "value": "1536:gjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXM9:AB9wzbqtWb08UscYJhnpjyq9qBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261021, "uuid": "ab3ae7af-54ea-459b-870d-64974d45c317", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261021, "uuid": "20462815-45f4-40d1-81e7-0ad3a90cc142", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261021, "uuid": "3a0050ba-e16c-47fa-bcd1-f8623271899f", "value": "diagram-264082397.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bc1158-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259665, "uuid": "7fd2a690-adbc-4721-a5ea-f4a1604d907a", "comment": "Malware payload", "value": "66094ec073512035e0fd8c77d44504b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259665, "uuid": "a531e339-ce39-4cd0-ba57-fc6e8ee66a1f", "comment": "Malware payload", "value": "2cd7fc667883e8a4c567e20f6420dc7c313cf0ce018648a5b669790e3e807ce9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259665, "uuid": "ee992cb1-cd4d-4d51-b43b-5bd05589d943", "comment": "Malware payload", "value": "9eda4312780d93c4d235e5d97abc79f9ad2e9021", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259665, "uuid": "ba136942-6155-4b52-81e9-c16d46c32a73", "comment": "Malware payload", "value": "c3defaf738d88ac42b3256e73c6723ad7842e6b04008d1668a702bd45ef6093a5594609218cfb5151f4f88c58eefc199", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259665, "uuid": "dc13bcc0-0a09-4d08-a0a2-67e7b6277419", "value": "B433F17547ECCAA76C72E0BFC4C6F845BFB28421C897872249F9B0C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259665, "uuid": "f149a24f-8681-4611-a2e1-6ea0632abdf2", "value": "1536:XjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wp:zB9wzbqtWb08UscYJhnpjyq9qEK0wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259665, "uuid": "f6a96937-6e59-4c90-8f12-d288137bbedc", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259665, "uuid": "72c52cb6-1dbe-4c01-afbd-daa3bcc63d96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259665, "uuid": "d9aa7b47-22f6-4d12-b65e-f496f6a70255", "value": "diagram-1227703292.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecedbe8d-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259036, "uuid": "80f39d1a-ebf4-444a-a29b-9248cbc518f4", "comment": "Malware payload", "value": "9e007178c5b1e526780ea158d27c6a1b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259036, "uuid": "ccc76bf2-431c-48e6-99b7-f8fe0cee2785", "comment": "Malware payload", "value": "2ce84d44fce47330b0abc0522eca4241d9aac0211cac1b45124bd976aac79cf9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259036, "uuid": "a24fe1bb-e233-43ee-86f2-d5a1fc36f042", "comment": "Malware payload", "value": "a86782cc31e0375f234257fb49114d4cdf24507a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259036, "uuid": "57e661e0-aa2d-4d29-ba90-3d2225086ebc", "comment": "Malware payload", "value": "912276f858f3d95aa08313a3a1b06867187b85ce59a872badcbc997b1d04aa90a2b7e85b44bb76f7eb4e21abec6e4daf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259036, "uuid": "3633c35e-93d1-4a8f-a9e4-a4e9cf446a90", "value": "5633F184D164108DCF4FD2EB70F6F9ECE19EBF43099A68C09A6E2A44D2920F54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259036, "uuid": "3434c07d-589c-4b80-8cc5-e6965cb20c68", "value": "1536:I2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbtt:5fqhp+g5ru2kmUEt88mAbtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259036, "uuid": "cd261e76-9b10-4fb7-9f24-66eef9676c44", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259036, "uuid": "3dc3de23-e32b-4884-b2a2-08f8c407fa91", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259036, "uuid": "92695029-44dd-46de-9b18-42d246ec0d19", "value": "catalog-766554185.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3f7b91-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261749, "uuid": "553d9947-33ef-47cd-a715-19c5c2473786", "comment": "Malware payload", "value": "930a50f66fc2a7fb02da67d3def97e93", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261749, "uuid": "84c0c573-dbd2-4d8c-8b9c-c46a89b00868", "comment": "Malware payload", "value": "2d0789d705bcd7d619689b7c3c0157b4b8f91d1b50efc52ff0fccc142421b0ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261749, "uuid": "37551498-98c6-4b79-897f-4e79dc9c9765", "comment": "Malware payload", "value": "e8fe7d507e549e354d30f64d53f76aa0734bf2f1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261749, "uuid": "575dbcfe-3faf-47be-ba99-3cc7a4e752cf", "comment": "Malware payload", "value": "1dfbe0669601ec1bde44bf281c7b708330ad183d7beb0857560a6b09d6dff68beeeae17bcbe5721f17a0f617a925191a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261749, "uuid": "d9a412d5-7ed8-4b20-9c5e-289b0a6e9484", "value": "5B33F13647ECDAF62972D0BFC8CBF905FBB18465C4D78A2149E8B2C8B6D01855E32E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261749, "uuid": "395e7d2b-df5b-4854-a7b9-464d90005124", "value": "1536:3jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXgZ:TB9wzbqtWb08UscYJhnpjyq9qBgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261749, "uuid": "7884e197-1b2b-4bab-8899-b2cd8668f0cd", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261749, "uuid": "70d7b62f-7359-47c9-908e-d551c2a7a9f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261749, "uuid": "0e10cee6-6305-4886-8b6a-402e95e6047e", "value": "diagram-76695408.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578d8060-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260074, "uuid": "3f88d7ae-7df1-4b81-8904-148a4d2094f7", "comment": "Malware payload", "value": "c7af4bde50b18a3ed73c1e21467f69d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260074, "uuid": "9798d61d-059d-45ab-b91b-4af8710f1d36", "comment": "Malware payload", "value": "2d09b44f73897722d69c58c84777581eefb522b380cdd52893147fd39f30de9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260074, "uuid": "a3a44fb1-2e01-4b57-894a-b1da5d04d22a", "comment": "Malware payload", "value": "ec357196ce300589823179ac92c2a119e8cad046", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260074, "uuid": "76d63de6-abf6-4bbf-8c3d-484e04f24446", "comment": "Malware payload", "value": "e9a45404ade2bf71e7dc93a5d34328f6c1fe2607b7e3235ec403224913359d560e696f6856a8a48a33db6eb861b62365", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260074, "uuid": "8f317606-42f5-4222-a730-f8c415837bb7", "value": "6F33F1711BACDAE66DB1D47FC486FA04FFF1C865D4AA871285F8B0C8B6D02519E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260074, "uuid": "15f0a67c-8518-406e-888e-a9fd3a6b13c2", "value": "1536:ojfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67t0A:IB9wzbqtWb08UscYJhnpjyq9qawn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260074, "uuid": "c8664ef8-7a25-4d01-9d67-1090107403b2", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260074, "uuid": "b99de9cd-91cf-47ba-ad78-a4112782a81b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260074, "uuid": "c885e0bf-b9e3-4e28-b0b3-353ec45b58a5", "value": "diagram-1556404599.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30636494-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259149, "uuid": "f4563d69-339a-41c7-b47d-d28c90561d83", "comment": "Malware payload", "value": "2cfea39df85de00e90c3c563f9864807", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259149, "uuid": "68466659-c9b6-4087-b390-84df23db8106", "comment": "Malware payload", "value": "2d3d94086ad97e4fb572229d44c708c9503149e8984a945a16898211e22bd303", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259149, "uuid": "30f65b48-f684-40cc-b1ce-aeb5f991f7b9", "comment": "Malware payload", "value": "60a5ccf704f640b067de2d6d935d17aa836e903e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259149, "uuid": "92bf9188-95a9-4457-ad79-a49facfbe642", "comment": "Malware payload", "value": "ce3b7af5ae2b13a0cfafe6eb4e42e132db123c3c9f4310ea968fa7ea899baac58337ab28f00fa8d693a2b5aeca7a3ae4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259149, "uuid": "b4286b92-cbc2-46fb-8d61-f5ca338567dc", "value": "1033F1A59658008DCE4FD2DB30F2FADCE5CDBE434F89B4C09B6E2B4590920F5192E58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259149, "uuid": "cc22cb5c-a72a-44d1-86ee-f68ce45cb5d6", "value": "1536:D2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jITR0:Cfqhp+g5ru2kmUEt88t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259149, "uuid": "d504acdb-4df6-46d4-990f-25f5a4005c9d", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259149, "uuid": "ff3dea6d-c6f3-4289-a383-7ca566cb7209", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259149, "uuid": "aeab2653-9216-4956-9d4e-cf742725964d", "value": "catalog-830181632.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de37e01-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260031, "uuid": "4d225ab1-c150-49bf-a739-823cf4b77dbc", "comment": "Malware payload", "value": "83bdf921377d6687cabc1e767a3fd185", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260031, "uuid": "7f90c40d-87a6-4043-80e0-5a4dbe15f255", "comment": "Malware payload", "value": "2d648fcbc0f7b72ed7ca43c1aa51223fdd616702e95c84cac2acd4670f0ae976", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260031, "uuid": "7cd43b13-a472-4743-8e53-b544f7ca789e", "comment": "Malware payload", "value": "f1002e00ecc88c80b0af070f0bea3b281916d571", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260031, "uuid": "97c2769b-66e0-41e8-a516-e0c6a6a0f6d1", "comment": "Malware payload", "value": "ba40622c53183e6a297294800b95789f8a262795e0762f7e6644f66b5c92c5b858988aab5edd75c39139b72b5170f26b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260031, "uuid": "222c29b1-ba22-42a6-979d-606194b30981", "value": "9233F1711BACDAE66DB1D47FC086FA04FFF1C4A5C4AA861385F8B0C8B6D12915E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260031, "uuid": "a512aa0b-5e21-4688-bfa9-ea9f15b75689", "value": "1536:RjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67q0S:VB9wzbqtWb08UscYJhnpjyq9qaw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260031, "uuid": "90d308b5-dcda-4982-b5d8-f761035b5729", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260031, "uuid": "b8b6493c-8bff-40b3-999c-ebf57ceed1f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260031, "uuid": "465761f4-ff2e-448b-910e-1c6ce79f1314", "value": "diagram-1536324590.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180c4c15-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259967, "uuid": "0bc6dfe9-74af-4ba7-80a1-e6f0e038c1f3", "comment": "Malware payload", "value": "7933794f0e4f08904a84d5227a939f28", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259967, "uuid": "b37a119c-d97b-4248-865e-da21f7e2750b", "comment": "Malware payload", "value": "2d6ba384fe596bf4ff3168e7550e8a3bd6f3ad8f5b4971de0bb8ab03bb7ece80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259967, "uuid": "e9831af7-11c9-45f7-9351-a8f89b4d1a9e", "comment": "Malware payload", "value": "c3e14cd2969302e03cf67ca0981ca4bb0f9df953", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259967, "uuid": "ecbb638c-e5b0-48fb-a6b0-767bb2df21e3", "comment": "Malware payload", "value": "55ccfec15e11f10bc3196fa841cc561d22ab57579983189cf806b6e68e6c59cee64428f99eccc3c628c66049c89a5cc1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259967, "uuid": "4258d248-1199-42f3-bfee-6a7a81ec593d", "value": "4433023147ECDAF629B5E0BFC8C6F604FBB19455C4D3862649F9B2C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259967, "uuid": "0f7259ca-39e2-478a-a4e6-96aced264fa5", "value": "1536:VjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXti:xB9wzbqtWb08UscYJhnpjyq9qBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259967, "uuid": "2b879b55-aa57-4534-af88-e48257025b4a", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259967, "uuid": "c807b92c-4889-4c79-9afd-713b84c84a1e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259967, "uuid": "bb6d397d-d5ed-493a-a41e-fc327d15a9fb", "value": "diagram-1490425552.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9c61be-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263515, "uuid": "a2371224-be68-4ef6-90f0-512b01dd73de", "comment": "Malware payload", "value": "6f1320077af6f21d080aca19e0b99f1b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263515, "uuid": "4a08dea8-1713-4463-b6de-4c827d6294f9", "comment": "Malware payload", "value": "2d7e181b0701e8cb25be332da5ca07354938c732ede8af06393544b0bc703542", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263515, "uuid": "e1feb409-c7e9-4242-92d7-425bde7a34ce", "comment": "Malware payload", "value": "fb130239849c33be4fb2ab95c4c7ba45048b188a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263515, "uuid": "231ee2b3-b8f9-411d-8229-ed26c127492f", "comment": "Malware payload", "value": "01daabca4b7f9127a231fbcf3de833299b4fb4ac81ed9a180379351153269d9176c5733af293482fe040ef8012a24a91", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263515, "uuid": "26413bed-f277-4bce-b095-50deb070bf17", "value": "1033F1E09902F08E9759BC59DCAB9D078F39C91E027D3883017BD0475EB1AB5A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263515, "uuid": "852da509-5d32-46c6-9ce7-d89deb9ab1a1", "value": "1536:gXXtg3K7774iXfEz5lnm/hQMOEYus1GppKA:EXma7774mfCyWMB/4Gppn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263515, "uuid": "5dd0fed3-3bdf-4dc5-a7df-f624f5883044", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263515, "uuid": "d9636ce1-c506-4858-b16f-6a74d31407b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263515, "uuid": "46bdac05-5460-4d87-9ead-754ab0a0395b", "value": "statistic-1959400492.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc40e782-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260672, "uuid": "8c740a31-52ca-4d1b-80da-4313b88250d3", "comment": "Malware payload", "value": "d50975a22559bd16851366d06a7b5ec1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260672, "uuid": "822e4621-2598-43f9-96dc-55fb56f8f850", "comment": "Malware payload", "value": "2d993a2795599b02cec532675ea1ea9cf126b3869063641fc6ffb11bc28c8fbf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260672, "uuid": "2a8e3794-3f75-4fc3-9af3-1a097f481baa", "comment": "Malware payload", "value": "826c4f5e1c8040aa194ebae2a3b26ae30e2933fe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260672, "uuid": "d340468c-d8b9-43bc-bf3b-6f6d46750fd9", "comment": "Malware payload", "value": "e3cdc2ed4705c61442058849e9a364919fd9ab671d916a670833c256485243bf1e17e011827e68ae031d1171c59dc548", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260672, "uuid": "1bf5659c-7581-4355-8808-d9314529d735", "value": "833301354BECCAF629B6E0AFC8C6F604FBB1D495C4D3872249F8B1C8B6D01855E22E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260672, "uuid": "429b6710-712b-4ce9-a1ae-997e05b2283e", "value": "1536:7jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXHC:PB9wzbqtWb08UscYJhnpjyq9qBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260672, "uuid": "96f7463f-c869-4236-88e2-14d11f2783d3", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260672, "uuid": "84dea70f-3883-471e-b7cd-4db3d383f6ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260672, "uuid": "ddf1336a-76a6-4e48-8c7c-be348da0d5bb", "value": "diagram-1960666038.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160093ec-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263829, "uuid": "0b2a86c6-e79f-467c-b8b5-fdff9e12e40a", "comment": "Malware payload", "value": "625968b60be8a82a923c102de5572ddd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263829, "uuid": "3120dbbc-0372-45e8-b3b5-085fe9b9bc1b", "comment": "Malware payload", "value": "2db1999dacce28373a90cc673a1279ad93d74c007cbe30ecc6f50a6fff8882bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263829, "uuid": "2b69803d-1b62-485d-8f97-60564ed55cfc", "comment": "Malware payload", "value": "92d9e6ae3620bc414495c4f2cd9db2dc2caed48b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263829, "uuid": "d937020d-101a-4972-a158-f1b56ea5f9e3", "comment": "Malware payload", "value": "43d563a446f44441b0006c46348b4fa832a86bdb3ca8f7824384f3cdb7b504a8b5f3ecf0a18f5e838ffff3dcee0135b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263829, "uuid": "5c0e3bc3-4939-41d5-9469-712ee4fb33db", "value": "6B3302E49507E0479748BC2DEC5E9D038F3DE91E433E78D2112BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263829, "uuid": "10f998ec-3f7d-4f24-80b7-e54ae3415b23", "value": "1536:AXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZt:kXma7774mfCyWMB/4GpWvZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263829, "uuid": "ca17f6e7-03a5-48f0-80c2-33ce852df5bb", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263829, "uuid": "e64af97f-d235-487e-97a6-400548891ac7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263829, "uuid": "565bb105-16ab-4810-96fb-ba1abcbb4d35", "value": "statistic-278757019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804b1f2f-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258853, "uuid": "7782c660-cc79-4e35-827c-43aab1517ba2", "comment": "Malware payload", "value": "67ad5e9d5d0026bdc82568ae65ab406b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258853, "uuid": "fcb83495-4f50-4a1f-8ab8-b1549a3500cc", "comment": "Malware payload", "value": "2dc181821a1ab8aa7938c81d4e730ef5f63789f28a984587f4b1d921abc7e3f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258853, "uuid": "f4cd3a01-11eb-4815-8a1d-63410fb08712", "comment": "Malware payload", "value": "ce5e59d3bd3688263fc7b45ffde5920e8a0bbe71", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258853, "uuid": "41d11839-404c-47ee-95f0-f1ba3c11ce3f", "comment": "Malware payload", "value": "1356ac02e7b4e9d626779c8244a47983bb4bbbac33d08de666213917be9da8f531714f555e96b3fbb2f5c347cba0f01f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258853, "uuid": "3f437b03-d970-4868-a76d-25e3e4bd2488", "value": "B6330295E524108CCE4ED1DF30F6FADCE6ADAF5709A968D09A6E2B04D5930F1082F58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258853, "uuid": "5423eb75-b228-499b-aa62-8a81a83e84c6", "value": "1536:d2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIlR8:Yfqhp+g5ru2kmUEt88la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258853, "uuid": "6fa4b606-54e8-43e4-a9fc-04b7625ab7ac", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258853, "uuid": "f0a1a495-725e-4463-a5e4-bd32688a6988", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258853, "uuid": "88219eef-24b5-43f6-98fc-9f40ec03548c", "value": "catalog-622781336.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d221fb5-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262230, "uuid": "cbbf0983-acaf-4749-be65-3401ba66b2d5", "comment": "Malware payload", "value": "ee102880549b2e94292770018539c83c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262230, "uuid": "a50e4410-0495-436e-af40-cd5ea558d90c", "comment": "Malware payload", "value": "2dc725bec776b2473b9413872492e0fdc7e1fdbb423f90d5a572b6374ab6253f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262230, "uuid": "596a5189-b612-4da1-8bfb-ff9b8695f484", "comment": "Malware payload", "value": "df54022e1f30c4018a2b07e405f251a05ba35e6d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262230, "uuid": "09fb7b32-f5b4-40cb-83df-9347531efae0", "comment": "Malware payload", "value": "cf6c7989ea308cbc3e136c5b79f522e1e80d13df2e9f164f3d81b7649491ba9707bd61b19cd15ebb6f81fc616a3faf16", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262230, "uuid": "5ee36b29-61be-49c1-99a3-c9ad00ce74ce", "value": "7033F17187ACD9E668B2E4BFD8C6F904FBF2D499C4D78A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262230, "uuid": "9c778f64-abf4-4f79-b6a7-8e08bd0a8e34", "value": "1536:XjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXrC:zB9wzbqtWb08UscYJhnpjyq9qBrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262230, "uuid": "44897bd5-caff-4a9d-8d22-d7c2d6e35212", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262230, "uuid": "fd5cd047-3954-44d7-b13e-8876ab15060d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262230, "uuid": "2ae20508-b21c-47a0-a957-cf8cc9fc6e93", "value": "diagram-990725116.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeca12d6-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257750, "uuid": "f8a8374c-51bd-4b37-887f-419669a3b57c", "comment": "Malware payload", "value": "788c801f667846832dd89d7f4743bee3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257750, "uuid": "aebeda7d-51b4-42f3-ab9e-456a3f8b8fa8", "comment": "Malware payload", "value": "2df8c6421e57d540daf7f34e38fc4010430e321aed249cb8c5add1d06e0b355f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257750, "uuid": "f79fd71a-0a58-4140-ae2b-5ed236e23214", "comment": "Malware payload", "value": "c0a5199123528546b178a31d4ec94e368af19782", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257750, "uuid": "7074981a-e3f8-4909-a225-ba8865b3dd53", "comment": "Malware payload", "value": "7288bb08d810702e473e90c875e26946d6b5fceb06a90d3c27dd7fd21df799ed2a3bfcc59e28311a6878c651af83d134", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257750, "uuid": "252ce0d2-9d92-4107-bb4f-a6ad3d159b62", "value": "6833F191A558118DCF4FE29F30B6F9E8EADDBE830D99A4D09A6E1B0184530F4543F68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257750, "uuid": "606f562f-72d3-45be-8633-3c5872d0add9", "value": "1536:z2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIRS3+:Sfqhp+g5ru2kmUEt88U3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257750, "uuid": "fb3402a0-ad5f-4ee9-8853-ae5ae7783d77", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257750, "uuid": "33ab0cce-e65c-49d1-a1e3-2f7921e0f85a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257750, "uuid": "89de608c-c1a1-4528-9dfe-b853f5d9ecf2", "value": "catalog-1847517280.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb7550a-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261963, "uuid": "3ea2562a-0d91-4e22-a3b4-c8d831360a29", "comment": "Malware payload", "value": "4a177b84246d9eab88bee22a54e81292", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261963, "uuid": "0f2d4704-dd0a-46b9-939f-600811acdfef", "comment": "Malware payload", "value": "2e141585e6467c922cca3b41ff6757eff0e2c54434d275f9a1088ba27ed56250", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261963, "uuid": "f691ee57-5e0e-422b-aae3-8500965df59a", "comment": "Malware payload", "value": "41b7b4a673725492b561167ebc608c1f5fd1d22f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261963, "uuid": "5e550e4b-c800-4c98-8b11-5cda3d9f55cc", "comment": "Malware payload", "value": "bc7f83c1646a454ec530fe475e63b5303468604df0776a0e100a6e1c17c840d330ce0c31cf2b33767af63f63cebd77b4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261963, "uuid": "bf041a59-9674-4ca0-8b38-513359789364", "value": "2233F17147ACD9F668B2E4BFC8C7B504FBB2D49AC4D786224AF871C8B6D51544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261963, "uuid": "363f4f99-72c5-4d0c-b48e-8c548293c6ea", "value": "1536:djfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXa3:5B9wzbqtWb08UscYJhnpjyq9qBa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261963, "uuid": "9e613ed5-fe14-4e78-9e1f-17ca043d907c", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261963, "uuid": "d874dfc2-9211-4111-8bca-ed46adf69024", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261963, "uuid": "fbd3b755-2036-4a41-90f0-128aae04360d", "value": "diagram-90093825.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d19fcc-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256799, "uuid": "ac5a052d-8597-46c3-b515-15da517c3b22", "comment": "Malware payload", "value": "a6a2c9269f30b0c53bd9de8d3c9edfad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256799, "uuid": "d591f141-5d82-47d4-9b7d-7d658bf6287a", "comment": "Malware payload", "value": "2e1ea3d19401a5afa51c46af203bbb940e683da1ff014798e11680e62a41c336", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256799, "uuid": "34a1b0fd-ca09-4def-a29b-8a116b82d6a6", "comment": "Malware payload", "value": "8b82d450a1809a7d7c679eaf94eaab875040919e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256799, "uuid": "94388524-0fce-4790-ab67-e394261c8a87", "comment": "Malware payload", "value": "5c58f43cec81e0d7ed99f7cd9c324ff04f14b6b3eeee29a19a37850ef9157d95ba03ca4b09d180eada9477a8e8179852", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256799, "uuid": "e064ae5d-273a-4c25-9aa2-da25fc0603dd", "value": "2B33F1469218118CCE4BE1EB30F6FAD8E6DD6A430EA9B0D09B7D2745C1630F1492F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256799, "uuid": "05ad7c00-4f62-414e-b4a1-bb5783f1c48b", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAukSD:Ffqhp+g5ru2kmUEt88ADE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256799, "uuid": "e6c2dccd-278a-427b-b9b4-6acf2441c3ee", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256799, "uuid": "6934bb88-717e-4fb0-b0b2-1aa91d915dc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256799, "uuid": "3af901d0-0495-4a44-9b62-13639ed90f23", "value": "catalog-1104917375.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaba4c5-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257207, "uuid": "5fc43e5b-a447-4bf3-acd9-f54e4d82bd29", "comment": "Malware payload", "value": "47684cd75b0cd9d9322d2ce1287ca684", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257207, "uuid": "a039a08f-f5b4-4b45-b38f-765114581bac", "comment": "Malware payload", "value": "2e30ca2b0db61998f2bd894a9158bcec4410af74b6b1aba239799d2b82f9d7b5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257207, "uuid": "02a7e4d8-79e8-49e0-bf42-13d2ce715837", "comment": "Malware payload", "value": "d21dac569350939710c01390e0f403f11eb6408a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257207, "uuid": "98c5e693-067b-4f36-8eea-49ace233cb65", "comment": "Malware payload", "value": "103e32a1e5dae3c4dae481649242a48ef809e02276680359ca0571a8705e4350dff814eeb0825631d1097fa35075d76d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257207, "uuid": "fecc452e-1ccf-49cc-ab3d-a0366877cc16", "value": "6B33F251E655028DCE4EE1DB30F6F8DCE6DE7A030EA974E09E7F2A45C1560F4482A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257207, "uuid": "b5445693-7e54-4faf-9fe5-a439f6ec9301", "value": "1536:j2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIOx:ifqhp+g5ru2kmUEt88Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257207, "uuid": "a104e893-6c3e-40bf-9e5b-7eff3c191b3b", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257207, "uuid": "b757e216-2d11-4766-ab5a-e4bcd984dc39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257207, "uuid": "a22533a3-707e-42cf-bd82-776924828330", "value": "catalog-1424594723.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbb9bc1-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264812, "uuid": "c78816e6-2951-4341-8978-4e1c8cbd4372", "comment": "Malware payload", "value": "2c0adca55468c7b67b37822a82b47d9f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264812, "uuid": "548eccb7-53df-4ec8-b44f-bcd11d2d897e", "comment": "Malware payload", "value": "2e3265ae733c3b3c5e59b6936220d67559ea0bec5b4a589dd5e6157d9d6db81e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264812, "uuid": "98534c9f-1f19-4487-bd26-eeef57bf0500", "comment": "Malware payload", "value": "ebcb569b8755fa62f89feb920506be61b2217bc9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264812, "uuid": "96f54e03-6a57-4143-bc08-af5470cd115f", "comment": "Malware payload", "value": "bccc5dd76877c421679ba04f3e242ccb39889f3ee8425f0596df2eda5c184943dca7caad551fae2dc541a2c92ff83c85", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264812, "uuid": "94b136ce-d43f-44b4-9f9b-b17b6b97455c", "value": "8133F1E0A403F08BD75D784CDC6F9D034B3DEE0A433D6892457AD08B5EA1AB5F649D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264812, "uuid": "bcc36bcc-637a-4973-8cc0-0ed99aec605a", "value": "1536:zXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EIRur:rXma7774mfCyWMB/4GpV5dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264812, "uuid": "9e9d37d5-ad92-4029-8a72-b2507b195a22", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264812, "uuid": "db150f3a-a04c-4333-b4dd-badf1916bd6f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264812, "uuid": "5bdb3461-48f5-4048-8317-f3e02fd5f5e9", "value": "statistic-97310678.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ac0ee6-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256928, "uuid": "cff02668-da9e-47c1-83be-cd3769a208ea", "comment": "Malware payload", "value": "12ab1ca4ffd9cba392868c2a371dfb31", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256928, "uuid": "818ffeca-ef56-4fc3-a5b2-2f60be6ee3a3", "comment": "Malware payload", "value": "2e367ef38a74b792c38f549d66d88bed7b98b9cc7e3ce072918d96c932f203f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256928, "uuid": "b810292c-fd3d-41e8-9896-1ad690fbe42b", "comment": "Malware payload", "value": "d173f1e5c73b27e3d94dbd4ba6133b3a238b3f89", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256928, "uuid": "cb1eeffa-1f8b-4507-bb61-fc400c54e37b", "comment": "Malware payload", "value": "ef83ca310da9f5ad572b8e20b88b946c1b0ab08be69ecfc9a74926d5fe2243d8a7a0462e870482ea8f92c43c7cda7b84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256928, "uuid": "fdfd2757-51c0-4108-b8c1-7dadb0183bef", "value": "4F33F181E558118ECE0ED29B30B6F9DCE2DDAB534E9AB4C09B7F1B44C5924F1482E58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256928, "uuid": "2091104c-e331-4153-874f-ceb96a438157", "value": "1536:h2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIFh:Mfqhp+g5ru2kmUEt88Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256928, "uuid": "ded31148-ec8b-4ab7-b224-916fb69e779d", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256928, "uuid": "b4c4799f-224a-49d4-afa4-f8378c092327", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256928, "uuid": "3c14b67c-3545-4ce4-9c3c-2eb778e09524", "value": "catalog-1217374758.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8405abb9-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259719, "uuid": "22dc280c-af5b-4c91-9d6d-acbfd96efcdf", "comment": "Malware payload", "value": "91dadd020721a78e9a21e06eae3ce346", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259719, "uuid": "9fe4dfe3-3fc1-461e-88c3-69014ae49006", "comment": "Malware payload", "value": "2e554b33514a6322ed9f11870c6a2a5ce270a5b4275ad1ead1c8a156a976a03a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259719, "uuid": "939395ba-b37e-4e73-91e5-b8b8cad6d53e", "comment": "Malware payload", "value": "29ec92a11ff1b968ec09d10cec4d3258b6e29f35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259719, "uuid": "765ee04a-71da-4443-9293-6dd2e43f6733", "comment": "Malware payload", "value": "8b51ebec6c988638d13b1f327fd95b2fdfd9b57f5b931ddf346179cc419114c620daed66bbbc18b9d18c7e9156f1fbd6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259719, "uuid": "984a8de2-3248-44bf-9ee0-01efcb8babef", "value": "9833F1314BECDAF629B6E0AFC8C6F604FFB19455C4D3862249F8B2C8B6D01855E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259719, "uuid": "6069dddb-d3ec-463b-8bd8-cbaf6346e102", "value": "1536:gjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXT3:AB9wzbqtWb08UscYJhnpjyq9qBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259719, "uuid": "020bfd09-e2aa-40dc-85ee-6a427bfb4f90", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259719, "uuid": "09bb853e-9b62-41cb-85ab-d9b38d7f170a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259719, "uuid": "e75921e1-0db3-496d-812c-36ff937fa902", "value": "diagram-126967290.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffe1892-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258101, "uuid": "e67ef86d-bbfe-4e84-962a-6eb188fa6137", "comment": "Malware payload", "value": "2d09d0e7569fd8c1e6cc337c5f929822", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258101, "uuid": "7b4fcd7f-d775-431a-9a36-f035d89a13e4", "comment": "Malware payload", "value": "2e91efacbc36ef735e5d03e6e5f4e5daaf9e6ef484600b80a3e9b5a744af34f0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258101, "uuid": "f60d63d3-4625-4e9c-98ad-db9ab4b69a37", "comment": "Malware payload", "value": "2432af8aaec7fd89f75cb776ef44bbd62d3aeb86", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258101, "uuid": "1ba405b4-f135-45c9-a24d-d38e9aa0021d", "comment": "Malware payload", "value": "f8a2323d563157b8471b78c8e30550fc527a95c9075c583aa154053290b005a1a0e6b6d2c91f336af19b6bd50c8fe551", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258101, "uuid": "72b9c9cd-ca9f-4446-8d9f-358a9e7fd4f6", "value": "9033F1469218118CCE4BE1EB30B7FAD8E6DD6A530EA9B0D09B7D2745C5A30F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258101, "uuid": "568eb60f-0010-40e4-958b-238e110141f3", "value": "1536:02fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAugS7:Ffqhp+g5ru2kmUEt88Azk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258101, "uuid": "dde699d2-d924-470c-aefe-790a344172da", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258101, "uuid": "abf48134-0127-4b7b-ab15-7f357a72c69d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258101, "uuid": "188b2198-ec65-40fd-8361-d335f4c92476", "value": "catalog-2099082655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd38a52-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257935, "uuid": "a7bc6be4-8815-474c-8937-0a1da116a230", "comment": "Malware payload", "value": "40af5c66588e65c8cef18a3c74f6c433", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257935, "uuid": "a51e0af0-9e3e-4593-a9ad-0e5e2cb337a0", "comment": "Malware payload", "value": "2ea809ea1ebe43f09dd093bc46154037e8c303daeb14955a9b6cfbc18004c46f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257935, "uuid": "3a6b8edb-310a-4b9c-a99e-deee96999a2c", "comment": "Malware payload", "value": "08eeca88892937e66a7a2c8fdb97775d3854e623", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257935, "uuid": "d0acb093-4c9b-4947-a28d-d8c9e01ed4f0", "comment": "Malware payload", "value": "3f80939c01b51f4c68b3382985e2ea1a358297f2c087cd0be8f6fbd8afb21012647917457256fa650bcf72a7ce55c621", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257935, "uuid": "2116c44f-8748-4fea-9d7f-d6bb26167702", "value": "0433F1A2E544018DCF4FD2DB20F6F9DCE69D7E530B69A8D0966E1B45C1930F1182E29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257935, "uuid": "94e91fa0-4f20-4db0-8930-d9f6b3315beb", "value": "1536:x2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIqdXDtYp:8fqhp+g5ru2kmUEt88qdXD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257935, "uuid": "fbda769d-cac6-4d4e-89ed-1ba706a4b9f8", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257935, "uuid": "549df44a-43f4-4c4c-8009-77ca1d62cd01", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257935, "uuid": "58e2d085-b74b-4d80-a146-29501155655f", "value": "catalog-1984852838.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de33c3a-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261910, "uuid": "34b4495d-7935-427e-9485-b6fd153b68e0", "comment": "Malware payload", "value": "9705b21c8c092f547c0bb5e18f972205", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261910, "uuid": "48074dc7-748d-47c5-9336-ccab3f19083c", "comment": "Malware payload", "value": "2ec49218ebbfc3ec1cebf9eefd2cf51b6f5f3da0a64d3e976e27a6d468facd66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261910, "uuid": "1815b261-ef55-4663-bb7b-0bc049afc47b", "comment": "Malware payload", "value": "07caf7f9b84b8c46416b140ea192bc30533d1ec0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261910, "uuid": "77260f50-c19c-48c6-927f-e2f1b31ea8b1", "comment": "Malware payload", "value": "ef42340b1e3c0c2879c8171fbab1ae89627e97bef9e5f1f9c90cb3dc0ee6a5a258f4364a1e0b27d401a4bdcecc2a5edc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261910, "uuid": "488b949d-0e61-4f8f-96ef-8087997178bc", "value": "9C33F17187ACD9E668B2E4BFC8C6F904FFF1D4A9C4D78A2246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261910, "uuid": "20d31541-0ce0-4723-9e69-f1885e682fed", "value": "1536:XjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXO4:zB9wzbqtWb08UscYJhnpjyq9qBO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261910, "uuid": "669d2389-6208-41df-97d5-6bd0f2136db5", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261910, "uuid": "c1c73522-28e6-4f73-b37a-37317a49e7b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261910, "uuid": "9ce994b0-0df6-4081-848c-c4f3b1266302", "value": "diagram-870837873.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfa8170-b6ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621213269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213269, "uuid": "e92af718-b23c-4cad-8715-6e145db7a13f", "comment": "Malware payload (Dridex)", "value": "8392bd25f936a116f6832148bb8471b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213269, "uuid": "e8a9ba56-72ce-424f-a187-94071d285151", "comment": "Malware payload (Dridex)", "value": "2ed8960336e33c8456554254d458ea87cf7b9823e3f07bc15bd08d9cdbe3f933", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213269, "uuid": "0216ef91-ebf1-4709-a68c-da904ba1ccce", "comment": "Malware payload (Dridex)", "value": "80625bcebc4c8a6cf6e324c9db3c145794276fa3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621213269, "uuid": "b787cc67-64a0-4130-9bf7-65caaec26e1d", "comment": "Malware payload (Dridex)", "value": "eeb84e3e13c2a1416f63ae1efcfd0c770c902bd47a569651e91d142bf9bf9238de74f0f26f267e518b298e171f1dd46e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213269, "uuid": "d3c868a7-4d04-4dbd-9b55-21f3f6531b7f", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213269, "uuid": "3024e364-2bfb-4206-99ee-e45e9c570106", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213269, "uuid": "cd522489-42e7-478e-86d0-a258a2da426d", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621213269, "uuid": "b8606172-768e-494d-8448-1847463fccd7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621213269, "uuid": "10d76c73-79ba-4434-9ca2-ea7e0a2c824d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621213269, "uuid": "1271aa68-8192-4065-aec1-00c3b15d35ad", "value": "8392bd25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45681b95-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263909, "uuid": "4a25cd1f-cedc-42b9-b67a-754dbf7faa23", "comment": "Malware payload", "value": "e550e6bdb77a2a9e6f386cc3b09cb33b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263909, "uuid": "c2133dd8-b0e5-45bf-a29d-1f9dabc08952", "comment": "Malware payload", "value": "2edda221db0393ae10483f3faf8c5dc9fc66f4aa8f3f6946f42d3e726b4d96bc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263909, "uuid": "2d5a3f73-293b-46ed-b721-eaf2264652b0", "comment": "Malware payload", "value": "42cb4c42380fb2f11332c80b188cc5fc2ffca10b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263909, "uuid": "90e71c8a-324c-4e88-b006-636a34354ac3", "comment": "Malware payload", "value": "3c5b667460e8f7f5a992060285cb7984dd5eceeb17375dbbcceacc52b74bb6dc1db1ae72c5b0b5cb87181d8a571d5099", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263909, "uuid": "1e813902-4dbf-4197-8184-ad07608416ae", "value": "8E3302E49507E0479758BC2DEC9B9D038F3DE91E033E78D2122BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263909, "uuid": "ccaf35ba-c9a2-4a69-b5d3-6bc21a7ab359", "value": "1536:TXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZZ:LXma7774mfCyWMB/4GpWvZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263909, "uuid": "bfb04441-aad1-4985-885d-b39e3fc3748a", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263909, "uuid": "a9f9d97e-60fc-46fb-8688-153f753ab31b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263909, "uuid": "02623b09-671d-4f09-8e3a-fb8ff4a87451", "value": "statistic-349665716.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c3b329-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261029, "uuid": "a39e13b3-dbca-419a-bfc6-1214fccac135", "comment": "Malware payload", "value": "aebb4bc47bd57842987695986f29a6b8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261029, "uuid": "4a1300b9-c5e6-41dc-97c7-a60c67b81072", "comment": "Malware payload", "value": "2f062a8b004cdfe79bf4310d51b4dfdfdda2af82b176d9b5c679b9f9356bcef0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261029, "uuid": "95ecb67e-045c-4702-8efd-2d525eab0672", "comment": "Malware payload", "value": "2d52729167e1732bc229d78e76dc5543ae176a7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261029, "uuid": "b1c7e7aa-ce38-4400-8518-8fff1f8da979", "comment": "Malware payload", "value": "5778d120f5c823a33ebb64d1b62f4ea918702bed0bd82f31f397c1197106eec994903cf42802f59359afdcaf08920d4b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261029, "uuid": "f711bca7-3b4c-42fb-8d5f-875e69f5d28e", "value": "7F33F07247DCCAF66C76E0BF84C2F808FFF28951C887866645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261029, "uuid": "4354bed3-4978-48fd-b0c3-972667dd077c", "value": "1536:VjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wwG:xB9wzbqtWb08UscYJhnpjyq9qEK0wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261029, "uuid": "31ba74c9-2c7e-40c4-8e1b-958c08bd9fb4", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261029, "uuid": "5ad981b4-5ab0-4428-a000-63c19c34c14d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261029, "uuid": "83c51616-28d3-408f-8e89-24cb9484e130", "value": "diagram-267586551.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfc897a-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264671, "uuid": "f5578534-285f-411e-af47-70c4ea0347fb", "comment": "Malware payload", "value": "c3a4c77176749511c128442e91af0dc1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264671, "uuid": "5abbb0e2-39d8-4058-9c1b-206835e8785f", "comment": "Malware payload", "value": "2f0c100188e049d5c8757e20e8c23a30cf5b5a6a0eb693e493e489a0b9a0a33f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264671, "uuid": "76448652-f9e0-4940-9d98-5261f742e239", "comment": "Malware payload", "value": "88c6bdf4e47dbed99231288a4028b0b6b63b7501", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264671, "uuid": "d6477df1-f833-4685-a3c4-22bd832aa82f", "comment": "Malware payload", "value": "b51356b3eb47f120fbe9f90420d9d6677349c593c180f3e94148b13ccf4338554c461a9f5ad16712dab1e1f011da718f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264671, "uuid": "87cd5905-d49f-4083-b6b2-21493935328a", "value": "8B33F2E4A507E047E349B81CDCAE5D038F3DE95E433E7892022BC1975E61AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264671, "uuid": "ddd1cf72-8af1-43fe-bb13-1b10bdea3e6d", "value": "1536:QXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZVq:UXma7774mfCyWMB/4GpWvZVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264671, "uuid": "985384a0-fefe-4372-a317-471351dde8d5", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264671, "uuid": "16f850f0-51aa-454d-80c5-22407e20b48e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264671, "uuid": "560ac51f-397c-4c11-b30a-9a440d22fb74", "value": "statistic-884489353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9a7224-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257797, "uuid": "5f880666-2f34-4af5-849c-2157d8cacd05", "comment": "Malware payload", "value": "be41e3b73dafc31d906178b4858d2afc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257797, "uuid": "59d76620-2a1e-445d-b244-30dae151ba62", "comment": "Malware payload", "value": "2f28f091ffb101c11f2fed21c754710d136082d168e0cbf098f6b81fd9c8a363", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257797, "uuid": "6d7c1f90-873f-470e-ba51-c6254c846392", "comment": "Malware payload", "value": "1c41cda4ab1ac273adbddf8c8aa2519f94e771f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257797, "uuid": "ff603fc3-74ac-4eda-9323-bec64e83a241", "comment": "Malware payload", "value": "8e6f228b0ed09b89160659d805321efe5e4fc1a1be8a2c40fb4efe56460ff3c6180919400aba8a2d6954309adac4fd6c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257797, "uuid": "710f042c-f152-47de-be1e-4beecaca92f5", "value": "B8330296E654214ECE4EE29B30F6E9DCE19E6B430DE7B8C09B2E1705C1570F5082F64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257797, "uuid": "dd828e75-7bc5-4a36-804a-a3a96b7aa249", "value": "1536:92fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIBfa:4fqhp+g5ru2kmUEt88Bfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257797, "uuid": "2e11c7f1-adbb-4567-a4ce-e8532460edbd", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257797, "uuid": "50f0b963-d965-46ec-baf8-d9e12c2a3cc3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257797, "uuid": "238332c1-9db6-4e02-af21-1b2cc941fb9d", "value": "catalog-1884775306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b3b243-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257331, "uuid": "f36d66fb-c867-45ce-996b-cc509a71e6f4", "comment": "Malware payload", "value": "116c522448ea0b21c274982d66cee110", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257331, "uuid": "f6c6f78b-07cd-4644-878c-298cda155e89", "comment": "Malware payload", "value": "2f52a826c7b60a2a139831f92f596c79d07ea26206c2f34368b05e2167e72b48", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257331, "uuid": "9a49769e-1872-424a-9ccd-b2cc6487c949", "comment": "Malware payload", "value": "22e1f4e81f23d6b1189cc939808aa634d0580fd0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257331, "uuid": "e29d1578-4bd5-4d30-9226-3dedaa750e65", "comment": "Malware payload", "value": "67dc71a7251f19bf6e5d8b83987d33ee94119d3741bd76a98e53bf9cc228bc5efc00630e09f97923315c90f13f757ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257331, "uuid": "4901c24a-4e80-4ef4-bca8-74c40196e3c6", "value": "CD33F184D164108DCF4FD2EB70F6FAECE1DE7F43099A68C09A6E2A44D2920E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257331, "uuid": "a87fda3e-a7af-4502-9ce5-80d55c9514cb", "value": "1536:M2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbKy:9fqhp+g5ru2kmUEt88mAbKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257331, "uuid": "13988560-0405-42e9-804f-36e56d9925e5", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257331, "uuid": "aa2f3f27-4337-4823-b8eb-af63d12701e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257331, "uuid": "facf3ae5-1bb0-44bb-a7c5-a3afa5ea9ce7", "value": "catalog-1499859701.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5930b592-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258358, "uuid": "b952876b-ef64-41c0-b141-04eff945ef7e", "comment": "Malware payload", "value": "3acaf2bc9fddc58dec43fc893da00cd0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258358, "uuid": "14e60fac-f7f5-4d5a-8d28-f264d7266d5a", "comment": "Malware payload", "value": "2f542eb084e1697b9bc929a3b19ee22c269c5e66cd691da91d214f797f6fac98", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258358, "uuid": "1185706b-8f24-47df-8d2f-6c70913fe744", "comment": "Malware payload", "value": "ff6e0e08554e263a132808b811468d60769330d5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258358, "uuid": "5d6eb145-0780-4bb2-b9d3-2ba698737c15", "comment": "Malware payload", "value": "ba43f1d258789136b3c153acec18a52d274291a9d314e941d5bb42f6e93d591dcd2a84055c5ae8d4cc692b6658057912", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258358, "uuid": "a33727f7-5ca6-4894-a47b-71b8f72c4f9b", "value": "DD33F2A2E544018DCF4FD2EB20F6F9DCE59E7E130A69A4D0966E2B4581530F1183E39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258358, "uuid": "7c7fa16e-939b-4c5d-88d7-9062f047925c", "value": "1536:32fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIqdXqYg:mfqhp+g5ru2kmUEt88qdXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258358, "uuid": "63e9ffba-74f2-4e9a-aecb-79dfba61e81e", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258358, "uuid": "9e236d58-c3b7-4528-909f-9691d203dc7b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258358, "uuid": "ae59dbd1-3d11-43f9-b659-9da68d8688b6", "value": "catalog-360233010.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3432b93-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261167, "uuid": "a1ff0b11-77b6-495e-b97c-6f5f960e1142", "comment": "Malware payload", "value": "4879128750dbdef938fc6d2e08a5e8d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261167, "uuid": "1c53fb6f-40b4-49e7-88ef-9374eaee8814", "comment": "Malware payload", "value": "2f6989ee523ed4527a67587574508b3b7e3b971fdc029a056029cc91d5965a22", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261167, "uuid": "26bda98d-6714-4042-8cf6-e0e751307040", "comment": "Malware payload", "value": "24f65c9a56c93beeb3473f918e84493cc95f555a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261167, "uuid": "59a627eb-7399-4912-9bfc-1ee1d6442b93", "comment": "Malware payload", "value": "0f083a2937a6ca1749e42bf01826a184c4f901db094591da0fa6497476fb357018a19c8b0f7490d13ebc1430a65ffc49", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261167, "uuid": "71c7f14a-dcb5-4693-9a88-41b7db86e3a8", "value": "E633F13547ECDAB62DB5D0AFC4C6F504FFB1C4A5C8C78A2649F871C8BA912959A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261167, "uuid": "2c9738ea-08d0-4f85-a8b0-cfb38a72287a", "value": "1536:QjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXXIH:QB9wzbqtWb08UscYJhnpjyq9qBXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261167, "uuid": "245030da-9a03-479d-91f6-b6e3bd879ef6", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261167, "uuid": "fa65d403-3001-4c46-8000-82027c31fc8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261167, "uuid": "8a2ebbcc-6bd0-4e94-a971-1eabf1468e18", "value": "diagram-363039699.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d385e82-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261667, "uuid": "a93dc0ee-5060-4888-bc41-38610f242f70", "comment": "Malware payload", "value": "1b180a6d9450d708773ca3a675f26ceb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261667, "uuid": "e2cf308d-8405-4376-b558-a7e88f46529f", "comment": "Malware payload", "value": "2f6f34049ad071f419f5599109d0855730dfb57e36d34cb857a8d337a71ef9cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261667, "uuid": "e51d1c92-a078-4683-a98d-eddeaca09669", "comment": "Malware payload", "value": "2b9c26fe81bba62927e2de6f673a0a7898fa70ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261667, "uuid": "5c7f27e4-c1b7-4a2b-b8a8-5b767ca98f8c", "comment": "Malware payload", "value": "8443e424a4f454e04dacb4d57bc97928582885c5b5df276d5f38051cfde7c627a18a3ae6f296aecc4e3caee6486061e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261667, "uuid": "ec6200cf-c5ca-47bf-9627-6f6a7411464e", "value": "CE3302314BACD9F628B2E0AFC88BF504FFB1C455C4D786264AF871C8B6942559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261667, "uuid": "6d9da1f5-9ddd-4158-9ad7-dbffd77d30cd", "value": "1536:6jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXRf:qB9wzbqtWb08UscYJhnpjyq9qB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261667, "uuid": "ca23d491-8543-4343-aace-1c532ae537bb", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261667, "uuid": "fbd434e2-474a-438a-891d-85f66df92981", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261667, "uuid": "bf454abf-1071-4c06-8ac9-1e5f155eee90", "value": "diagram-706951369.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b6e095-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261174, "uuid": "9917a5b9-c25a-4476-a618-14bf3378fe7c", "comment": "Malware payload", "value": "abe9db55105781356efe2f2f984e4902", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261174, "uuid": "ef33e884-393e-4c7d-818b-c05bea1ab054", "comment": "Malware payload", "value": "2f8bcb9193a64c271c381dcecb8b6bcd32cddf2a7bcc5a1e4748b902215348d2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261174, "uuid": "d02978d5-27fb-48c6-9399-806ce18cf2ce", "comment": "Malware payload", "value": "8e00ffb4bce28005f31b3ff9198e5197d5c52c48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261174, "uuid": "dcd01261-2c9b-4d7e-8249-02e4b5c9d436", "comment": "Malware payload", "value": "bf80126e54ea4950645fe98ac37221458eea21956e212d533c50d64832b4698f588ce92afc33ea3185a9b1a683c8f806", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261174, "uuid": "e3b64675-fd95-490b-9bec-b44da96f0bc9", "value": "6833F07147DCCAF66D76E0BF84C2F808FFF29951C987862649F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261174, "uuid": "3399a675-808e-4a36-8c73-07497921272d", "value": "1536:ljfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wGq:hB9wzbqtWb08UscYJhnpjyq9qEK0w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261174, "uuid": "0fb205f9-f130-49a3-a69c-ab26517b2d25", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261174, "uuid": "626fb6bf-6b43-4ba8-af6c-5107c147d0ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261174, "uuid": "2b6c185f-24ba-4874-9aaa-13ea2d79a0a8", "value": "diagram-366713843.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db27ad3-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264755, "uuid": "e69190e9-fb6c-4dd7-8c78-2c94485db3aa", "comment": "Malware payload", "value": "495a5e78722312f2e8ec96876f33a771", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264755, "uuid": "ea9f5fa6-ecae-4f1d-a247-fe352369bb7d", "comment": "Malware payload", "value": "2face4e6296c530ac1435e82eff01027adb1373dd9b4f9ace92ccdb502092882", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264755, "uuid": "246177bd-7c5d-4081-ad82-1a17654271a5", "comment": "Malware payload", "value": "19dc94400ebab853a9ea12a90d1ffb140d50a674", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264755, "uuid": "f3c73587-9e48-442c-ac99-8b129e77698f", "comment": "Malware payload", "value": "cb90049788688707c357167324f57a57fa9205d2e9bde8368753feb29a79d5ca9ddbd74d11342f7ebf1eb3fd731b3c59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264755, "uuid": "cbba13a1-076b-4296-bd83-8474a4f6197f", "value": "0C3302E49507E0479748BC2DEC9E9D038F3DE91E033E78D2122BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264755, "uuid": "f4904ddc-644e-4d95-b819-b52788094cec", "value": "1536:SXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ8:CXma7774mfCyWMB/4GpWvZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264755, "uuid": "6a3d6e06-85e9-4f87-aa19-8ae3b3bf8abc", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264755, "uuid": "94eed54c-1d25-45a5-bae4-b2c0740c3e29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264755, "uuid": "a3e7e546-2550-4e94-be14-da5266d34922", "value": "statistic-939530420.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71259db-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259858, "uuid": "4eaf18a4-4aaa-4c5a-bd4f-8d00e89bcb69", "comment": "Malware payload", "value": "60d05005466279c1bf14186203e9539f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259858, "uuid": "5dbf6b06-5ef6-4581-851c-a1452ddaa6f7", "comment": "Malware payload", "value": "2ff5b4b472487eadfcc222788e64a5a434e16790f4cc7147e2c681ab1b6582bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259858, "uuid": "71f6bffe-0511-4e95-b7d2-8feaf268295e", "comment": "Malware payload", "value": "aa0c17b3c8467d836f46a2d819c1e0cde100d4ef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259858, "uuid": "5d40f8dd-a9a9-498b-9a3d-f4b316496ce4", "comment": "Malware payload", "value": "e7782b7bd65695cf1dbcab5af7144fdc26bec087c17c9abdb3fc85a704495447de1b1b74c7a070e6a934849a40df5342", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259858, "uuid": "c7a7b984-f895-4f8a-96c1-610521da1023", "value": "6F33F1711BACDAA62DB1E47FC586F900FFF2C4A8D5EA861645F870C8B6D42558E31E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259858, "uuid": "59448272-54b1-4a7a-83d6-c21145b9fa29", "value": "1536:PjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67CD:rB9wzbqtWb08UscYJhnpjyq9qawe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259858, "uuid": "4ca0e698-e2c8-4ad4-8173-01e89c8ad3b6", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259858, "uuid": "017b190f-6503-404b-9354-25ee3afdc9a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259858, "uuid": "d04ebc33-6f8c-4093-8944-a7d502a67ed7", "value": "diagram-1407845556.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77d6cef-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258114, "uuid": "3bb80dd1-0cdb-4636-a027-f3e61a220b40", "comment": "Malware payload", "value": "b9c36fdcc43c3b05a4a5c076b3fa517b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258114, "uuid": "6a6da1b0-8bb2-4fc9-b6d6-51e31c75c532", "comment": "Malware payload", "value": "30084475a46cbdfe2609aa9792e286db124fc7dc2833105f499766191d7d52fd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258114, "uuid": "a62a27a0-6304-4554-8e4f-e581be61ed60", "comment": "Malware payload", "value": "7aa8f386c2c7a083bf508b94aaab80261557fa6a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258114, "uuid": "4c6bf5dd-4a89-49b7-8c53-0514354c84cb", "comment": "Malware payload", "value": "f93e46923cd3daa87e3cc0e7a6d34616a9bcf81be3d16811932e7e29af891cfdc68425475647eabe1eb01a09ca3cb0d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258114, "uuid": "eac6ac3e-26b6-4840-b350-738be7328a7f", "value": "CA33F185D664018ECE4BD1EB20F6EAC8E59EBE470A9E74D0977E270586534F04C2A29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258114, "uuid": "0687152f-11bc-4a7b-bc20-8ea2f8a9c490", "value": "1536:o2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI6i4a:Zfqhp+g5ru2kmUEt886u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258114, "uuid": "aa2ecc23-196e-4769-8367-15482efaac71", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258114, "uuid": "dfe73c59-1dd6-49a4-a10d-d0eb33c4425b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258114, "uuid": "e34d1341-74c1-441f-9685-6b59dea1b544", "value": "catalog-2104950786.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45953afd-b6dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621234274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621234274, "uuid": "0b812e45-7478-450d-b0f9-769632a67762", "comment": "Malware payload (Formbook)", "value": "ac8c78de76cc5d0ee1807babc3b5ab98", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621234274, "uuid": "56999a05-55c3-41d0-8097-2c2d833dcd7c", "comment": "Malware payload (Formbook)", "value": "3009ff9d8a1675709ccb395bb2c45fb0046a19389e37f4e20bc672efee49f8cd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621234274, "uuid": "f5840b81-0753-4737-9339-d146d2462d76", "comment": "Malware payload (Formbook)", "value": "00d70500a3d176f89d16845005ff40ce3728f2a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621234274, "uuid": "5f254a72-df22-4ba1-a5ac-ff18727af51b", "comment": "Malware payload (Formbook)", "value": "d1a9cbe6fd4703caf1a14b2f660927577eb3093ab99ad48cd4d7e745ab56799dd648e73b76dd7b7569aed44f8c6c73da", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621234274, "uuid": "f0632cc0-e273-4505-acc1-29c0f1e2a201", "value": "5B34121EB6D5A8EFD08387300B76B3B9D335D29E25BA080387583E6A69714C2DD19AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621234274, "uuid": "f5a13681-c1e5-4f15-86fe-33499a197beb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621234274, "uuid": "1eed1006-f535-4340-ad3d-d10e7cecdebc", "value": "6144:VPB6YtwEs09ZfVZcYRHOUoSDSQJkiqpcq22Lb+D:JLtwkffzcY4UTlOiN1Q+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621234274, "uuid": "6f1d2128-130f-463a-ac31-f8fd43241476", "value": 235551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621234274, "uuid": "83e55ff2-b9e4-45c0-87f7-50c9badf8729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621234274, "uuid": "4637d41a-9fa6-492c-9a70-beced1435403", "value": "Scan0COPY0002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f22b971-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264435, "uuid": "cab2004e-6b38-4273-8a10-dfeb95ac5bfc", "comment": "Malware payload", "value": "fca34d520d71bdae6bfcd9d86107f4dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264435, "uuid": "57575ceb-ae57-462f-ab42-fcacf2aede10", "comment": "Malware payload", "value": "300d4c740c78b4940ed88af51deb56bcd04b0e5c3d1e74a22a6f4a0a64ad6e6a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264435, "uuid": "a740fb27-d032-4662-94d1-c8ee9eed97d8", "comment": "Malware payload", "value": "5b26d2d750c6f010b7e8343c483535f2d194e30a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264435, "uuid": "e91670f9-065d-4bdd-a987-1ee28ea75646", "comment": "Malware payload", "value": "dfe64bd39a538d5404b2483f31ad4468b22e49fec3a02402e909e82fdde1204793d6ddc15c859f7e6db59b0a26db683c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264435, "uuid": "3c4d5215-cf2a-4c14-828b-209e6ab23758", "value": "F73302E49507E0479748BC2DEC6B9D038F3DE91E033E78D2122BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264435, "uuid": "a85b41f2-e2d0-429d-8b13-6712cc08de00", "value": "1536:CdXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZu5:CXma7774mfCyWMB/4GpWvZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264435, "uuid": "46a779d6-8e7c-4177-a146-f3871a0edd80", "value": 52856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264435, "uuid": "7af6db01-9235-464f-aa98-15d1a5c8928c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264435, "uuid": "198298c4-0f1e-4720-99c0-68b12ee9cd8a", "value": "statistic-72077746.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018cd2d0-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263365, "uuid": "3039c88e-276f-42fc-aa6b-5f1951edd1ee", "comment": "Malware payload", "value": "352b87ea18e70da765f88952737ad1fb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263365, "uuid": "3f363ae3-90ef-4d66-96be-383364ca4929", "comment": "Malware payload", "value": "305fd20da9ba3a8608ad5f96319f62dce7ea1c6eddcce386115546ca93a56126", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263365, "uuid": "5456f5b4-d1ce-4ca6-bfbb-8b8e0f34340e", "comment": "Malware payload", "value": "d2131b9cda3787a37fc67a6934e1b2a345e1a931", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263365, "uuid": "f69a3634-bfab-4618-9a08-b708c8a09303", "comment": "Malware payload", "value": "71fac688afe4ef44824ec4537ff7a168b42720cccb7d35ba4c26c3cef3cb8b4ebdb749b520c175ba735d902e771556b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263365, "uuid": "24f37af5-a413-4b33-8c37-95ae87f017d7", "value": "BA33F2D0A905F08BE749BC4CDCAF9D074B3EDD1B463DBC92013AC0871E61AB96746D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263365, "uuid": "03398f8d-3072-4f9a-9083-53dd6c13af72", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1GplItiri:6Xma7774mfCyWMB/4GplZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263365, "uuid": "c6550763-2919-48a6-b0aa-c9e70df281b7", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263365, "uuid": "a6d574df-f839-4352-9465-9eb05cc737ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263365, "uuid": "f95ec8a9-b165-458f-b780-995ae5b582b3", "value": "statistic-1841469438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00fe9c4-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260276, "uuid": "0760856c-1ee9-4659-b2ab-0f9d1665e052", "comment": "Malware payload", "value": "a338f51d8794cfcf625ffd913a4fe694", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260276, "uuid": "59ed2817-c79b-490b-b176-8d1760c0c707", "comment": "Malware payload", "value": "306f61b287a102b0fac81784d0dd11b7ed6227e561655dfa3e6c4bd74b0a4d3a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260276, "uuid": "5a1dcfd0-bbcd-45e6-afcf-7ff432db9794", "comment": "Malware payload", "value": "4c487f2c55c5e2772eab48c8d9ea2c415057cb01", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260276, "uuid": "3f711097-a40c-4dd7-a4f9-d3cb8ae12533", "comment": "Malware payload", "value": "b3179e78a1f91fdd9ce6df15e07cde403123cd836752a7e9434f393adca62614eeee2358fbcb5caf9c8ccdb837cd8872", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260276, "uuid": "17b6604f-2b18-44ea-a687-a934e29f19aa", "value": "A933F13547ECDAB62DB5D4AFC4C6F504FFB1C4A5C8C78A2649FCB1C8BA901959A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260276, "uuid": "5bc3f50c-6cf9-4a72-91f8-309457e200bf", "value": "1536:ZjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXOsG:9B9wzbqtWb08UscYJhnpjyq9qBOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260276, "uuid": "2c452883-e4dc-4826-9f43-5f0863f1894d", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260276, "uuid": "de9f38e0-098e-499e-8025-4774d7f81006", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260276, "uuid": "e637eede-0913-44cc-8b39-8321c9c0a9b1", "value": "diagram-1684985593.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ba3e62-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621260661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260661, "uuid": "8e12c5f9-6150-47d0-90d0-1503935ed715", "comment": "Malware payload (Loki)", "value": "524acaf48bdd42d49c4f6f485468bc67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260661, "uuid": "502dd43d-45f2-48e2-a96f-2ccdb4db18a5", "comment": "Malware payload (Loki)", "value": "30774c7e96ef2ec4ebace6cbc4e484cce33c61b833b84a066741c6a0fb982792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260661, "uuid": "82dac8a4-e927-4aaf-8a38-32426fe1f60c", "comment": "Malware payload (Loki)", "value": "ff42be001f9041fb7ecac4ae5db9a1d346186e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260661, "uuid": "bcfeea8e-82ad-4964-aa08-7cc7eb7d7ef5", "comment": "Malware payload (Loki)", "value": "fcc38148eea1dcb4404c506ef67f09c2102efc04ec1887a6ed638e5a0c07c37cb3f1a29916bd12052700275654ec7c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260661, "uuid": "b9219801-d66f-4d7b-b30a-68266b7ec380", "value": "7C74C01DE2F1D1D7C34D32F47AD9E3B0986FAEA06F02950ABA533A961A3364F9437111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260661, "uuid": "77f0cf4f-953f-493a-a227-ad0e3117a7b8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260661, "uuid": "6171b39b-dbd9-48a9-8cf6-9494621a1ca0", "value": "6144:1PB6gc+PguKE36LkMeXzL+eYxaUhP1phLVdcIVYhAZkv+un71:pPca1KE3PujwU5/hLTqhAZkGun71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260661, "uuid": "d4ab8513-8ee7-4f99-b294-e8e211f4c169", "value": 360838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260661, "uuid": "888a353a-8054-4710-993c-34332ec0c3d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260661, "uuid": "430a5b7f-2a67-4fe4-aedf-e4a83ec5d080", "value": "tuvomaq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107bf548-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264679, "uuid": "b804d268-8a99-40ca-9c93-c802e562def2", "comment": "Malware payload", "value": "e0c363049dab695e1fe290c9328392e1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264679, "uuid": "66d6e9f8-4c4d-423e-a530-94b3047b557b", "comment": "Malware payload", "value": "307e26ca4533ddc6a30aad6843d754fdef795fa5796a54ca2adba4185708715e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264679, "uuid": "377f84b8-715d-44e7-a1ad-d21ce0bcc204", "comment": "Malware payload", "value": "32ac567e7e15e57a968119a203cbe1f18c65a434", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264679, "uuid": "b16d9c2c-edf0-4c65-84d3-0c0c54e8fb1d", "comment": "Malware payload", "value": "a5a43db37768c89ed999faa12410e2e4147aa4dcdfa8c777102601a1fb2bf41a56aec415c9a7a532a729600684d3d10d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264679, "uuid": "471df163-9e20-485b-a823-9bdb65f12a43", "value": "4533F2E4A507E047D749B81CDC6A5D038F3DE91E433E78D2022BC1974E62AB6A245E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264679, "uuid": "4b485bc0-4c9d-4503-8913-29db7f912ec4", "value": "1536:AXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZzp:kXma7774mfCyWMB/4GpWvZzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264679, "uuid": "f5692020-b5df-41cf-ae5c-30e0ab1285ac", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264679, "uuid": "e25be175-14b7-440f-bb3d-ae7a04f873df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264679, "uuid": "5f19ed75-770a-4018-b0f3-4906a101e442", "value": "statistic-887101484.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf720a9f-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261107, "uuid": "6f1061cd-664b-48c3-9e11-48f5d58f3673", "comment": "Malware payload", "value": "fc9e6d8d8272e8cdd46787bfcc5cbc78", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261107, "uuid": "33f5f012-36c0-4580-95ef-3833d9ffe75c", "comment": "Malware payload", "value": "308b5324396b325e6393fd49b42849d40c6965c3359053ac4fca6d4b1962621e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261107, "uuid": "8e1961fc-d1f5-4ef0-8de1-f586a3a99163", "comment": "Malware payload", "value": "7de7d65efd2e743dfcc31f817c4deb0b0cf961d1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261107, "uuid": "b8e7b8ac-84f5-4c22-bb5a-e9f54bd6c68a", "comment": "Malware payload", "value": "e8622459e5623c6d53558513d5e6abe37e5ebe4aae706e2448419fc7aad6123c718e49688f9d131b7709caf56c4553cc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261107, "uuid": "0d6869ef-c2c9-4db8-809d-52f90bb973d7", "value": "3633023547ECD9F629B5E0AFC8C6F604FBB1D495C4D3862649F8B1C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261107, "uuid": "7c9c994c-82ec-44d5-80ed-56b1a8cdf962", "value": "1536:0jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXjt:8B9wzbqtWb08UscYJhnpjyq9qBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261107, "uuid": "5230444f-64b4-46de-8996-847c017ce9dc", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261107, "uuid": "d94f1891-bc03-47da-ae81-c12b9fbd27e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261107, "uuid": "2cea88ed-9f6b-4664-bfa0-43f46521a77d", "value": "diagram-307910495.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99cc05a-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261204, "uuid": "485d69e7-5c5b-4fa3-a01f-1090787416c6", "comment": "Malware payload", "value": "6364eb45eb4b8dfe810cb90a55b7c3d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261204, "uuid": "270a1514-649e-47ba-8f48-d399f09aacc3", "comment": "Malware payload", "value": "30a10f4019bca4200a33e0027f070b0e976e852ee046b58a2d1874e7a7a4993d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261204, "uuid": "5e2b7a6c-ce3b-489c-8910-a3f0673a13f2", "comment": "Malware payload", "value": "f1d6d2c0e1a98bf283b2fe2c2e57740ab5c6846b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261204, "uuid": "3477c640-7d6a-4ec0-9dcc-3cb9c8dc6f69", "comment": "Malware payload", "value": "b26597393c17fefdf16d73fd4833c4850ad9c003bed1e3ac3a50b6a2d514672d0a689c0473d32b2175f584b75af8a2dd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261204, "uuid": "27059804-2f47-4a7f-9531-1e6ecaa7678b", "value": "3F33F1314BACDDF628B2E0AFC88BF904FFB1D455C4D78A664AF871C8B6941459E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261204, "uuid": "f64d5fdf-49de-4c4a-b85f-945eb3adda00", "value": "1536:jjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXlm:XB9wzbqtWb08UscYJhnpjyq9qB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261204, "uuid": "80de79f0-26c4-4e59-b1ca-06432f873d70", "value": 52849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261204, "uuid": "45c22a1f-2d75-482d-b340-9a9bc421b6da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261204, "uuid": "c47d4de0-eba1-41e1-81e1-0a5295b35bf7", "value": "diagram-40173230.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f1985c-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264505, "uuid": "78cd2e2e-d781-4111-8a08-6e9cab8057c7", "comment": "Malware payload", "value": "7520f529db81e81bb2aef5b1b11ad5bf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264505, "uuid": "437dd9bc-af54-4d24-9df3-3c49af2faf10", "comment": "Malware payload", "value": "30a6e3b9041666a3f2645deec23a976faac88d09f857aca0b07e106086ab9750", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264505, "uuid": "c795ba44-5987-42fd-a7b8-424247ddc7c5", "comment": "Malware payload", "value": "cddf5a6da9cc680e8b37b5f4eed14b767b5b8f26", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264505, "uuid": "fd0a936d-4bee-4dbe-a3f7-33b33a93ab11", "comment": "Malware payload", "value": "45ce4d19c69a0755a6f2533abf12ab5a7c19ce3a8f4c1707de1fef2497da5c1c8971243832ece528ef8b976491c01e97", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264505, "uuid": "000f8161-8560-443d-a8df-b7cb40b9ffd3", "value": "E13302E49507E0479748BC2DEC5B9D438F3CEA1E033E78D2122BC1975E61AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264505, "uuid": "7ce8f7ae-1353-4bea-a886-e3c55c94dcd3", "value": "1536:DXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZC:bXma7774mfCyWMB/4GpWvZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264505, "uuid": "7f0b0e03-edb7-4b61-8e02-0fe74fda8207", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264505, "uuid": "6e3c6ebe-262e-4870-9f11-9e8438b5fed5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264505, "uuid": "b1b4a9b9-58c4-42fd-aed2-27b1d5406014", "value": "statistic-775838349.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7bf964-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257102, "uuid": "22747a74-c1d0-4e96-8c56-5efb10ec3db0", "comment": "Malware payload", "value": "ba2e0b65d2f163f0ea295260b2f1f6a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257102, "uuid": "cfd5be00-b8df-4036-8ce8-b5998e0b909d", "comment": "Malware payload", "value": "30c2e912b8df69895c9dc6a44d8523fb71f1ad13a0290ee880d7cbd7f6818496", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257102, "uuid": "db131f72-2e27-47b0-a747-4cb254c72ea1", "comment": "Malware payload", "value": "76eb6b1936ac3e71aca0fe15ad023e81e7c96469", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257102, "uuid": "41828bd1-b0ae-4778-a588-3cf62c798260", "comment": "Malware payload", "value": "f86db94e286269b15b0fcc1e1cd872e588a3f09cc549233c778ea1c954b274dcbd23e31e559c5de7958d80f5f9f32612", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257102, "uuid": "36f70345-74ef-4c02-89a9-5ae179e2daf3", "value": "6C33F146921811CCCE4BE2EB30B6FBD8E6DD6A430EA9B4D09B7D2745C1A30F1492F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257102, "uuid": "02e5321b-a155-4482-86b1-0189d8e3cece", "value": "1536:T2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuCSK:yfqhp+g5ru2kmUEt88ABN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257102, "uuid": "35b8d07f-03e2-43aa-92a4-34ba5c1358c1", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257102, "uuid": "b9553934-8931-46c3-becb-18a2e24ad891", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257102, "uuid": "45242692-e2d8-4a43-a6b8-ed7cea58639d", "value": "catalog-1364566058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c79eafa-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261719, "uuid": "af2b2ff1-c320-488e-9b66-7cf77897c0f9", "comment": "Malware payload", "value": "be431f73ca0a0841af7bfa01e2752493", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261719, "uuid": "4a582a2a-e7b7-4771-bbe7-42600b075828", "comment": "Malware payload", "value": "30f1006fbbfe2458ac7912b4f00b4e17cc784277b8df56f63560de979e9b1df4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261719, "uuid": "1d7e46ae-3d27-46f7-a19b-f647fefe79f1", "comment": "Malware payload", "value": "80f8a5b444224b6a4218a16c27893f876336e254", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261719, "uuid": "b9add629-a9aa-43c4-8675-7c35ee2886e2", "comment": "Malware payload", "value": "89bfd3ab359500fe5add890c085f2305c01018901948d3f49e8e9034520257b6bc1e3424bce4af7dee52e205bbb84d1e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261719, "uuid": "0161640a-9022-47a6-93d9-c4774377e44f", "value": "CA33F13547ACC5F66976D0BFC8CAF604FBB1D495C4D7862249F8B1C8B6D02845E32E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261719, "uuid": "21843cec-0708-47b9-96d7-46c7b9097557", "value": "1536:9jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX74k:ZB9wzbqtWb08UscYJhnpjyq9qBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261719, "uuid": "52281a3c-b3cc-48f9-a7bd-fcd30c78fe26", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261719, "uuid": "50c36454-c471-4d76-9e79-31e205731fcb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261719, "uuid": "20c1e54d-2beb-4f06-a03e-a13bd811a8bd", "value": "diagram-744543499.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c98ed8-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260602, "uuid": "c227b09c-5819-44a7-b1ea-e0acc55a2cda", "comment": "Malware payload", "value": "2f1427ad7f2e8ee9d9522b808d1d8f4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260602, "uuid": "5ac03f99-eb8e-4c16-82db-5a32d3dbcbf7", "comment": "Malware payload", "value": "30f8acfcf6f62c6398bd038a4a36508376bfb0e641b3f994c275400f617ef899", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260602, "uuid": "09e3434f-4985-4fcf-bb95-30ebde85200c", "comment": "Malware payload", "value": "a475d82b59e4200f96235f33c1b93643fd251634", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260602, "uuid": "3975b88d-883f-406c-811a-955ef0030e4d", "comment": "Malware payload", "value": "35ec05005644dcd429f0801798a3b69c0a5c3cc2ee07b0960639d3409385c2de198b551f7c34914d27ec7d6a624699ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260602, "uuid": "3286dee3-7b7f-4061-8676-810c6407a2bc", "value": "BC3302354BECDAF629B5E0AFC8C6F604FBB1D455C4D3862649F9B1C8B6D01855E32E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260602, "uuid": "238b3353-8984-4e05-810f-502364540164", "value": "1536:fjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX7k:bB9wzbqtWb08UscYJhnpjyq9qBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260602, "uuid": "e8dafe4d-14cc-4105-b20b-3962728333b7", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260602, "uuid": "96be31db-836c-4cc9-b0d7-2ba2fa8fc07b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260602, "uuid": "a22b1619-0abe-4371-a6ad-5917515471c6", "value": "diagram-1917018551.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbf7c11-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261268, "uuid": "791b28c1-e156-4d73-8cf3-de05cc1c77c3", "comment": "Malware payload", "value": "791f4d37a515794db9a120372ce09713", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261268, "uuid": "d458c7b5-9f3a-4fbf-b08a-9e7e0ad54f49", "comment": "Malware payload", "value": "3107620ca2a37e1b8526e91619d500bee2ec8e17003935480cc3467928a5eec3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261268, "uuid": "0351f56d-9d88-4169-b3bd-74f798ee2d22", "comment": "Malware payload", "value": "bcd12506071fec1bc055ae4c3063885e3c30a503", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261268, "uuid": "259e28f3-b734-4882-a9e4-b8b969d4494b", "comment": "Malware payload", "value": "589e5a3030f48c8426a3cc7343427d01b9d12da8a77dd11f3fe85a9cb1f12641b077aebfcf875da2b7d3e9804ae58319", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261268, "uuid": "9b150194-a929-42e1-b554-7479bd180494", "value": "003301314BECCAF62DB6E4AFC8C6F604FBB19455C4D3862249F8B1C8B6D02855E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261268, "uuid": "1204ed16-4886-471c-a21f-9647e7992f72", "value": "1536:WjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXh9:OB9wzbqtWb08UscYJhnpjyq9qBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261268, "uuid": "c56e5c14-cff8-42a8-a58e-15740f18878e", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261268, "uuid": "6e30b562-ca52-4d13-a481-ad4a1e960813", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261268, "uuid": "997b1cc5-95a1-4c28-a447-f464107d859e", "value": "diagram-440507407.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a194ff-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258975, "uuid": "95585416-ca9f-4763-b73f-e5343bcd00d4", "comment": "Malware payload", "value": "27f97ed6e8596f545ce465fb29404878", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258975, "uuid": "3a5e4056-98c7-4118-97bf-3908977bd8b5", "comment": "Malware payload", "value": "310a31a5b9a1cb0d5865668dae8bac13e058bcd420871fc7d1354adaf299ea5f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258975, "uuid": "0935b471-9125-46d7-9f24-1b19a8d8d87b", "comment": "Malware payload", "value": "ce6426b5024b5af6f33d9210589a8b291f539f57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258975, "uuid": "db3a6d81-83e1-4f35-a6ee-fe1060a4be48", "comment": "Malware payload", "value": "dc50f1e728d4e7e8acf10e4ac77f40871482831a098c69696b54dd700ab2000bb3097fb79c4ced1bfaf78ead4a5f1da8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258975, "uuid": "10325259-e354-4d89-a1da-695ef633422a", "value": "2C33F185D65411CDCB4FD1EB30F6F6CCE2DEBA834D9A68D09BAD260590970F0492E68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258975, "uuid": "bcbb31fc-fd52-43d0-b103-0988377545e7", "value": "1536:k2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIn3:Vfqhp+g5ru2kmUEt883", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258975, "uuid": "b24c8c9e-7e4e-4448-b52c-3f1a74861264", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258975, "uuid": "a29e6b63-50c5-4b07-8236-ac4f031b1dfd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258975, "uuid": "7cb8b16f-382d-49c6-aa8a-641e76fdad2e", "value": "catalog-724781109.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1c4750-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264267, "uuid": "158f9016-f0d7-47ba-84b8-776fccec6c94", "comment": "Malware payload", "value": "332073d61c84bdc3561c72cbb7ed4713", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264267, "uuid": "2c1f4fbb-fdba-4104-983c-4a3de81832db", "comment": "Malware payload", "value": "310d168b327ddbb6544a00a428f180658ff76f8e17d15e58d3962e6b841c4157", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264267, "uuid": "8061f5dc-c73b-40c4-a2f6-a3f61d6d40af", "comment": "Malware payload", "value": "3126eb6eb694a623ccc9ab2b8de252a75227534f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264267, "uuid": "b3c37cbe-8fa1-4942-9078-4cd0a037a09d", "comment": "Malware payload", "value": "c1ca3a598b194d0e13e6505c8ff54966e308d9971a46e07b9b8bcb17c171b2ff801cec5da1d5ac874deeecac22eb0c42", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264267, "uuid": "ce1f6411-f2b8-47d0-90b5-34fca688e64c", "value": "EF33F2E09502E047A354FC58DCAB9D038F7DDA5E477D7842027EC0879E72EB5B246D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264267, "uuid": "d1a2f167-e31f-49c5-a98c-f4de82e33fb7", "value": "1536:AXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOu5u:kXma7774mfCyWMB/4GpCOuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264267, "uuid": "e75fe6fc-41fb-470b-ad5a-929b01a05d69", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264267, "uuid": "537044b4-a261-41a0-9802-23914b955fde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264267, "uuid": "7ec4a02d-deb8-46a7-ae84-23e1326bda0a", "value": "statistic-590953659.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aa6665-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259024, "uuid": "bad5216f-9ffd-45b8-afed-969c6e982837", "comment": "Malware payload", "value": "b0ef613fa5fda539f093c1db8f5adc33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259024, "uuid": "01cceeed-866d-45e7-a61d-4863fdd609d6", "comment": "Malware payload", "value": "311d372f20ced69470176359ef69f48ff21d7683f9563f4d39d96a59f1217b81", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259024, "uuid": "fad788be-9875-43d1-9ea1-a4a9412e4235", "comment": "Malware payload", "value": "9699fd7d74261ef131468b0f658fb8eacf891485", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259024, "uuid": "3e578bcb-9cc8-455b-b9c6-2ca9b9579634", "comment": "Malware payload", "value": "40f7022de831a9c3ff51f3143ab3166624b2a792f63cbedbd793cb58a1771b8570b2f74249eb7cd32767f9440258938d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259024, "uuid": "45baeb16-32db-44af-a675-7250b8ced5f9", "value": "0833F14692181288CE4BE1EB30F6FAD8E6DD6A430EA9B4D09B7D2745C1A31F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259024, "uuid": "528a9364-e08e-4904-84bd-28677d989c9f", "value": "1536:T2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAudSC:yfqhp+g5ru2kmUEt88AaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259024, "uuid": "3263ab7d-af22-48dc-acdd-4d65a2ad0af6", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259024, "uuid": "98f1ae3d-6ad9-4889-a6c7-99a0386619b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259024, "uuid": "19d17216-f7d9-4c5d-8db5-ae8b4cd355e6", "value": "catalog-75942695.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4056dc-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261536, "uuid": "fe29b13a-2814-4716-a594-3eb950590e96", "comment": "Malware payload", "value": "d201792b44be91761f473e2e117fc2dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261536, "uuid": "1839e757-bba4-45af-89a3-42e3b37f4320", "comment": "Malware payload", "value": "31229fa5ce2c2243b7684415bec5a0c9957b2b66a729499c0742aa5a9d049f3b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261536, "uuid": "a3f4bf23-7008-4ea6-9318-94dcc1e93818", "comment": "Malware payload", "value": "75e648776fbebf73af12c9469945b12c1b8248de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261536, "uuid": "e8d44233-96b6-4611-b625-fcf790e8d7e4", "comment": "Malware payload", "value": "012c1633cb6ed197ee100ee1f53decfcc1389b3f0c8f8e0ce14f64d7be7b394ddd95918e3320e1b10895e7feb687f390", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261536, "uuid": "6df4e22a-31c1-43a2-8b22-97006ed9ed05", "value": "5B33F1314BACD9B62C72E0AFC8CBF504FAB1C495C5DB8A664AF871C8B6941555A32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261536, "uuid": "8acf1a80-2e00-4254-ac05-2f63b8831c42", "value": "1536:8jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXHW:EB9wzbqtWb08UscYJhnpjyq9qB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261536, "uuid": "b413afcb-3012-48df-b036-7b6a4889bc8b", "value": 52850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261536, "uuid": "69540d43-6b07-400d-9481-f6836fe868eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261536, "uuid": "5dd24661-4da9-4e46-896d-4243b25c54ac", "value": "diagram-61163865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39659398-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263888, "uuid": "77ea5118-fdb6-4c79-af47-bdcb61472d4d", "comment": "Malware payload", "value": "72298e8288b1f9df12cc1a4c3051e480", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263888, "uuid": "4351d034-f783-4d8c-9be1-4f8bc919ee58", "comment": "Malware payload", "value": "312c8deca6b32a1bf1777fc16cbd37b4a86b2640b931ba70a2fdb2208f0de74e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263888, "uuid": "76dc413f-7fda-43e3-b214-4dbfbafb4339", "comment": "Malware payload", "value": "92138a1b277360da6d4b3fc6ed70afc5d26a878b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263888, "uuid": "cda3228a-472a-4d7f-86ee-48ced8ce7eed", "comment": "Malware payload", "value": "875eeb5cffb000076cfa70aec2c54136e03e6d596eefafca88b9b825844017e3e5d9305dd33f56b23281d7979e79029d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263888, "uuid": "ddea881a-93b0-4df9-aa94-36143341b52e", "value": "B23302A0A906E087A759B81DDC7A6D038F3DE90E473D6C53013AD0874E629FC7645E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263888, "uuid": "db924cd3-9abb-4c8c-b6a9-dd0db04532b7", "value": "1536:xXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qzxc:VXma7774mfCyWMB/4Gp07cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263888, "uuid": "b1999c06-4425-4fbe-85f4-5690ab833cd1", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263888, "uuid": "76bd63cb-56dd-4331-8902-ed1c0219e066", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263888, "uuid": "92561372-5793-44e8-b53d-f6c401394f1c", "value": "statistic-331889286.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9a39cf-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264624, "uuid": "2b585abf-7f9f-4d54-be23-356905a6ea66", "comment": "Malware payload", "value": "50b9307beaae11706e038a98c2bd0df0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264624, "uuid": "eda37292-43eb-4ea8-9de1-bf7a77244bd7", "comment": "Malware payload", "value": "31303aa3593134c1277f572db30b73a7950a074b134064a58729cee74ca79f71", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264624, "uuid": "aa462942-55d8-44a6-814e-d26e61e0c5d0", "comment": "Malware payload", "value": "c1f15d568fdf6dc2cc698206c44aad2d0ed6de82", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264624, "uuid": "0da45cd4-6497-4f54-8c6a-3209432dbdc6", "comment": "Malware payload", "value": "c159e70c45c98028b8f1b05b626d0ab999c052a7d612e66a11d78fa1e2142d46f8beef98c6a8df981239777d1a4b09a5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264624, "uuid": "3396f130-7a3b-4648-9c42-5c00da7fea26", "value": "7233F1D09906F08B9B45BC18ECBB9E038F39DD19427D7882117ED0C75EA1AB4A749E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264624, "uuid": "cea75516-430b-4be1-9a1e-fab29fb52156", "value": "1536:MXXtg3K7774iXfEz5lnm/hQMOEYus1GpyuOL:oXma7774mfCyWMB/4Gp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264624, "uuid": "c3a91ef6-e7e7-4642-abcc-1ea0b47ba373", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264624, "uuid": "cd4749de-882d-462a-a693-d6b87af76bd6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264624, "uuid": "eebfd76a-617c-4b54-a4d3-0c1f7cd80333", "value": "statistic-863760519.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9376b3-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260241, "uuid": "0d7a95a6-5e21-44fe-a58b-3dd6aa8cb2e2", "comment": "Malware payload", "value": "dc8dc56ae6a5518d86ca9684a9c7e561", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260241, "uuid": "70c85ffc-3951-4c71-999d-c894f88ae42a", "comment": "Malware payload", "value": "3143ee2c7df906ba84e7fdbfe991b1090a9a94c0190b46caced31a6c434fb384", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260241, "uuid": "2b6cd0d1-ea49-4d26-b973-87009f865db2", "comment": "Malware payload", "value": "857156f8c1dd066b6ad5f2e62ab89a464fe38e7f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260241, "uuid": "2cba46be-41b2-4ef0-9b43-288c8edaba0f", "comment": "Malware payload", "value": "22e4401c3ed8d79a66676c139571a6c3220d6e479a38b51c56bc3c1a3a243ab39c47e9fc661c3fc7abe6afb0aa78d99e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260241, "uuid": "057460fd-8e06-4610-a3dd-827088d4fa58", "value": "1133F17147BCD9F628B2E4BFC8C6F904FBB1D499C4D78A2246F871C9B6D01544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260241, "uuid": "080d1c6c-012a-4274-bb51-41685472a085", "value": "1536:5jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXyX:dB9wzbqtWb08UscYJhnpjyq9qByX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260241, "uuid": "70be80f8-f437-43f2-a1a4-2d566740f060", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260241, "uuid": "2586686a-0567-49b8-b720-728986c9ed0d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260241, "uuid": "57bb07ab-ec69-45bb-9dbd-68a39812e3b5", "value": "diagram-1657424194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e123d4-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263617, "uuid": "1248ecd6-3bed-4654-aa8a-d98db5b51b3e", "comment": "Malware payload", "value": "c9a8b7e1ff643cff37880f3260859974", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263617, "uuid": "e8ca80a2-4f88-4a5e-9cc3-635ec9d2db17", "comment": "Malware payload", "value": "31443f20a5368e11c35f04807225345b4a0e9ec873854c2f8446c53fbc07170a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263617, "uuid": "229839e4-eb66-4983-96a9-2a5a70f1fbd4", "comment": "Malware payload", "value": "e0d3ff63f5179442150ed6efa1929ceba6292230", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263617, "uuid": "379770d1-dfc5-4a1a-b760-52d5d96e4635", "comment": "Malware payload", "value": "ea2a9231d407c780de43c7302269fff67a7ade7b3c0f8753232ec78fe193c17729c02679bdbc2d294b805cfe1c442da6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263617, "uuid": "3a2cf488-398c-49c3-81eb-6f0911db7e8f", "value": "D63302E09902E087A7597C68DC6E6D079F3CED0A473DB853112ED0874EA25F8A745E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263617, "uuid": "0139bde2-8d81-4694-952b-b59a71d11f5d", "value": "1536:TXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qu8:LXma7774mfCyWMB/4Gp07U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263617, "uuid": "d87a22f7-fdf1-430d-9285-b9255b03ed16", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263617, "uuid": "122b01da-bdcf-4650-b7e7-d2fa458916da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263617, "uuid": "73095e65-c033-4763-989c-58849361100c", "value": "statistic-2045760931.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3ea87e-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261692, "uuid": "a8a3dabe-36ce-451c-9a96-7e6c4d7f9a34", "comment": "Malware payload", "value": "84bb195b64abcfcdee458f6ae59b73e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261692, "uuid": "31fdd0be-f47a-4d20-a127-21ea0a0c8518", "comment": "Malware payload", "value": "3152f5d3a086cb7402ce311a63fdfcf8b4b6d66a8e11acdb8739ab4058d20d7a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261692, "uuid": "4168846f-2943-4a3b-b035-bf80e6fe173f", "comment": "Malware payload", "value": "654ed21f831cfe2dedfd96f5194637deadf9b75e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261692, "uuid": "f8ed31c4-b748-45d9-898a-b2c955ee741b", "comment": "Malware payload", "value": "b9c012b016ea0d983d556d6b9c1de5cb88f29ed7440072ed69c1bf971a4d431541a7769b2eb207408670a42980677cac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261692, "uuid": "560de325-aebf-40d6-80ae-75846ca533d3", "value": "ED33F1714BACD9F638B2E0AFC88BF504FFB1D455C4D786264AF871C8B6942959E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261692, "uuid": "a4aac483-6040-4ef2-a824-462917b93c4f", "value": "1536:+jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXVL:2B9wzbqtWb08UscYJhnpjyq9qBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261692, "uuid": "25576f58-21ed-41b3-913b-6e890ed5530e", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261692, "uuid": "486430c5-95f6-44ee-92b9-634ce2f1e578", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261692, "uuid": "9c32f5f8-d07c-4615-a58d-ceeef09d4e81", "value": "diagram-723200056.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71443e0-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262838, "uuid": "041aa5bc-6c62-4225-acab-10971e3cab1f", "comment": "Malware payload", "value": "d9eef9d4aa3b71af3ad05227a1179c58", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262838, "uuid": "f5f9866e-05d4-4b8d-b177-f4c061325735", "comment": "Malware payload", "value": "315cd3e89b6aa1aabc64e7bd13efcd7abd5240324d2ae0172fb8bf7236c235ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262838, "uuid": "cde27764-61b4-4d95-95e5-e39623307e21", "comment": "Malware payload", "value": "acb216f85c59f7a4c8019d264654089bb05cf9c6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262838, "uuid": "c9dd227c-89c4-49c5-bd4a-7cdd3e29f0f6", "comment": "Malware payload", "value": "839bb84c3e78dcb262e374efa5f5280510b45f5b306eb1f73c2bcd223d21c8ea8273d24a19cff2f97b14a5bd398e9cdd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262838, "uuid": "02fcd272-cd55-4946-a07c-c9a246e6a67a", "value": "E033F2E09402E047A354FC58DCABAD038F7DE91E477D7852027EC0879E72EB5B24AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262838, "uuid": "c0a22352-ff6f-4c01-a4d5-e8002668fbac", "value": "1536:2XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOW5c:eXma7774mfCyWMB/4GpCOWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262838, "uuid": "1698183e-4f7f-488a-94b2-c61add8198f6", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262838, "uuid": "024a0f2c-92a0-4392-b3d9-26e5749b2ac0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262838, "uuid": "b0d2b9a6-c053-48fa-93b9-c15432d7e469", "value": "statistic-1448783442.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05d2485-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257189, "uuid": "244a7904-a320-44c1-a497-548fc2c36c6d", "comment": "Malware payload", "value": "000f1338a910395925c4abc1571ec02a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257189, "uuid": "2888d460-40b5-49a3-97c5-b39304b3fb34", "comment": "Malware payload", "value": "316b4852727aa8b960257fec27c795bf5de8cb0e351520763958a035d8fb8407", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257189, "uuid": "7f8c42c6-c37f-4e07-bfd0-49b13e959455", "comment": "Malware payload", "value": "65119cbe5ca0bb036d272dd0df9955349b2ab849", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257189, "uuid": "9c473bab-7bdd-40ae-9e05-a40bf49d2830", "comment": "Malware payload", "value": "6aa073f23ae6f70967ff2a75c010978d214ea785889e12ba6e46e42f4fdb5af781a000e46e39729a719cbb19deb4380e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257189, "uuid": "46b60ebe-cf6a-43e1-b6cb-339e6a846391", "value": "4D33F196E755018DCF8FE1EB24FAA9DCE19EBE03099A74D0DA6E1A0581930E0182E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257189, "uuid": "60370087-8cd3-4a99-b1e0-62ab9756df77", "value": "1536:v2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIfJoh:efqhp+g5ru2kmUEt88fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257189, "uuid": "dc4aab54-6e85-42e9-8d60-7a632f5f8941", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257189, "uuid": "e9b5ec38-21ed-4f41-a61a-2e374e11304b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257189, "uuid": "04ed16aa-c007-4511-979e-69318c5a1077", "value": "catalog-1409846263.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dff1de-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259744, "uuid": "5e120ba7-887f-4376-a300-a0f583ccbdca", "comment": "Malware payload", "value": "7b0b8a56e9ae661a948f829fc7805792", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259744, "uuid": "032c5b15-63e1-4557-83c8-36cdc6ded9b0", "comment": "Malware payload", "value": "3182880c5845a643de6e0e88ab4d98a095d10c54a5a4af262c87b379d6a741db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259744, "uuid": "1c889ab4-02c6-4a90-9e3c-aa2fe6412794", "comment": "Malware payload", "value": "a5d9cc3195ddb6cc2780749f073496ef643c769c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259744, "uuid": "49af32ae-1891-4f5a-a7e7-20fe30f4cbc8", "comment": "Malware payload", "value": "d0562d9d96b06d2345dddf3a1a4ca9e9b07ad0b1b2dba599875339e1fe525f1121e9ca7ef70b8821d7051acdca1ff878", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259744, "uuid": "35522ede-d614-4547-82a3-2fe7b8f89d82", "value": "0333F2714BACDAF628B2E4AFC88BF904FFB1D495C4D78A2649F871C8B6941455E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259744, "uuid": "fad5db89-c2a1-409c-a92c-8dd2b29ce586", "value": "1536:ZjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX3y:9B9wzbqtWb08UscYJhnpjyq9qBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259744, "uuid": "5146527e-b291-4f58-8020-74a8f22d4fa0", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259744, "uuid": "0b21ae6d-5539-4ba7-895e-437b47c9f259", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259744, "uuid": "ede01e54-c775-4510-86b1-37cdcd3837b1", "value": "diagram-1293729375.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c638900-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262659, "uuid": "249e9dc1-6e99-49d3-9b59-6769f8f68e27", "comment": "Malware payload", "value": "5d469d3fe6aa0acc954cbe4e06927f4e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262659, "uuid": "41fbeaae-d47d-48ae-97f3-1858bc15d68d", "comment": "Malware payload", "value": "319052906029ed95eb654f94e5f15376f518ac68e6a10eca67fd73780736f960", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262659, "uuid": "6ccf44d1-b46d-4846-b3bd-0f37c3348605", "comment": "Malware payload", "value": "aa09a6addf886f3df3d9d6fec1d3905499495ad7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262659, "uuid": "81d6494a-2505-439e-aadf-4d2651b50200", "comment": "Malware payload", "value": "b7cfd3fa623714dc9fb82b5ac05cdb6a26eefb2a571c36c1e79eae6ae11ae1d4608fbd0f9bea289a31b7f05f454d1ade", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262659, "uuid": "fed07d36-d43f-49c5-abdb-5de52e9d133b", "value": "F233F1D0A502B08B9758B85CDCAF9D134F3DDD5E433DB892413AC0C64D62AB5A709E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262659, "uuid": "995479de-e109-476a-b2a1-8359dbe4dc78", "value": "1536:BXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVNz:FXma7774mfCyWMB/4Gpurz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262659, "uuid": "2bd4ddaf-b6d1-4d74-8cd9-3e591c82e6bc", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262659, "uuid": "d666efb3-4c07-4d28-936a-ea231db6d231", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262659, "uuid": "bb98f633-57e0-4e89-b58d-6239e1d66bbf", "value": "statistic-1324928403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479c7ade-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264342, "uuid": "c05c3363-e2ea-4f83-a650-09103e463b97", "comment": "Malware payload", "value": "cf74dc67433cd5607639b8237ad8396d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264342, "uuid": "d8fc0328-1554-4811-b02a-b9a03cdb1769", "comment": "Malware payload", "value": "31984ed7fb4cb98d77caea70f0f58f9ebefe38f34cdf50edfd68e6e1d1167ad9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264342, "uuid": "b9395d6f-9e48-4d15-9190-8ea8e5e27cc2", "comment": "Malware payload", "value": "3dde7167360690f7105a041e99d93d1883b9406a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264342, "uuid": "c8cc8167-33bc-41c8-9fb6-89b40dae2d36", "comment": "Malware payload", "value": "b752c8133a75397fef2b191acf452677b5fdaddf1694df4566b479d61384ed56cfa7d63563983263527477aa940ff00b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264342, "uuid": "8ccd36aa-7406-4fd2-a591-834aeb4882a7", "value": "D93301A0A906E087A759B81DDC7A6D038F3DE90E473D6C53113AE0874E729FC7645E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264342, "uuid": "f6358e77-81fb-4350-ac78-7bdbcfbb46ed", "value": "1536:fXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qdx6:fXma7774mfCyWMB/4Gp07qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264342, "uuid": "37e1e944-c68d-41af-8e71-97b557ac86bb", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264342, "uuid": "592c9e2c-063f-495e-98ce-9ebe67969a17", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264342, "uuid": "ca8e355d-35ad-438c-bc11-1c1f78c91adc", "value": "statistic-653135919.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb54e61-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260376, "uuid": "31d74941-4209-4d68-b8a8-163d53dfe093", "comment": "Malware payload", "value": "b72f82a3e7de245a5f32b93c80abe462", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260376, "uuid": "e114bc35-b4aa-4090-a527-0389e0d8e855", "comment": "Malware payload", "value": "31aff3f4a54cb1863dcdfd29f7e81f9528cb475463bb6e58b5d2d765976e4f65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260376, "uuid": "343831dc-531f-43bb-acd6-53f234e8fe50", "comment": "Malware payload", "value": "79cbf27e5ee2ec55a970b856b9e73083661da1b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260376, "uuid": "c1a1e1fb-4d31-4769-9157-79dd7841083b", "comment": "Malware payload", "value": "d8188587974ba6d5211c1f3abb69ac109ab608abc8349b6fab106cf414d4d66fdd3f67e86380b46281fe2fb9aeb4ef6a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260376, "uuid": "97cd5c6f-37db-4f34-8e41-15793751a719", "value": "0F33023547ECCAF629B6E0AFC8C6F604FBB19455C4D3872649F8B2C8B6D01855E32E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260376, "uuid": "85ae952c-d813-4d73-b672-dc490aeadf1b", "value": "1536:mjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXq/:+B9wzbqtWb08UscYJhnpjyq9qBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260376, "uuid": "5ddfff8a-6c99-404c-b700-a1a11cc3b008", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260376, "uuid": "4643ef34-5dd8-4f75-b8eb-d3934ab061db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260376, "uuid": "510388b8-79fe-4d7a-b8a3-8ae8f30858ba", "value": "diagram-1729624654.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fcadd0-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264287, "uuid": "59f1a375-9e59-4478-80cf-10f33ecf6543", "comment": "Malware payload", "value": "0b4b1097d45a8fd3695ec7b2ff392c1a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264287, "uuid": "d6f3dc7e-1eee-4ddc-ab57-e55719dad474", "comment": "Malware payload", "value": "31b18e0da48c35e477cdcbf4b4113be9e9006e56678f53f356be4bc29e4a680a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264287, "uuid": "8219ce42-8186-4505-8d17-6dd0b08c0809", "comment": "Malware payload", "value": "5e295cd9955fa83d58a16db7c91cc41bface10b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264287, "uuid": "53d5ecae-e172-4fc0-aa6a-f4e468d8e21c", "comment": "Malware payload", "value": "30cd10f76f9c35054598f65b04e35cea98e2f8ac230d26cb6f75fde68e271e3932f7f187d36f63b58ee2ccea596a705b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264287, "uuid": "e6e10954-41d6-4988-8dbc-3926a6d09f53", "value": "4633F2E4A507E047A749BC5CDC6A5D038F3DE92E433D78D2022BC0D74E61AB6A145E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264287, "uuid": "3c6b968c-b697-4c79-8df7-6991b70f4818", "value": "1536:OXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZxx:mXma7774mfCyWMB/4GpWvZxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264287, "uuid": "d8198894-4ec1-41bc-b57a-6d170eae2802", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264287, "uuid": "c304ab25-d273-4876-a61f-e1521b20a29a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264287, "uuid": "970d404e-8cbf-4964-b015-5c9a00fa3670", "value": "statistic-604926343.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a33d0bd-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262950, "uuid": "699860ee-c1b3-4f60-9920-7deddb3e8066", "comment": "Malware payload", "value": "456dbf70bf0017419fb3dc5ae2fef2a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262950, "uuid": "a875adf6-9ab0-46aa-a664-dcad57a383b7", "comment": "Malware payload", "value": "31be84ec502d19ab81a8082dfc3cf709238288f18fdf4a4e6e62595352ca984f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262950, "uuid": "aa689f99-0a21-494e-a1bf-bd82f56c5a63", "comment": "Malware payload", "value": "77a4a863bd503ab2420dbdd09670186cf92bc4ae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262950, "uuid": "55079e70-086a-4cfe-a938-b6afe07ed3d3", "comment": "Malware payload", "value": "acaf89b5a9a6675d1c8aef31c4dd1b67a1d21c99e3bb849758908abb2cd446c332a9e6210e0bc6c939a0347474bdc430", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262950, "uuid": "299873f5-176b-4f9c-878b-7d56c38b3782", "value": "B9330290A801F08BA359BC5CDCFE5E034F7DDD5A037E78920136C0475E52AB56746D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262950, "uuid": "6f9fad4f-9db1-4037-aebf-e7c05154e385", "value": "1536:+XXtg3K7774iXfEz5lnm/hQMOEYus1Gpnw:2Xma7774mfCyWMB/4Gpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262950, "uuid": "7e716cc5-6c5f-4e6d-81ac-f46c97543554", "value": 52859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262950, "uuid": "9182d934-a313-434e-ba96-c1891c989fbc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262950, "uuid": "0996a14f-fa7e-4744-91c5-5310b96b70ae", "value": "statistic-1517818265.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4c4635-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261343, "uuid": "630a9b2d-8db2-41e3-b81b-bda20de973fc", "comment": "Malware payload", "value": "4e458a2943dcc29d50c31857e434c9c6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261343, "uuid": "8a230afb-3d5f-4daa-b987-fae631d3db09", "comment": "Malware payload", "value": "31c6d5a2ddd95ed4f4c11470e359186d1481022113da63dd9546f5d2e3ed3ad6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261343, "uuid": "935bcbc2-0b28-4f69-bbfe-b4790e73b4e4", "comment": "Malware payload", "value": "de3c586a64f3d4baa9c065dab8d2bc0e72ba1d58", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261343, "uuid": "6dd428d5-949b-47bd-9103-5e5909e0abb0", "comment": "Malware payload", "value": "aec70263f50ccc96ec9bba8ed05c9d94ccb890eae2cfd0901061c6efc9fbaf56c40fff2ac977cc2fe202971df67695d9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261343, "uuid": "0aac4a42-5af5-46e5-bd71-682023fa1682", "value": "6533F17147DCCAA76C32E0BFC4C6F845BFF29466C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261343, "uuid": "f7b699f0-3707-41b5-ba03-7d1c65881b14", "value": "1536:zjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wI:HB9wzbqtWb08UscYJhnpjyq9qEK0wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261343, "uuid": "6828dbe5-abaa-4cdd-ac1a-8a5a4b0decee", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261343, "uuid": "5d8c014f-3554-47c2-bf17-8b961c8390e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261343, "uuid": "7cd58134-b399-4211-947a-cfde8cad578d", "value": "diagram-47748763.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec226ebc-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261182, "uuid": "d1e6d000-718c-4190-a534-cfa2124a3f01", "comment": "Malware payload", "value": "d117d91b0483e625b743e138dff419ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261182, "uuid": "f58714c5-9dec-4ce2-831f-d4d1ae71288d", "comment": "Malware payload", "value": "3202e96a2396ffbf02b0645789ed7abd0f444ff9db5726220b19da70fe7419dc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261182, "uuid": "330af676-b217-4102-8dd2-174b5d72fda6", "comment": "Malware payload", "value": "cb206875946d7761a4a525f37638e53964d5cc32", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261182, "uuid": "d86afdb0-ac53-4a72-b64b-ad818188764e", "comment": "Malware payload", "value": "ecb3b59ebfb7055c164a765b8dec255a8caffd3041aff3887ba6f44503800e3ced7f6976431957cfe55a77f0c806c3cc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261182, "uuid": "897bb60e-f8c0-463e-a817-59e520c91c2d", "value": "5533F2314BACD9F628B2E4AFC88BF504FFF1D495C4D78A2649F8B1C8B6941559E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261182, "uuid": "102c3da7-1c4d-4bd5-ac20-02e7e37fa793", "value": "1536:tjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXgK:pB9wzbqtWb08UscYJhnpjyq9qBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261182, "uuid": "c7e2bb5c-0685-432d-8695-24e79e84753f", "value": 52849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261182, "uuid": "25eee17d-4f22-4a8c-8864-002d13b6f810", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261182, "uuid": "1732e51a-9102-4112-83a3-76c0bec8cbb9", "value": "diagram-37433318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b394ee37-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257222, "uuid": "ebc03f9c-184f-436b-b92a-3f55cd9c3802", "comment": "Malware payload", "value": "66d50452c28bf6ed1a4dbb9424a45659", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257222, "uuid": "e4841821-d5a6-4f8b-a13a-ed3211cc5f01", "comment": "Malware payload", "value": "3204ce8d17e33febde97454b52453c578c17b3748247cdf1c549c987370bd9a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257222, "uuid": "64f28958-8a36-4ef9-9cc0-e17328057ee5", "comment": "Malware payload", "value": "05cff7162de371111d0f37e7aba1a8773376c580", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257222, "uuid": "70ccb208-9df9-46d2-bb8b-f50be1af8aa5", "comment": "Malware payload", "value": "ec0965107e940e23c121c60fd6a1b84eb0490758f818b61d699a8d78228791058b51c3d6b0bcbbe6bcd6d0fcb3c76dbe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257222, "uuid": "9d90d745-14a5-472d-8e92-8e3bc185f04e", "value": "98330186D264218DCF4FD29730F1FACCE5DE7A430EA9B4D0A66D2B0481931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257222, "uuid": "4e673a21-b494-4e62-9e89-9894e86743ca", "value": "1536:W2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ37:7fqhp+g5ru2kmUEt88Ix7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257222, "uuid": "4b779700-0b2e-4f7c-85fd-dbcb76f036b3", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257222, "uuid": "2ec09cb1-4586-43cd-a285-3bdc6ade553f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257222, "uuid": "3739a3b2-eee3-4744-a2e9-ec78bf547df9", "value": "catalog-1430870145.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49045e4-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260632, "uuid": "9019c234-2d4a-44fb-8535-7f8653a9fcbf", "comment": "Malware payload", "value": "67fe3c83b7aedbe4f1bccb2fc1be989f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260632, "uuid": "e05a3ff8-c41a-480e-b5e4-4f55eaf1ff8d", "comment": "Malware payload", "value": "321330553f4d82bb78e857d314dd3ac2315086fae5d9a1e35768dadce93e7f66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260632, "uuid": "a4ce98cb-76e2-41e6-9f3e-37d7e35d94ef", "comment": "Malware payload", "value": "bb1bdf58bf3b63d7973ac513a5436c5923cb133d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260632, "uuid": "dcbd2b38-0746-407d-b55b-526834aa3c02", "comment": "Malware payload", "value": "f6bc9fe2a2ee76e420aad66cf88a2544141c215618ac543369c67fc9220d7c9561fb1d0c9c57d06c1abeb101b036290e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260632, "uuid": "a2bf0409-a448-4f91-a8e9-4edf9d7f6d92", "value": "F83302714BECD9F628B2E4AFC88BF504FFB1D455C4D786264AF871C8B6902459E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260632, "uuid": "539caa1b-4a43-472d-a62f-0cdeb6822039", "value": "1536:HjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXMVy:DB9wzbqtWb08UscYJhnpjyq9qBMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260632, "uuid": "5a61068b-3a66-4df8-aed7-7321b987aefb", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260632, "uuid": "d6586749-596c-4f34-bb16-62f24494de2d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260632, "uuid": "40d54395-3fd4-4f1c-909b-d6764a656e84", "value": "diagram-1941058780.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844a9308-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261867, "uuid": "fc906bc7-1bd5-4649-beb0-9c2865cae079", "comment": "Malware payload", "value": "3a9313da758307f5e7cbad34949ebb0a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261867, "uuid": "6b3e01a5-1686-4edd-a111-f473072519c8", "comment": "Malware payload", "value": "3218e72856000cbb79fef92e0600246654198171645b30f2715b0c144ec29f93", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261867, "uuid": "0f356db2-03d1-45ea-8767-2330b8ecfce4", "comment": "Malware payload", "value": "68ec531c7e7a409b36c56d0ae12a5bebcf9007ba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261867, "uuid": "9f7280fd-47bc-4597-88c3-5b21e5aaa731", "comment": "Malware payload", "value": "3065ec21362d5d2b69958200a4e4b93253478e4b40b81b3381e9e55c6fa4003d61a1c3554f12ee876a0d8846346f58f5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261867, "uuid": "06f71c56-a974-4c8b-a8b6-6b56e5e6bbf4", "value": "5C33F17147DCCAA76C32E1BFC4C6F845BFF29821C897872249F9B1C8B5A52564E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261867, "uuid": "2125527f-2621-47af-95c1-05c663f17297", "value": "1536:ZjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w7:9B9wzbqtWb08UscYJhnpjyq9qEK0w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261867, "uuid": "33e0e0bb-86e6-46b4-a413-3953555a1018", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261867, "uuid": "53bf896c-29c2-405c-8df9-35d7d2bbf012", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261867, "uuid": "b5391cdb-1547-4ef5-a629-5eddf9465a86", "value": "diagram-841186712.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b70653-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261834, "uuid": "0f8d8a13-a26a-4141-9e6f-195219d383c8", "comment": "Malware payload", "value": "1d58b04f9abd484f26b94a423434faef", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261834, "uuid": "8d5829c0-5330-4773-ae3e-719720a42c43", "comment": "Malware payload", "value": "322907e16f4b3e161481c68a9e3f951037335d1bc8fb4a50329f8e21fb3c1493", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261834, "uuid": "7d82dcc0-aaf9-49ae-bc6b-825179c58822", "comment": "Malware payload", "value": "bbaa11d5b4d4331983ae24b8f0be50444299d761", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261834, "uuid": "16703fd4-354d-4ba8-ad06-28f063f79cca", "comment": "Malware payload", "value": "08434f2a7890914d87e73a67d46ec1226cf65ea27854000b3f09ceccbf186df190e8be571a7a0e64117b2c25d0046bc6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261834, "uuid": "a0117f2b-8d85-4ea1-b492-9585efed621d", "value": "0833F1711BACDAA62DB1D47FC0C6F904FFF1C869D89B861689F870C8BAD12559E31E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261834, "uuid": "81e4afe6-2541-42d5-b946-68f15133c0e5", "value": "1536:yjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67xt:CB9wzbqtWb08UscYJhnpjyq9qaw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261834, "uuid": "ca59a650-f1f4-4f60-8200-6b078756da64", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261834, "uuid": "819efb10-2fd9-4821-a495-bbb90d470088", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261834, "uuid": "63925527-bb4c-4c77-9e59-cbc32d96857e", "value": "diagram-824035150.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8bad29-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262845, "uuid": "aa9e16b6-2d81-4470-bca4-745189948178", "comment": "Malware payload", "value": "d43eb36c9136fcae30e17add14f741b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262845, "uuid": "65b8e347-d259-41a0-b64c-3adde51da8d4", "comment": "Malware payload", "value": "323204f06a868b83ad90c19ed61728356dcbc5ab7217f455d2ca8c4909aec4d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262845, "uuid": "23967f50-5e36-45b4-89f7-36f5cc899ad0", "comment": "Malware payload", "value": "771dcd2506c470f7e512c51abab8c6024629964a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262845, "uuid": "c0c3a581-e970-4af5-bc6e-0435a4dea41f", "comment": "Malware payload", "value": "60227a1716e4cb38db467a3b9a47990dd4d125305c34b3a41efb73ffd942332a8ab8110ab13754d88e3ff89185fddb14", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262845, "uuid": "9183d53b-0f6e-478f-a865-8230b777cc45", "value": "8E33F2E09402E047A758FC58DCAB9D038F7DD91E473D7842027EC0879E72E75B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262845, "uuid": "adbc408c-9e86-4cf8-853d-1a2a8e4b9382", "value": "1536:4XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOX5T:sXma7774mfCyWMB/4GpCOXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262845, "uuid": "187c5792-f6a6-400b-ac88-9d79e3281722", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262845, "uuid": "2f4ca620-cabc-45da-b5af-b7bbbb161489", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262845, "uuid": "cd528fcc-b710-4fbc-a483-a8f2187fbcc2", "value": "statistic-1453005769.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d136224a-b721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264143, "uuid": "b8dd1315-5d87-4690-8c73-0d7174257845", "comment": "Malware payload", "value": "353e010bc6f018fa84d78e629863f228", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264143, "uuid": "fa506f22-0cb5-4aff-bcba-0389a2020088", "comment": "Malware payload", "value": "32568f40d3654b47352612f904f150ce48e1f7b125da8dfeec8f6894e009aab8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264143, "uuid": "510da3d1-9eb1-4719-8cfa-22170fecedf2", "comment": "Malware payload", "value": "cf257957256008b98f965018e67948b9ada2b5cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264143, "uuid": "145863f9-ccf1-4569-8b2f-6fb67b6ff06c", "comment": "Malware payload", "value": "f5b5b95b4382c1c35d54c41973160a2995beb3f45f9fbeaaccf56a16eb35aff9f88354d5353c6591a8c4a8e91c99df09", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264143, "uuid": "4eb03fb3-f1af-4e65-a23a-b5ca8abc82bf", "value": "CF33F2E0D801E08BA754FC58DCAB9D038F3DDE59073DB852027EC0D65E62AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264143, "uuid": "91974aa0-a908-43ac-8dd1-8254b65bb656", "value": "1536:PXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOl+:vXma7774mfCyWMB/4GpCOl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264143, "uuid": "e54428c7-bd30-4112-8801-176d1b5e75eb", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264143, "uuid": "96874e3a-e1d9-438d-832d-746f933d6694", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264143, "uuid": "c5847c77-ecf2-4974-9632-8325d324174b", "value": "statistic-522722943.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03e00b1-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262343, "uuid": "7ecbcd5f-53b5-478f-9d41-c32d0b663871", "comment": "Malware payload", "value": "a1bb99015b56cc5b743603cdb45eea02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262343, "uuid": "fd64d1bf-fbf0-4dde-8bc8-3c334b556c24", "comment": "Malware payload", "value": "3278ac555f83dbc19f7e747b8d45ef11a350987e41c3a43b3d0f656b7dcd7d94", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262343, "uuid": "9534869c-2fbf-4033-a8e3-4192bff2fc57", "comment": "Malware payload", "value": "c72a83cf029db880b3621250f60d417f9776cbb1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262343, "uuid": "97ac0579-681d-4044-b845-30db3f12f262", "comment": "Malware payload", "value": "a19c27ec8e50af7b9e309a6a7cc6f7edce0cdf623fa8f3f02c5ee564e0ed1471fc7fd7689dbd7aa1f155c10ad6ff4606", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262343, "uuid": "21e1d6bf-eade-429b-8f3b-0724a429b491", "value": "2A33F2E4A507E0479749B81CEC6E9D038F3DE91E433E78D2022BC1D74E61AB6A645E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262343, "uuid": "ff2833a1-3d75-4bfd-8bf7-89d0dc5ee901", "value": "1536:nXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZ0fX:XXma7774mfCyWMB/4GpWvZ0fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262343, "uuid": "a8ac1149-9c33-4918-bbbd-95ff654d2356", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262343, "uuid": "541da185-b19e-4895-a0c3-e8b7fd415acc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262343, "uuid": "ae3db9ec-ae49-4ed5-a6b1-e661e0cc776c", "value": "statistic-1082229589.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b46fa7-b719-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260371, "uuid": "f1007453-9c7b-4058-a09b-d3272d86b318", "comment": "Malware payload", "value": "e4526a2ad88c912d2fb27f9dcef5ea0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260371, "uuid": "ddf7d28f-0cda-4b30-be2f-fc9cbca30412", "comment": "Malware payload", "value": "32814acd122315d49ccb2342cb7100354f360dd13f1ae72e2d0676929d78d5cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260371, "uuid": "454ce5f3-fac9-4f25-a1d3-8bf4b4422c02", "comment": "Malware payload", "value": "f689d5d0af1806b4d520e4ec6514e8ad4f33bd98", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260371, "uuid": "38573b6a-ea94-4bcc-b7c1-e40ad53c3928", "comment": "Malware payload", "value": "21ebd40924332e26061363f42eae08045ccbd39f16609906e4d726215d87800a06dad78f615f057ea69499116fe3f426", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260371, "uuid": "71e6767b-a3fa-498a-a5e4-44e4c0858f1b", "value": "2733023147ECDAF629B6E0AFC8C6F604FBB1D495C8D3862249F9B1C8B6D01855E32E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260371, "uuid": "cef2e237-ec07-4acb-bd1c-fcc93c554900", "value": "1536:jjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX2x:XB9wzbqtWb08UscYJhnpjyq9qBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260371, "uuid": "5c62bb1e-3eb8-435e-a99f-d8484d8e53ef", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260371, "uuid": "4ccc92c6-93e7-40b2-aa35-27b8aa2b656b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260371, "uuid": "e6e378c4-0e5f-4795-873c-ff844c435c20", "value": "diagram-1727399604.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea549797-b711-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257313, "uuid": "f0c891f9-06e3-4677-bfbb-913c916068b7", "comment": "Malware payload", "value": "9703a1adfa9fee91364ddf6ba2359007", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257313, "uuid": "45035173-a4a1-40d1-8984-cbccbaf77299", "comment": "Malware payload", "value": "32841e3291c69f1bb33837f3ad52d3c2f74ef2441762f344600fe6466d96bab6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257313, "uuid": "76562542-2f82-4574-898e-08048bcbe519", "comment": "Malware payload", "value": "a443aa525003535729339eb32a34b96322ab6b33", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257313, "uuid": "2e352634-6652-42ad-b94f-f2a8764e532a", "comment": "Malware payload", "value": "382c3474ab0f9b991d758ac517cc8875e12b39f49ad979e3506e472c48b5af6f4ccd14d59d0bb4a223b7b6303ea2cb0b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257313, "uuid": "023a704c-0a24-4c73-b4a9-d5e4dff702ff", "value": "CB33F194D164108DCF4FD2EB30F6F9ECE19E7F43099AA8C09B6E2644D2920E54D2F59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257313, "uuid": "690b4ed7-cdc3-4d77-89da-5d835e135d1c", "value": "1536:f2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbNE:ufqhp+g5ru2kmUEt88mAbNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257313, "uuid": "6a33fb6b-cbfb-4e72-b59c-18ea2ee28796", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257313, "uuid": "017715ed-de73-410e-99f7-5601cf518cdc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257313, "uuid": "60231f5c-f985-4c51-ac03-bcf7e399d5e4", "value": "catalog-1492591172.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1157c1-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263247, "uuid": "57a52c55-f01c-4b41-a89e-76d75c7592f0", "comment": "Malware payload", "value": "8d50e9efa0c0f0e8f77b0f4e2d9bc126", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263247, "uuid": "2ab5d9a1-41d1-415d-91c7-7280e926cf96", "comment": "Malware payload", "value": "32ac06b96ca0d0f8cff675e3cb834ed2185c8e849b434c910ee9a343f94b0ca2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263247, "uuid": "3a301a4a-c2ff-41f5-98e9-79b72f37fe40", "comment": "Malware payload", "value": "15c239ccab6b6ee1581d51b02714f97169432126", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263247, "uuid": "abb372be-f49c-4acf-a7b6-3cb3c851c90b", "comment": "Malware payload", "value": "bd2a905e917d1629e5c3657d0d038e59982279a5c6c59105cda484723915065d1b6dfdf67dd857eb378b81e663873ffe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263247, "uuid": "e5501e3d-9ad9-487f-b1c1-9130be4cd1d3", "value": "8833F2E0D801E08BA754FC68DCAB9D038F39DD5E073DB852027EC0D75E62AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263247, "uuid": "d9a4b8b5-6658-465f-af1e-73c8079be900", "value": "1536:YXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOV+:MXma7774mfCyWMB/4GpCOV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263247, "uuid": "06d9d079-118e-4f74-88c6-23aa95848db0", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263247, "uuid": "649c36be-15f3-458d-82f7-1528d6a7a7e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263247, "uuid": "89006d83-c2c5-44ed-afa6-98fc7b95b3d0", "value": "statistic-1770200083.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9186a2-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258903, "uuid": "1f63ed41-4879-4e8b-bc56-68ee277ab296", "comment": "Malware payload", "value": "cd5d504a645cf7fa66290863ebc81265", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258903, "uuid": "d3d91ab5-269d-4b26-aed7-d7aea780e253", "comment": "Malware payload", "value": "32b0d624eb3d6c6c2042d3c6fe9431d9c4bfcf9bb6c893905179a7ebcbe0dd34", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258903, "uuid": "0d07d80d-b7cf-46fc-9b9f-de3ea06124bb", "comment": "Malware payload", "value": "b27f332b83d8aa801d5791337685b2838b2471ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258903, "uuid": "52161fcc-8058-44c9-9e6b-f0b6bb245f05", "comment": "Malware payload", "value": "0a6ad6f120b57ff2298cbae690e85ab25ffdc735f369c2c93457fb562b6c7378244948389899953349e2c5049f4a1686", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258903, "uuid": "c2e2159c-0f77-4e15-8362-8d4695046680", "value": "D033F251D644018DCE4BD3DB30B2F9DCE69EAE034A9C78D09A7D1B0490938F1492F19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258903, "uuid": "8123e09c-9c6e-4611-8082-5bd083621f5a", "value": "1536:u2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jId4Rl:Tfqhp+g5ru2kmUEt88Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258903, "uuid": "da7ea70e-c8f1-4971-9d4d-5d8fd07ba877", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258903, "uuid": "718a7aec-022a-46dd-bcd2-e32590c4cb2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258903, "uuid": "e8388955-af3a-4a50-80bf-4f905cdbce75", "value": "catalog-658100514.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b67fdc-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261601, "uuid": "97ba6818-219b-44c7-bb3d-a55e8962a054", "comment": "Malware payload", "value": "f904db109abd67bbd446387cd79e2a2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261601, "uuid": "c6f70a67-a9d9-41cf-8c5e-a67e789707d3", "comment": "Malware payload", "value": "32b477687b0099e6269fb68755d2bb737e435d09c394a5f3dab1b17d9f5084ff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261601, "uuid": "6ebbacc3-5c03-4680-aecc-61c9bca5e19b", "comment": "Malware payload", "value": "87cdaf855f2c64454f0e8c7a9ec630d90d05054e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261601, "uuid": "3810f589-ae6c-4097-a456-7d53e4b97762", "comment": "Malware payload", "value": "e6763a7552326662a2d4561787479e7ae25ef34429a19cba7cc70072b37bcd65be2ffae2910fa70fbc727e8fc59cb2ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261601, "uuid": "f45f57ff-1f90-4734-ae2f-7b5686598cd6", "value": "7F33E07147DCCAF66D76E0BFC4C2F808EFF28956C987862645F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261601, "uuid": "a11d4d7e-5260-4228-ac2f-295fa3897253", "value": "1536:rjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0w2Q:fB9wzbqtWb08UscYJhnpjyq9qEK0wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261601, "uuid": "e162735d-170d-4e84-925d-06e81aeef576", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261601, "uuid": "57372b08-4859-43ef-bcfc-2f9eec09f87f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261601, "uuid": "a1aedf97-61ad-458b-9bd8-ba6d95d7ad5e", "value": "diagram-660098370.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd95ed8-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262661, "uuid": "83c9555d-9a8e-40b9-bca1-b5171d097a01", "comment": "Malware payload", "value": "be67dcc01ff472791648a76e90b2a1b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262661, "uuid": "b7e616b8-f23b-40d6-9e5c-a00a288882a4", "comment": "Malware payload", "value": "32e5ebd1daa22d092d1565e741613a45aac1b863bcaa0a26ea8adbb07bd45695", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262661, "uuid": "0cf09053-64cc-41fd-bd70-5a8f4a0c6798", "comment": "Malware payload", "value": "ba3dc820e55efd8ed0d524c505d41bc3112f4683", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262661, "uuid": "bcbf8ec7-351a-4af9-a248-0404673d3f2b", "comment": "Malware payload", "value": "0d0747d140e76514b75652f795f303f8bb59674c3bcb31e9595b01d7b12754c13aa5e71a5b1af7f9c763302b1e0b3ff4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262661, "uuid": "179ebd9b-699d-4e7e-932d-231bd8e2e524", "value": "A93302E49507E0479748B82DEC9E9D038F3DE91E033E78D2112BC1975E62AB6A245D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262661, "uuid": "59f52f5e-df60-4573-a4db-6c790bd72a0f", "value": "1536:ZXXtg3K7774iXfEz5lnm/hQMOEYus1GpELvZZ:NXma7774mfCyWMB/4GpWvZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262661, "uuid": "c7a569e7-f20c-44f1-aa51-b15dd0767e3e", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262661, "uuid": "416a7310-4236-4ca6-a4f1-f05f9aaf2b79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262661, "uuid": "b1100d26-0210-4438-ad8f-bf86dea9b355", "value": "statistic-1324953596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86020993-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258004, "uuid": "ffb4ff56-d131-4855-abce-0b55b3237bc1", "comment": "Malware payload", "value": "e2f0d54e32f0a94ec00eadeb3c3a1f51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258004, "uuid": "5ed1f534-fde5-484b-a2ea-2d3f090b6e5a", "comment": "Malware payload", "value": "32e72471a6323dd724819da11fbbf665ac4ce741a6f4e464307fcd9fe3a88662", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258004, "uuid": "cf66b730-b32d-4abc-b4f8-ea833ed6d5c7", "comment": "Malware payload", "value": "293316917315f067b003deb2ad0d9d986d4425cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258004, "uuid": "c6ed7afc-bd97-4257-a846-9b7066b1ba19", "comment": "Malware payload", "value": "1814ca4ec69658b3bca8facfea879743e4e2e5688b8ffba42b00aef9fb238c210c4dad6255781550236e0309af0ca961", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258004, "uuid": "b9ff9ddd-e863-4429-aecc-6fde1692e7be", "value": "4933F155D294018ECF4BD39B20F9A9ECE2CEBE530A5AB4D0667E2B4581530F1482F98F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258004, "uuid": "370aed8f-d530-45de-a33d-8bc1b8f74851", "value": "1536:d2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jILR3:Yfqhp+g5ru2kmUEt88L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258004, "uuid": "d35e352e-bdcc-4797-84da-1001db82abc9", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258004, "uuid": "c869c387-e397-4640-83bd-fbe2846cbcb0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258004, "uuid": "702bade1-5a3c-4d4e-bb5d-3575256603d5", "value": "catalog-2028311770.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8792453-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257686, "uuid": "cb6146ea-f4a0-4cc8-ad05-4880cf13c36e", "comment": "Malware payload", "value": "68ea51e7978606f1a2ccee1d6a0635c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257686, "uuid": "da06e2cb-30b9-4158-9410-4c244a902c11", "comment": "Malware payload", "value": "32ee15631336b538b99c5bcaf14baf09d7db18ec2cc671663671ab4f8e3ca195", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257686, "uuid": "004f810e-a383-4128-8f89-5d4d28da5586", "comment": "Malware payload", "value": "810536af7c7653a6b121b8b019906f7a33ef279d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257686, "uuid": "fef7115a-e271-416d-8034-203b1ec8b268", "comment": "Malware payload", "value": "de14ba213dce7d465fd328681a7ed081e0bebd55b4bfbf88a0387c26e723a97b835c17cbf815db7af843bdae53404385", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257686, "uuid": "97ed6d7e-18bd-45c0-a550-f445fe20c465", "value": "38330186D264218DCE4FD2A730F1FACCF5DE7A830DA9A4D0A63D2B4581931F4492A65F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257686, "uuid": "6559aa5b-86d8-40c3-bd28-5fb589a826b4", "value": "1536:N2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIIJ38:ofqhp+g5ru2kmUEt88Ix8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257686, "uuid": "11b6e3ef-24fa-413e-89c0-0a75110457ee", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257686, "uuid": "a2dcbc2a-4744-4035-824b-942dbf3476b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257686, "uuid": "d86577e2-5b20-4c20-9946-6df0028a5560", "value": "catalog-1790985836.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d32114e-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258821, "uuid": "6e7f91d7-51ac-40fd-a85e-80aa2f31ac55", "comment": "Malware payload", "value": "8bb1e57e5b673db7a1a131ee28856d8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258821, "uuid": "c5fc8a72-ebfc-4ed1-82a9-6c9ff537640b", "comment": "Malware payload", "value": "3332bf14c5081dd8c6985c16a6ea6d060cf15c991456e08c345375145b4a9c5d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258821, "uuid": "3ff37240-afb8-4ca5-8bc7-fa085908d161", "comment": "Malware payload", "value": "87ceab5679b8040e891c1cdb86b7a0c0f0d8331e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258821, "uuid": "a0c13ede-2bf2-426e-bd52-8129d4688571", "comment": "Malware payload", "value": "3f7c167b76dfdd91a2a15793e18f66716745145a168194f979e5ad4c90bbbdfd994b73f5e7c7de4856ba152a9e8bcce0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258821, "uuid": "cbf94a2e-23b8-4646-8f8f-bfbf654c3d08", "value": "2933F195A554114DCF8BE1DB20F6F9DCE6DEAA470E9AF4D0AE2D1B05C0A70F0492E18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258821, "uuid": "a378bc5d-5ba4-4699-adb5-b420d411e755", "value": "1536:x2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIplD:8fqhp+g5ru2kmUEt88plD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258821, "uuid": "f9263299-07b1-4b2b-8656-85e7c4655bca", "value": 52727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258821, "uuid": "a2753146-e219-4e1d-977c-d45dbbc70003", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258821, "uuid": "507f7f4b-1b93-45a5-a137-c54353ca6df2", "value": "catalog-595093719.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b137aee-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259677, "uuid": "833dff57-98ca-4b76-8930-9ce6cdca03f5", "comment": "Malware payload", "value": "ae71b7a7ec3038b550d0137dfcbfb382", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259677, "uuid": "d5282811-2680-434e-a52f-8f1bfeb4fbda", "comment": "Malware payload", "value": "33361cc498a7d52029c60fcc12b8053c77afb429dc13ab69b4e64338dca56704", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259677, "uuid": "23666be7-6eb7-4d3b-be98-9aefeee0bc32", "comment": "Malware payload", "value": "83083e7bf93a26f759197c1b2abc80a3dad0095f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259677, "uuid": "980999a8-5ab7-4026-941d-fd00b21541be", "comment": "Malware payload", "value": "bdd45d28bf8fa12616de0bb15571e5905468c8a8617d75a63b4a7d7c489af39c5935aa8576570b807c96d36545678069", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259677, "uuid": "0149b667-7e37-47a1-a769-042d74899fa1", "value": "A333F13647ECDAF62D72D4AFC8CBF905FBB18465C4D68A2649E8B1C8B6D01855E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259677, "uuid": "d013a727-de55-4587-85f0-ace76ca68df4", "value": "1536:1jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXhQ:RB9wzbqtWb08UscYJhnpjyq9qBhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259677, "uuid": "6f6f1c6e-ec00-4bbf-9881-e3da950367aa", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259677, "uuid": "8f57ddd7-aad5-4495-822f-b78c9e4adc52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259677, "uuid": "885fcb88-d164-4de4-96dd-65ef769a0e2a", "value": "diagram-1234758477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24ee870-b6c4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621224148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621224148, "uuid": "d4cb1fad-6a43-49f1-9e8f-9dfe3fe0642d", "comment": "Malware payload (Dridex)", "value": "2921293d88926e70979b266442686cf9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621224148, "uuid": "9f50dedb-beb8-4c42-812e-a6c69b5ff222", "comment": "Malware payload (Dridex)", "value": "336d7927ded4d89e9d063b04d8c285d4c27dd962b1edf38394cf56a33825ed72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621224148, "uuid": "e13fd81e-51a5-47b7-99cb-a2d796e79fc9", "comment": "Malware payload (Dridex)", "value": "b2b2ab291a4401a20160976d8c1a725efa2b471c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621224148, "uuid": "98b7335f-80ed-4ff8-9e6c-9760db49f4ee", "comment": "Malware payload (Dridex)", "value": "09763fd3c35ee395bc585c17d4793b7f1f92ee8a9d2f9787dc9da33c04853c42839bf4112c478ad846d1d9706078468b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621224148, "uuid": "ebe67cfb-1412-4c01-9e6d-11734639e731", "value": "58F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621224148, "uuid": "5b68b301-9271-4613-baed-bd158eb98352", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621224148, "uuid": "38351bf2-afc8-4610-831d-78ca0b79552b", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621224148, "uuid": "a73a0dbb-7249-43ba-b932-23139a81303d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621224148, "uuid": "8242e919-4ce5-4f7e-802d-be4b80610792", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621224148, "uuid": "94bf52ab-f29d-4740-8224-831f4c02e848", "value": "2921293d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc53d814-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259921, "uuid": "78dfca00-ce66-4f65-bbe6-8681275ad1ef", "comment": "Malware payload", "value": "4b63d21693acd749fc87b685b8b88b70", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259921, "uuid": "384dbdc9-4f9f-4ed6-9a00-4f9927496632", "comment": "Malware payload", "value": "336fbd13a250eaefb72135f6f6a1b640a5bb202e2a193c8478469b6d5adffcf5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259921, "uuid": "8c4dcfd3-dcb8-458d-9703-505ca70fe28a", "comment": "Malware payload", "value": "4597cd84503e21cdee44798692107b1d27eaac7a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259921, "uuid": "fc75fd00-6d69-47a4-9066-7f39af47f164", "comment": "Malware payload", "value": "cfd24a6416da5aacbe418220ce1d5e8471f9e661a5a42be4a903dc7a99614e34aa9288559dd573fce1f1e5b12d9770e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259921, "uuid": "da9d6207-7db8-405f-b28d-70cf55219d62", "value": "4D33F13547ACDAF669B6D0BFC8CAF604FBB1D495C4D78A2249F8B1C8B6D01845E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259921, "uuid": "f9f4964a-4780-4f19-aa66-2c0e471f2c0c", "value": "1536:NjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXO4h:JB9wzbqtWb08UscYJhnpjyq9qBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259921, "uuid": "798883c2-0ee5-49fd-af43-f78ae4e72ff3", "value": 52855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259921, "uuid": "732623ec-fb14-42eb-be7c-2d681c01ee70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259921, "uuid": "ffeb4ed9-be61-48a6-a1fb-611167cc33e4", "value": "diagram-1451907476.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08244b5-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263739, "uuid": "8dfbc1f5-d50f-4e51-a301-4bf43e4dd105", "comment": "Malware payload", "value": "5dc15292d2aac6b5169867a22d2185c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263739, "uuid": "ee0377a3-60f6-4cd1-8348-c8f568d125e7", "comment": "Malware payload", "value": "337faf66e308b3860941601fd8de1a91419190f005e1aa6b9d6f174b86a5c19e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263739, "uuid": "8535d85f-3d8d-4f67-97ba-4dc940eb0c68", "comment": "Malware payload", "value": "5a2aeb9fd55376fbef3b65f596f8651710f4fbd4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263739, "uuid": "2b2a0800-1bba-4a8b-874b-5e39a8d05bde", "comment": "Malware payload", "value": "4cc10af89dfcb1bcb88a372d44cb2e548685980feb3de47c12a4ff1bd81366d26b54973ecac22c5b168d65fcbbe1467e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263739, "uuid": "9511d469-7895-46bc-9cb5-53a923d71a10", "value": "9A33F2D0A905E0CBE749B85CCCAF9D078B7EDD1A463DBC92013AC0871E61AB96745D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263739, "uuid": "42c39d43-0e2e-46a3-b9d4-4734f10d811a", "value": "1536:LXXtg3K7774iXfEz5lnm/hQMOEYus1GplIt8r3:TXma7774mfCyWMB/4GplDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263739, "uuid": "5b0d8673-bb7b-4c7e-b927-27ecc6caa0b2", "value": 52863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263739, "uuid": "087001d6-6c7d-4c61-b188-f2850b4d8387", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263739, "uuid": "bf070850-a340-4bc2-9ad5-be3b2faeaa4e", "value": "statistic-2131521990.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d289df-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263671, "uuid": "9150c7ef-5413-45c6-9dc9-b5d244868676", "comment": "Malware payload", "value": "7d32ac1ec3180c1462b9cd6da0841955", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263671, "uuid": "3a5f887c-68d7-4ea4-bea3-104f29dfeeba", "comment": "Malware payload", "value": "33834281947ed11fab8e4cc278a66029576495e85cc2110a4e634bb5052fec89", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263671, "uuid": "efb4982f-0df7-4567-a819-05a4c2f96a00", "comment": "Malware payload", "value": "fe97667e14dbfe2090fb9112ddd1a01e5ea8d5a8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263671, "uuid": "d876c752-6a4f-4581-b5e1-8bcce412fa8a", "comment": "Malware payload", "value": "dcb16f6c511467f45165b40c90d43fef2476cd41a14141c242051b2b105cc41955be2d5bc708a50f3bba780bc7003035", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263671, "uuid": "e45b7d4c-dbb0-4ab3-998c-93419ef66726", "value": "AF33F1E09902F08E9759BC59DCAB5D078F39C91E027D3883017BD0475EA2A75A749E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263671, "uuid": "ddeeba29-8d61-423f-b792-70bc1d5557b3", "value": "1536:aXXtg3K7774iXfEz5lnm/hQMOEYus1Gppl6:6Xma7774mfCyWMB/4GppE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263671, "uuid": "9166a937-fcd2-4b1a-a727-48c90adbd870", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263671, "uuid": "8414a5a5-17f7-48fe-b539-6ffb118f4d69", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263671, "uuid": "a814aef1-553c-4531-badc-b0450e9f5b50", "value": "statistic-209608652.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c918f5cb-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261982, "uuid": "08f6d2e0-1fb1-4544-8d14-6d059260a81c", "comment": "Malware payload", "value": "45628beb84596651fae7e73c28f226ae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261982, "uuid": "1643df4b-857e-4bc2-8a01-bf6427b6aeb0", "comment": "Malware payload", "value": "33940ae1eb4959e4b5978eaff0a8610c403db632d84509b381ea130ac176662e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261982, "uuid": "fa5424f3-ad7e-4732-9801-c7aa62415f82", "comment": "Malware payload", "value": "5d8e6a0ce0be179b6ac3ccc4576c2d447148a526", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261982, "uuid": "a7d919be-a043-489a-92d5-c30884cdd120", "comment": "Malware payload", "value": "0d88dd8be116d1876da3fd79c59fbfbe07d112e4fe877ec162d5d77cec91574d6136ff76326c84324e5b8ae2feaf66d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261982, "uuid": "d4467526-b758-4746-a20b-a54bf7f58850", "value": "B933F1715BACDAF668B2E4BFC8C6F504FBF2D459C4D7862246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261982, "uuid": "a62734ce-a343-45ef-aec5-cb6ac433f9b8", "value": "1536:AjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXFD:gB9wzbqtWb08UscYJhnpjyq9qBFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261982, "uuid": "4e1e9d5e-fe47-4094-9125-abef058a6905", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261982, "uuid": "9b185807-49de-41ab-9efc-bf68bfdccc76", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261982, "uuid": "dd1b8f28-a8e4-4a62-8819-97062040fd67", "value": "diagram-917866416.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3ac498-b6bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621220833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220833, "uuid": "578fa9e4-164d-405a-99aa-3247565c8ab5", "comment": "Malware payload (Dridex)", "value": "7368b909f6dfcc6fc297fc27842d8f39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220833, "uuid": "3a8139b0-1380-46de-9a15-e8bbb9a81ee0", "comment": "Malware payload (Dridex)", "value": "339bcbd3e8e7fff184fdb9749a72fd5670b7be4a566ed61e67144c62cd94b4a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220833, "uuid": "671ae85d-14d0-42c5-ba92-6f96b80dde2a", "comment": "Malware payload (Dridex)", "value": "6977fbba58bb04d9ed72e5b97bb285df36f0a6a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621220833, "uuid": "39d67842-bc4f-4ed3-968b-dd5b23725f8c", "comment": "Malware payload (Dridex)", "value": "80d255e747bc57cb28048909328fca25eea917bc81937712b9df60b01c8a9062bbe3b2d1fa30cd92e70ca1a62c18902f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220833, "uuid": "6ac5369c-6115-4601-aa50-653f6cdbd8cf", "value": "4FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220833, "uuid": "538cd1c1-214d-47c4-a04e-fad7159165c4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220833, "uuid": "5f518714-62e7-4ea0-b5b2-356bae27bb4a", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621220833, "uuid": "183a43cb-9331-4c6d-91ab-ff5e0fad808b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621220833, "uuid": "15e8039f-e5cb-4f62-a670-1619eea97fea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621220833, "uuid": "1bd74098-5121-4af0-a2b8-ae4fc3064a57", "value": "7368b909_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ab1d4e-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261757, "uuid": "e7f10046-ecef-4d0a-94c5-2fee3f232de7", "comment": "Malware payload", "value": "777f830952ee80acd25580295ffab6ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261757, "uuid": "05cf2553-e4fd-44e4-a7ef-32903085b9a2", "comment": "Malware payload", "value": "33bba50e412c8d34368afe823635cef68c3c3337c243e3340997441d03c895d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261757, "uuid": "d93b0cac-858d-4eea-80ca-66a1282d406a", "comment": "Malware payload", "value": "7c157685bc91476f9c575db30b78c00224c7c33b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261757, "uuid": "e555b2af-b05e-4702-8027-b0469ddf70f1", "comment": "Malware payload", "value": "edf6ee29f9b75581cfabfd28e2860a4334ff2660d061af4b53cc59d04c3b62081e7ff37c0bc89ea6e7cf8c7158a97f30", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261757, "uuid": "283986b7-7596-4e99-83f1-67b290746573", "value": "0533F1714BACDAAB2DB1D4BFD086FD44FFF1C865C4AA861685F8B0C8B6D02554E72E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261757, "uuid": "4e568900-0a7f-43d7-9f56-ff508e3fcdc1", "value": "1536:0jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67mG:8B9wzbqtWb08UscYJhnpjyq9qawmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261757, "uuid": "cd22a9e8-3479-4991-b8ea-73665f266e0b", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261757, "uuid": "48417587-2303-4a35-b9fa-d497efc97158", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261757, "uuid": "5f0da626-0c3c-4d59-adc2-fd70af6a9eff", "value": "diagram-769460606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107fc50b-b713-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257807, "uuid": "0a78dcd0-155c-4f0f-b24c-fa49372dc7b8", "comment": "Malware payload", "value": "cb9d213567b0e9436189d21cfa023efa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257807, "uuid": "1b728082-49a3-4c43-8540-a5f1b266ccae", "comment": "Malware payload", "value": "33eaa16f3143eee849724fa78d237126f0ec2e6e64741073d69019bbac7c5674", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257807, "uuid": "a91cd575-3f24-49a0-9ebd-719e815e4734", "comment": "Malware payload", "value": "d7f6495ca5cb8d5141015cae0e62b46ea396aa23", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257807, "uuid": "75f8ab29-042f-4f2f-ae08-25456167210f", "comment": "Malware payload", "value": "95384a32258df67b467b7cfef02b2902289456d6e2417e517fbf558c538f1d48f167650699a889c072f7eb02b773e0c1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257807, "uuid": "20ea10b2-7229-41f9-969c-0b2c0b18d90c", "value": "1633F184D164108DCF4FE2EB60F6FAECE1DE7F43099A68C09A6E2644E2520E54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257807, "uuid": "16a18bf1-8a74-4f9d-a5fd-a443f06adbc6", "value": "1536:32fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbqX:mfqhp+g5ru2kmUEt88mAbqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257807, "uuid": "4f478367-96ed-478b-b1dd-fb68e5ab20f9", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257807, "uuid": "11e93cc9-3814-4ee9-bcc2-288d826f1cfb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257807, "uuid": "cd400ae2-cf78-473b-b830-e2b09a394c90", "value": "catalog-1891536216.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736ff3bf-b707-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621252819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252819, "uuid": "c188d4e8-500a-494a-9645-daa685884bcf", "comment": "Malware payload (Formbook)", "value": "735cd96bccfa228b401ee3db419e1473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252819, "uuid": "eba8031c-a639-4e9f-8c87-7187a4e6f684", "comment": "Malware payload (Formbook)", "value": "33f0d367ae282d4c9b9a6acbfefd3e86999eb84fc65c43d99f1de1b95c1f80af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252819, "uuid": "1247e3b0-4d05-4d35-9007-78367761aede", "comment": "Malware payload (Formbook)", "value": "ec7508e625a8931cc7e6bcd23c0cea75da2eb34c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621252819, "uuid": "8b020347-90c3-4b39-94cf-eded0647cf0a", "comment": "Malware payload (Formbook)", "value": "a7a6c0d4b1df4a4b33000655436390b10ce96c35b1b8148315af863770a93176f002db5497d0107f607be8e1bbe169c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252819, "uuid": "36394b5b-f6b8-4e1f-927d-944d8a99a3ec", "value": "90058DE2A2E04477E16F09788D2FA6709825BD122EA854B567F93D085F353D13E3B18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252819, "uuid": "7529cb34-18b4-4bee-a05b-b52a44005173", "value": "7c370007feb59a9e362766ed804d79e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252819, "uuid": "d9ab9458-1c07-411c-a649-0be6c83414ef", "value": "12288:OBNJLlBayXSMBvsDcB253YYhH0/ZL4P9Yp0Chmyo6nIF:OB/O7Mxs4ife09YW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621252819, "uuid": "888d26ed-9be5-4f53-bc20-15de3439bfd4", "value": 865400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621252819, "uuid": "b89fb79c-532d-4410-a637-7b9902d38b41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621252819, "uuid": "58a32677-27e1-46be-b01e-f364ecdff16b", "value": "Kqwsiusfvsjwcpravogqzczccqnuhlqyoo_Signed_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7010c93a-b6ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621228332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228332, "uuid": "2e53a859-352c-4e23-b97c-ed8a034c6343", "comment": "Malware payload (SnakeKeylogger)", "value": "4b04eb0fae74c1315e4a831cd2158e36", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228332, "uuid": "ad9ba94a-a0ad-45c9-b7d5-c93afe39d11b", "comment": "Malware payload (SnakeKeylogger)", "value": "33fb229cfe2f2fa9655a350500ff0df9f8d54edbb65aaf8ca3cd578b44f78610", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228332, "uuid": "702ef673-5af9-494a-83ca-ddd1b2492c29", "comment": "Malware payload (SnakeKeylogger)", "value": "c1aa24739ebc882726856819abf79008f08334d3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621228332, "uuid": "1527ffdb-da6d-4fde-a5e0-af3d54c81d0c", "comment": "Malware payload (SnakeKeylogger)", "value": "3f58b9b9cd9483190ae24db00fafb6cd81828e732768775686cb8b538518ef3321b67526e40588d8ee7ab93afe023ced", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228332, "uuid": "a15ce90f-57a1-452a-b240-d4124b21a4af", "value": "D2A4AF387AA5E16EC62D5D316A611C6482531373638BF35B8C3768EA0A4D74FCB217B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228332, "uuid": "8e40596e-2af2-4a5a-b20d-6a77f195a2f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228332, "uuid": "75303d80-cbf2-4b37-a7db-1258ff050fce", "value": "12288:GZFGfsNr6PUZg04QT7gY7isFJp8u+Zy3hnHKrgu:GjGfsNr6PUUQYKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621228332, "uuid": "7278222b-a07b-41bd-8170-2e6754a5fa91", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621228332, "uuid": "ad70f9a1-c820-4c5c-a81d-e01ec67e3bd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621228332, "uuid": "045ee631-cd88-495e-baaa-f9c65b912285", "value": "PO#975072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ea2801-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261809, "uuid": "0e1ffbae-0e8f-4eac-aa12-7ebfcb7b7be3", "comment": "Malware payload", "value": "88f9d4174f5fb6dacc6ec70ce1615b90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261809, "uuid": "c00c581d-a749-4ef5-892e-351690794b41", "comment": "Malware payload", "value": "3412bf6feb29720c268ef3166ce93d4bdbcc44c3eff19081fdb7edd48744cd45", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261809, "uuid": "1b4c71b8-3fbb-466d-8101-fafb07c7219c", "comment": "Malware payload", "value": "21faceeffd8cdd9c1c6bacbcca51373331a61a99", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261809, "uuid": "31f343e0-aee8-4004-b71d-e1dcd6ed213d", "comment": "Malware payload", "value": "d09c0923c561ab76945f645038718376aaa7990d24fc7cdfabfbd1bfdc725bf4bd3aeb77851b3070e0452a4c5b4c3d3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261809, "uuid": "c4c3c993-f5fc-4170-b99b-bc430b9034b1", "value": "3733F17147ACDAE668B2E4BFD8C6F504FBB2D499C4D7862246F871C8B6D11544E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261809, "uuid": "9c8fe236-1d7a-45c1-975d-f1dd09a82c41", "value": "1536:jjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXvp:XB9wzbqtWb08UscYJhnpjyq9qBvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261809, "uuid": "fc2838ef-e551-47a5-9176-ec3f3c87d4d8", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261809, "uuid": "8d78bf1a-560b-4acc-bbd0-042ff71d3f3a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261809, "uuid": "94986dd0-dc11-48e0-849f-c3221623786b", "value": "diagram-802772741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faca3a5-b718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260114, "uuid": "6c9bf2b5-9b23-4816-b366-dd7fc748914e", "comment": "Malware payload", "value": "e8c1f05f98821d88fe634835a98f594a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260114, "uuid": "6b77ef4d-66ec-41cb-824a-2419c06b718f", "comment": "Malware payload", "value": "34528abc931313319605bacb11183d4265db69cca3c9ea7e9e94f9f9307de39b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260114, "uuid": "23cc1ab9-523d-4337-b25b-03c1814dc20d", "comment": "Malware payload", "value": "237d1e660797d006aa4b0c84db9b95b0a41b02fe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260114, "uuid": "122b3ce2-1a80-4d6c-9a92-49ca32ae6269", "comment": "Malware payload", "value": "c4ab3ff35115f2502de3d5bbb27a9278fc4a1db213e6d607720a41bd72749d9d248682382331505ba5bc210fa9e79f14", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260114, "uuid": "32a4d865-58a8-44bf-a062-5e9290f98816", "value": "7433F1354BACC5F66CB6D0BFC8CAF604FBB19495C4D7876249F8B1C8B6D01845E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260114, "uuid": "5f64764d-a57d-4883-9e6c-90db3f33b093", "value": "1536:djfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXb4u:5B9wzbqtWb08UscYJhnpjyq9qBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260114, "uuid": "c152cf25-0b52-4ca7-8d44-b2bb33511e99", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260114, "uuid": "d6b50c63-a825-4825-8517-0959df8e7961", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260114, "uuid": "eb565004-76a4-49b7-98f4-b0907b9eb369", "value": "diagram-157679933.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e6b083-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261874, "uuid": "cb884f46-91b3-4b4c-bb89-92d658199332", "comment": "Malware payload", "value": "e7979edccf99a665cc27561228f21ff8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261874, "uuid": "58efb764-c31e-4020-a1e3-039a391b85e1", "comment": "Malware payload", "value": "347e5ab05a11c9a4c53bd43ca3c1033342ff5e427e0541023c83c5149f758cce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261874, "uuid": "8bfe1d72-bd62-434b-a682-9eabd2a633e3", "comment": "Malware payload", "value": "7dc6e7371b69f0af5b00c3a1166f6f2dc00f182d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261874, "uuid": "c8b04678-6339-408c-b56e-b0c877e6da82", "comment": "Malware payload", "value": "9af2c21c22194d4a09feeab51101d3c2b114b832f4783b566b765948ec0d462730bd7d1a06f15f0de6c7e7fedd65c1ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261874, "uuid": "cdc77ec4-08f2-4a09-8011-32e351295495", "value": "C333F1314BACDAF639B6D0BFC8C6F605FFB19495C4D7862249F8B1C8B6D01855E22E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261874, "uuid": "18dc251e-8dfe-4294-a34b-6f48a0953134", "value": "1536:rjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX24D:fB9wzbqtWb08UscYJhnpjyq9qB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261874, "uuid": "1510bf35-3443-4d5f-a5d9-4a24902786e8", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261874, "uuid": "758a0ed8-2c8b-4574-adbf-dca0286945de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261874, "uuid": "f03672db-f27a-4c46-95bc-2802a779841a", "value": "diagram-847894082.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2822e052-b71a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621260853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260853, "uuid": "abd0b27b-20c1-4e0d-904f-7f4d9746c96f", "comment": "Malware payload", "value": "03b74eac7bc633d432b61d70c9472936", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260853, "uuid": "4333b3b9-3aab-4aff-9a82-7e60e6a907d3", "comment": "Malware payload", "value": "348017c8fdae32e3d0f46b111456550e5a7f41f8fac108d26efefc0cde4fccd1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260853, "uuid": "5ee3715f-d0ae-4bf2-963a-8c1e62c7cd73", "comment": "Malware payload", "value": "7f27a44bbbe6d448ede942cac9299bf37857ab31", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621260853, "uuid": "472320ad-672d-4321-84e4-7c6813a170a5", "comment": "Malware payload", "value": "e32dc25f2c37ecbb8bab2ad4562826c1d1aa899f7062fdb6421263e026aee8fcc1526e1d661ed023ae2444b937828166", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260853, "uuid": "20b6520d-215f-4f04-9262-caddb01c5c42", "value": "033302324BECDAF629B5E0AFC8C6F604FBB1D455C4D3862249F8B1C8B6D01855E32E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260853, "uuid": "a9b371cf-358e-4bdd-b300-fad4d469e97a", "value": "1536:5jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXTj:dB9wzbqtWb08UscYJhnpjyq9qBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621260853, "uuid": "e60ba69a-033f-436c-b4c4-b3840c3c470d", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621260853, "uuid": "568702c9-7139-4d61-b699-d927b3294a9d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621260853, "uuid": "6c562957-5be7-47d0-9437-b8a6b033488c", "value": "diagram-2097984544.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d86054d-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263520, "uuid": "3249ac63-da4a-41aa-8363-c71128d3c62e", "comment": "Malware payload", "value": "26e205c5a76338c0264d4a2efdbbe123", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263520, "uuid": "07807860-6f07-4e91-bceb-10fcf1093f21", "comment": "Malware payload", "value": "348a8c395a80e570167375ac3f893c82cd7b3396eb4119fd09a5539abc6a365a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263520, "uuid": "80b28a55-796e-4500-b5a8-fca5418fe3b6", "comment": "Malware payload", "value": "f3dc3439292cc6230a82f5f604f2952adf5f7cdf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263520, "uuid": "4085e486-8460-464c-91a8-b476433ac89e", "comment": "Malware payload", "value": "0f135bd06e15815c79e8199e8516f260528e9fb971c8507e9972e8e65947b2d6d4a711b04b3744c0cbf7aaf35b259e04", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263520, "uuid": "3f86d425-32cc-411a-af12-91022e2b3660", "value": "7D33F2E09502E047A354FC58DCABAD038F7DE95E477D7842027EC0879E72E75B24AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263520, "uuid": "f89e7bea-205a-4f03-bf55-1dee651f1fe7", "value": "1536:7XXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOG5M:jXma7774mfCyWMB/4GpCOGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263520, "uuid": "16cfe5b3-accb-46ff-a54d-b6277e029cfb", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263520, "uuid": "edec71e4-a3bc-4a81-8968-5f76bd0338a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263520, "uuid": "6301fb97-a183-4283-924d-2c3059657fad", "value": "statistic-1965325783.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcfb6ab-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259923, "uuid": "f2fc411e-f3fe-49c4-9ea4-4ce1a9b8bb6a", "comment": "Malware payload", "value": "15d87a0e1f6441a6a64916bc4e9fdbf4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259923, "uuid": "39238d9f-e4e0-403c-b0fb-b5f7aee69ce7", "comment": "Malware payload", "value": "34bdf88f91cf80226107bc6b7184bfa13f993131a8400a8b00ec4fd5b79830cb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259923, "uuid": "f2bd4681-ff05-45a8-8345-683e7d3c88a2", "comment": "Malware payload", "value": "7e61a3a8272fee14904df6decd71a4383bc48f46", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259923, "uuid": "5c486006-970f-41b9-8b36-e945e4371a39", "comment": "Malware payload", "value": "71018ead03c50a22f7b4ef206d9a09b431390d7621f9031249951d19c77cd3fb7790e1b4838cb7b0df830303b690ac39", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259923, "uuid": "f8f17910-a69e-4e0e-b51b-9ed94ef7c348", "value": "6933F17157ACD9F628B2E4BFD8C6F904FBB1D45AC4D78A2146F871C8B6D11544E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259923, "uuid": "780749b2-b1e6-416c-b71d-d87cdd453b51", "value": "1536:xjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXhl:1B9wzbqtWb08UscYJhnpjyq9qBhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259923, "uuid": "2ce23967-4ef9-4a07-b37c-0df3f8266cad", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259923, "uuid": "18610bb1-b954-444a-9876-286f25f080f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259923, "uuid": "0679a62f-eaab-4244-aee5-cab41b0b8e8a", "value": "diagram-1454704550.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562a0239-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263507, "uuid": "5f7d9fda-3423-4adf-b4b6-3d8425915ba7", "comment": "Malware payload", "value": "c16ddeffaa09a564be9c490be6166aca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263507, "uuid": "530dbb17-9bad-4b20-93c1-7d5f091500e7", "comment": "Malware payload", "value": "34cc9a0a7053502d5e379824b662dec0eb6d8271b3556c6b731971c12a2e49df", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263507, "uuid": "f199c07f-a31b-4528-a168-18793b111ade", "comment": "Malware payload", "value": "5167ba305951de5a137edf7381ac391dd7da8b06", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263507, "uuid": "5917aa1d-07c8-4235-ab1a-37f3b81c049e", "comment": "Malware payload", "value": "6dfc0240ade1e8613d2f3773aef9132e52120534e6936e211a07a78f60b9a49de8899ac08e7c170e0d77df01452d3846", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263507, "uuid": "5e7dfc88-7382-41b9-9d09-661b5eae1a88", "value": "B63301E0D542F04B871DB85CDCAE9D024B3DDA4E433D7893057AC0879EA1AB6B74AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263507, "uuid": "ce3dde63-8ba3-403e-9d03-9820c91f11fe", "value": "1536:jXXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EImU:7Xma7774mfCyWMB/4GpV5dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263507, "uuid": "bf7afa55-f926-48b4-8478-3d701f2cb371", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263507, "uuid": "70db3727-7ce2-4d31-9d85-e6cd0d724861", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263507, "uuid": "aaed321e-6e8e-4586-ad7b-575818cf4ea6", "value": "statistic-1957452347.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8ca223-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263709, "uuid": "564281c6-ace1-45c8-9cfa-da376595d495", "comment": "Malware payload", "value": "afb95b50f62875107bb3d2398d34b2c0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263709, "uuid": "6c0b7256-f753-41a5-a5fb-63151d304230", "comment": "Malware payload", "value": "34d2bc31c94eaf0c80a3252777aacfa80dcc78954211b7f2603fa67973009aed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263709, "uuid": "69389d47-d9eb-45ac-8b27-8ea8d860915f", "comment": "Malware payload", "value": "8e3f6fc4acd56f7cdd1946d2acb9b8f398a2254f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263709, "uuid": "61c5b304-e2b9-4a2a-810c-12356c3d3224", "comment": "Malware payload", "value": "1f5b462738008c447811f0f09b1412319d2cfc8e224612e86c3b804d238653a323f5b7ffdee8ba80b94951358d86c3e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263709, "uuid": "85f03ef6-30dd-4e0e-a02c-524b2fc9e774", "value": "CC33F2E0D801E086A754FC68DCAB9D038F39DD5A073DB852027EC0C75F62AB5B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263709, "uuid": "9e034897-e6b6-4588-9a43-3f95aff92b24", "value": "1536:WXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMOZG:+Xma7774mfCyWMB/4GpCOZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263709, "uuid": "ee87fb3a-b570-454c-a267-70f268ed2825", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263709, "uuid": "d226a595-e82b-4b74-bb50-37f40b6caca4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263709, "uuid": "f32974ca-53a4-4e8f-9b2e-cefad22a1876", "value": "statistic-2115584976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa34c54-b714-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258638, "uuid": "1fd2ec40-9c23-4f4e-a397-b07ce753a7d0", "comment": "Malware payload", "value": "19033076688f187bce2e7f143631a780", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258638, "uuid": "06c7f550-ba93-4247-b373-4ec8fca554c0", "comment": "Malware payload", "value": "34f13e75dfeb3f8021647ac50d2c8ec0b314848ffa361f5cbd3122c235b39435", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258638, "uuid": "86b0b710-23ef-4554-8724-6e91f741d194", "comment": "Malware payload", "value": "6499213d22be9b57b9184021e35b2ef3a7d2f6fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258638, "uuid": "189d9be4-2c9c-49d8-8002-c16ae67da436", "comment": "Malware payload", "value": "d7793957c355920e7f472657335eea456229fc4e13e7bc57e7ed8c9b445d3a186382446518e0b06dc8178cd595edcc43", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258638, "uuid": "a296ce1c-6a50-4952-9f28-b2ee7dca7d30", "value": "703302A6E644114ECE4EE29B30F6E9DCF19E6B430DE6B8D09B2E1705C1570F5082F25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258638, "uuid": "f3b038de-bf8d-4483-a6c0-560e9fbfc6df", "value": "1536:O2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIBf2:zfqhp+g5ru2kmUEt88Bf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258638, "uuid": "20a1f11f-319c-40d0-9023-d24e0a78c701", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258638, "uuid": "4a49a966-93b8-423d-b273-485aa84b61a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258638, "uuid": "8b3f95f9-1655-4140-a458-f480244bb5e6", "value": "catalog-461472552.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f35f56f-b722-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264247, "uuid": "959b3911-d8ff-49fd-b8e6-0321f9e4914b", "comment": "Malware payload", "value": "c7463ad55f5889a5ad7ada85695ddc30", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264247, "uuid": "730fa5a6-016d-409b-a5f8-398e795941f9", "comment": "Malware payload", "value": "35180ca247c25f865c4e37c3c00cd97671d29f70023adbc454f2335c3c9497df", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264247, "uuid": "fb09114a-275b-4276-87c6-e2bb3f2fa000", "comment": "Malware payload", "value": "0a18a5528b5170cc571e25920a0a8b7ef269b051", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264247, "uuid": "5b096fa4-50df-4721-9e66-f71d828bd7d1", "comment": "Malware payload", "value": "3d2267107e1a201410a982bfaee89f5d648623ea19fa1daae658ac6e5cf67e3a5d6aefacc9bea4cddc74e3464b626aca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264247, "uuid": "cc76f6af-847d-47d4-9b9b-a2140ec76a82", "value": "7933F2D09802F0879B45AC49ECBA9D164F79E94E47BD74D3027AC0834E72AB5A249E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264247, "uuid": "c081e518-ebcc-4349-b738-4324dc65dbf6", "value": "1536:6XXtg3K7774iXfEz5lnm/hQMOEYus1GpDkU5:aXma7774mfCyWMB/4GpDkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264247, "uuid": "a70d4293-f7b0-4758-a89f-975242326986", "value": 52857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264247, "uuid": "ea082e78-08f5-47d3-987b-3d1692e2c3ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264247, "uuid": "0e02261c-924b-4153-bcb5-21994ec88a9f", "value": "statistic-581443215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d634fb59-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261575, "uuid": "264925c7-188a-4790-9144-5cc8bb76e668", "comment": "Malware payload", "value": "65523dd18c8b6f108d21d392eb345d00", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261575, "uuid": "e28fb448-cfe9-4127-b3f1-bcae0f9dbbab", "comment": "Malware payload", "value": "3543b87d4eaf635f70f1d3be491cfd4d0ee7005995305b0c1247c105a707f524", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261575, "uuid": "280a678a-4fbf-4986-8a21-8604923d3c39", "comment": "Malware payload", "value": "d305c963c82db852273fce0a39435682ebc2d4ff", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261575, "uuid": "141f87da-44bb-4e27-b1b9-c8c7df91b087", "comment": "Malware payload", "value": "b03f417196b257e3bc59299106b468b3b2c4956bf73560790108dc899cd4d1aafef39eb85a85b455fbd4337df86e39f5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261575, "uuid": "de26eee2-1d5e-4598-827a-e535708e929a", "value": "C43301314BECCAF629B6E0BFC8C6F604FBB19455C4D3872649F9B2C8B6D01855E22E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261575, "uuid": "5799a64b-3a1f-4f99-892a-b79c5b40acfc", "value": "1536:yjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXoY:CB9wzbqtWb08UscYJhnpjyq9qBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261575, "uuid": "28d0efc7-baf2-4852-9df1-9ae3777ae4f5", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261575, "uuid": "c5ddef41-c668-4842-84b6-91477fb809ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261575, "uuid": "9c7750a5-7428-4f32-9247-a9debc2e64bf", "value": "diagram-643453973.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66042245-b71d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262245, "uuid": "535ef12a-c445-4c83-8bfc-fa77c11cc2ac", "comment": "Malware payload", "value": "79cb67fd949ee42cb077cb2075c019c6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262245, "uuid": "1e42bff3-3ea2-429d-a894-971213a4b906", "comment": "Malware payload", "value": "3547d9ed7fd854337ca946128eefa2186dc5fe8dfb00ee2cbdb68fda2d450342", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262245, "uuid": "f30b04e8-aa1a-4c30-b985-eb89183fb51d", "comment": "Malware payload", "value": "bad114dfe46ab7eafe2b3935ae4bbd074ac6bcbd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262245, "uuid": "3f302bce-d192-491e-b69e-cc9980ae6f19", "comment": "Malware payload", "value": "129b7bcf5f2c40a7a2233149966b083406e4ff4d2a13cad0004f9b92b585e90d25670e360378c4f6c398e81d15e217c2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262245, "uuid": "67e7ee6f-0aa4-416e-8250-1ac9d911f61f", "value": "2233F1314BACD9E638B2E4AFC88BF504FFB1C455C4D78A2649FCB1C8B6941555E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262245, "uuid": "16c94546-ed15-4e9d-aee1-16d551bf3f04", "value": "1536:3jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAXDT:TB9wzbqtWb08UscYJhnpjyq9qB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262245, "uuid": "1b9dbcaf-2e22-4560-9a8f-7fdb36d4c463", "value": 52851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262245, "uuid": "aec2f515-a8af-400c-84d8-7dd409e71161", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262245, "uuid": "7b91c500-94a7-402c-9e41-c232f4832dfd", "value": "diagram-998107320.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fee6554-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261322, "uuid": "e811892f-7d8a-40af-96b8-e53785ef031b", "comment": "Malware payload", "value": "dfe40fdb23f52eeec1e6dc4638469db2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261322, "uuid": "54b647a8-6456-4083-ba0e-38e09f14ad84", "comment": "Malware payload", "value": "355377000eec3700749db546d4ba125e6303dd4011eeab8e225f23c8dedf88e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261322, "uuid": "eae9d3ed-28c7-46d7-aca3-af92a40d587a", "comment": "Malware payload", "value": "539f70bee1bbfee54cff1a2c1789e04aebccd552", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261322, "uuid": "b263b877-d0fe-451a-a196-d90cf978d94d", "comment": "Malware payload", "value": "cd2ad4fd288b3cabf7b71c8e17f443767a73211c32c7568cbe91806396b92052f910c5d9c03e4060098c88ebf582f86e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261322, "uuid": "71b4697b-041e-4dfe-9af8-30b84d397190", "value": "CE33F1311BACDAE66DB1D47FC486FA04FFF1C4A5D5AA871285F8B0C8B6D02519E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261322, "uuid": "9ae70684-2f80-4039-a1f6-0cc2a3654096", "value": "1536:5jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67W0a:dB9wzbqtWb08UscYJhnpjyq9qawS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261322, "uuid": "91a8cb79-9c24-482f-a7cc-6b281961ca36", "value": 52852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261322, "uuid": "8a25b71c-f876-485e-a688-a2c7be2ecc02", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261322, "uuid": "06cfb945-2573-4c29-985b-38a2bebf3774", "value": "diagram-46377385.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb1f716-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261616, "uuid": "685882cb-cf96-4185-81b7-ea8acc0bb56d", "comment": "Malware payload", "value": "b43a01ac3d6cf1478168357f971940d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261616, "uuid": "0be2dde6-8afa-40be-a206-6f2e114e6122", "comment": "Malware payload", "value": "355c977ef2d38ed4cdf68c7c9c4ba2c3478df6aca41e487271cc7eb62320c214", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261616, "uuid": "980f93ea-ea82-43a2-a810-1f0351334a60", "comment": "Malware payload", "value": "06f903901d521c95e301b56166e6420180e9dc02", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261616, "uuid": "c32d0255-c1fd-4dab-aa61-87c064d02f8f", "comment": "Malware payload", "value": "ad594b653f1a2884f96a62aa63c48cca36629995d6e453b4932020655ffca3cbe055bc1fbc9439a5f2b73cee8b8e3220", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261616, "uuid": "7ddfc8b3-6518-4797-b8f8-3543f602eb13", "value": "D833F07147DCCAF66C76E0BF84C2F808EFF28951C987862649F9B1C8B6A52514E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261616, "uuid": "9072fc34-76a0-4031-838d-927a38e829b2", "value": "1536:VjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdTK0wYW:xB9wzbqtWb08UscYJhnpjyq9qEK0wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261616, "uuid": "16256d38-2fb5-442e-805c-3ece9dfbef91", "value": 52853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261616, "uuid": "08e3edf3-05a0-4acd-a063-38e50de9fd96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261616, "uuid": "39c87dca-e8ef-459e-a6ac-fcd03409b073", "value": "diagram-665780749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda61273-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256809, "uuid": "3ac34f57-0b94-4641-b30f-56e68ef2a244", "comment": "Malware payload", "value": "2eb510971587c64bb0216eef6b56cb77", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256809, "uuid": "83fc0fbf-e2af-45af-bbe0-eb4e5eaced65", "comment": "Malware payload", "value": "35796e2c187677d1f3cf4e2dd014cd41ca905846e191056269120d0f36da5278", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256809, "uuid": "aabbc862-eded-4986-bda0-0aef6802ce89", "comment": "Malware payload", "value": "b7986a8f80c02c558471e281233d7d333781044e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256809, "uuid": "e5627c69-b2a1-4578-a05a-ad24bc6f7c81", "comment": "Malware payload", "value": "1ccdf83dee15ed30e8791268784e7c1b2dd08f7bb8f3a3644d6305dbef1e9d98af1e4216fa4e24f9dcd0793a1809653b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256809, "uuid": "510f9226-bc9d-4143-871a-95d52b84d581", "value": "9C33F1A59658018DCE4FD2DF30F2BADCE5CD7E430E8978C05B6E2B4590920F5192E58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256809, "uuid": "2cc1a624-0dcf-4df3-9616-af87e1110c3a", "value": "1536:a2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jITRo:ffqhp+g5ru2kmUEt88to", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256809, "uuid": "1d5c3144-d642-4bd2-8dba-029105d407db", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256809, "uuid": "cecf9a29-2926-4561-9dd7-41648db6555b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256809, "uuid": "98bcbc7b-c247-4e24-b747-7d18ee76bab4", "value": "catalog-1110993007.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436fe304-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259181, "uuid": "d04321bc-3502-42db-af87-4e986cd9e5b2", "comment": "Malware payload", "value": "b7f09f44be279d28d1376089864dec65", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259181, "uuid": "acc34536-0e56-4749-853a-cc4c66c8b5f2", "comment": "Malware payload", "value": "35c83a1005520a06ee4aeeaba72096fe8ed9540c27ea20f42d08d821bb274512", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259181, "uuid": "4acd109e-1ded-4fab-84dc-a91136f69389", "comment": "Malware payload", "value": "9008989f3ea217edd8b2a5a82660a95ec98bb018", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259181, "uuid": "f1af1d82-f7c6-453c-95a5-87cdddaa0a2c", "comment": "Malware payload", "value": "8d45ab01ec0d0a704174a3f1d00b3702aee434e4080a74a4f274295985bd1d504ac8c3592b7820df7f921faae805d9e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259181, "uuid": "189adc7e-a58a-42b9-b1f4-dbbe4d5436e8", "value": "0933F184D164108DCF4FD2EB70F6FAECE19EBF43099A68C09A6E2644D2920F54D2F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259181, "uuid": "e9d7a971-da5b-4169-8998-d225a5f605ba", "value": "1536:W2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIevAbuV:7fqhp+g5ru2kmUEt88mAbuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259181, "uuid": "3ebb73f2-9909-4c98-b835-f68b420f6998", "value": 52726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259181, "uuid": "0eb82ed2-b886-4fd1-be72-88958e76d44f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259181, "uuid": "b02c33c1-9c5f-4bf6-82db-f1d74e73e982", "value": "catalog-839211385.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4936410e-b71e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621262627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262627, "uuid": "85b722d2-8d64-4271-b90a-6ef8afe7b3ed", "comment": "Malware payload", "value": "3510c287fd2f01b6eb9fa44c9bd8fb48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262627, "uuid": "148de78c-552c-4c51-9e36-12c7c7a54240", "comment": "Malware payload", "value": "35c989519255725242da4c60e96dc1445196b9f2f8f2972472d66cdbe6eb2d3a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262627, "uuid": "85991f66-896a-4789-872b-ef72b14f1e01", "comment": "Malware payload", "value": "5145c2406494aa7b7372b237d3dc07d9db94b7e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621262627, "uuid": "1fda05c2-c57f-46e8-94f8-c08bbcd7715c", "comment": "Malware payload", "value": "2ce2a163ad30fcbc1f7ab1f531884b3f035209ac052efd342838538cc8fe41168e38d9f15e634534728fb2607aea1835", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262627, "uuid": "e66412ca-3449-4936-aa16-9c63862771e4", "value": "2933F1D0A502B08BA754B85DDCAEAD134F3DDD5E433DB892413AC0C64D62AB5A709E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262627, "uuid": "04de6bc4-628a-4d36-96ef-a064234a28b3", "value": "1536:mXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVXq:uXma7774mfCyWMB/4Gpulq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621262627, "uuid": "2860f84e-f8af-4a0f-a93b-54a3455a423d", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621262627, "uuid": "012afd0c-e75b-4382-bcad-36fe5016a299", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621262627, "uuid": "d86c45b8-335c-4e94-badf-82455a9fd071", "value": "statistic-1292937046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542bb5a7-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258779, "uuid": "34006322-0181-4ced-8ba6-a416ec5643dd", "comment": "Malware payload", "value": "8d105bf4ed00a9c8c156f51eb4ca5f65", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258779, "uuid": "6ab93142-be00-4069-b80d-d191c6e5397d", "comment": "Malware payload", "value": "35df1c9e8b9086675d36fb0b9f840d0d1970e50758c8f485a71ff3d11660faf0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258779, "uuid": "576a6fba-2f2e-48fd-961e-b3c6ecd35f5d", "comment": "Malware payload", "value": "c2a1feb734fcb9c164792f9535cca9c94d94418d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258779, "uuid": "80b300ce-e1c9-4cd0-a0b4-8c46288facde", "comment": "Malware payload", "value": "a26fe55a3b5a17a92ee1b7f074d2bd08c270162e58a85c15895ebe29d8a4b4e42a8811c42347e151827292462566be34", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258779, "uuid": "f6accf70-2742-46a2-b1b0-8126a019e80d", "value": "5C33F1469218118CCE4BE1EB30B7FAD8E6DDAA430EA9B4D09B7D2745C1A31F1482F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258779, "uuid": "88dc11c8-0fa6-48f8-8c0e-92cabec6b76e", "value": "1536:C2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuOSw:Hfqhp+g5ru2kmUEt88AF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258779, "uuid": "3f33c8ee-180b-44f4-8567-7721138253dc", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258779, "uuid": "c26604b1-bfd0-48e3-9c48-2e2f1d4fb340", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258779, "uuid": "7d5688ca-f2aa-4833-9556-e115c816ebb1", "value": "catalog-559786934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eff29b4-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263522, "uuid": "dcfe138a-56fe-4439-85f9-de68c20c2a8d", "comment": "Malware payload", "value": "11c312f9004beab1c8b7b72ec01c3caf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263522, "uuid": "b973f432-b226-47d0-adbc-6152725c27b8", "comment": "Malware payload", "value": "35e8611b67752f2c96f1b0e1eb904970b7e016b9cff61f63ce0c98a604c6a062", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263522, "uuid": "eee15e98-d31d-4a29-9bca-07b68aa8e10c", "comment": "Malware payload", "value": "b63f161ac0900c1e2a686fe7e00f4e47f9e91bc8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263522, "uuid": "b75f4b87-1d94-4859-a5cb-7a509e5442c8", "comment": "Malware payload", "value": "7db829521f487fb763713f52962972f7819ae70436879e003cfa8020fd8c1be81d3aaf76ffcb12050481076b3988d0e5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263522, "uuid": "d5d6e313-2e1d-4ad4-ac7d-a4573e31f4db", "value": "7633F2E09402E047A748FC58DCABAD038F7DE95E477D7842027EC0879E72E75B246D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263522, "uuid": "3f129ab7-33b4-4aeb-8b0d-b1e769826090", "value": "1536:KXXtg3K7774iXfEz5lnm/hQMOEYus1GpRMO+53:KXma7774mfCyWMB/4GpCO+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263522, "uuid": "79d2eb52-d90a-435f-9c06-f60df81bff7d", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263522, "uuid": "16f398ad-caf9-4b43-8811-694cba2ba3e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263522, "uuid": "3f796f82-6613-45ec-b2b7-d8f999d63c7f", "value": "statistic-1967209143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9464b110-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257599, "uuid": "e40ac6f6-3fca-4a84-8935-d30b05a0e23a", "comment": "Malware payload", "value": "af155d088121065fab925ec7215955d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257599, "uuid": "bb7e15d8-f3c6-4970-8db9-a67b57f843fc", "comment": "Malware payload", "value": "35fa4eb14226255f2603ce7323de93e0a7532e2a1163b3163faf1cb7639af101", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257599, "uuid": "be43e656-3e07-4435-a99e-ed1808712977", "comment": "Malware payload", "value": "e73a9d7cf75353c8bfbfb2bc51c735aff75c7704", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257599, "uuid": "838ecc8e-69a9-4d29-ad10-9e1e909a6949", "comment": "Malware payload", "value": "4a9710b3d8ef2bf9e6e3a1326b28841f8cedcfb0734918cf18d34c46623b1d3b895d0c6bd2f61bc09e0a4de92672dbac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257599, "uuid": "985425af-1ad7-41a0-a7c4-e2a296aec9a8", "value": "A333F195D15412CDCF8ED2EE30F2FADCE29EAE170D9DA4D0AA6E274081531F5482B58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257599, "uuid": "1acd69a6-0491-4998-89e9-3cd1b41e8c95", "value": "1536:m2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIjSB7:rfqhp+g5ru2kmUEt88jSB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257599, "uuid": "0128c4ea-60a9-4b10-b03a-d6249baae8a2", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257599, "uuid": "00c5d1f0-91da-4c41-aeca-1819e6555924", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257599, "uuid": "86fb0e16-264f-43fc-a580-256f2dcd47c0", "value": "catalog-1718154410.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddb2c97-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263628, "uuid": "e9d1ac08-c448-447f-af2f-f7b3560bb1ff", "comment": "Malware payload", "value": "1a4014b9972f3394bd835157d426e7d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263628, "uuid": "6ffff5ba-5bf9-4e0f-9728-cc1ec55307b5", "comment": "Malware payload", "value": "3627a5a060a5d238f915624c1199c381f9b78f7d02aac99814e8b5345af1237a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263628, "uuid": "c2cd1c27-77f1-4b3f-8f75-22954d45d906", "comment": "Malware payload", "value": "e3cd78c397fbe1f70d6635dce272f22fe54b3cbc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263628, "uuid": "6f038545-11d6-4300-9163-b729746c163d", "comment": "Malware payload", "value": "09405d8bc322afbe45a120c765ebb9264a1a220dd52624bdf3b3df81cea421c8ea2ccfc279d4e0203f420544d31e70d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263628, "uuid": "a765e614-a56f-43ca-bf1a-a62992b6bfa9", "value": "5233F1E0D402F04B874DA85CDCAE9D064B3DDE4E433D7893457AC0875EA2AB6B74AD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263628, "uuid": "7357611e-89eb-4a4b-8c8b-764ac3d38505", "value": "1536:7XXtg3K7774iXfEz5lnm/hQMOEYus1GpE65EI4Ix:jXma7774mfCyWMB/4GpV5d4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263628, "uuid": "b90380c2-2123-4a90-8c0f-3099851720c9", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263628, "uuid": "b578184d-3afd-4444-a943-b874cc19e161", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263628, "uuid": "2a97cd3a-37c1-486d-b265-9fcca5a8cb45", "value": "statistic-2056490610.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f65bd39-b720-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263630, "uuid": "570afc9f-58f7-4f43-85ec-03230a26b946", "comment": "Malware payload", "value": "21159e72b1ee97101549668612404b46", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263630, "uuid": "618ce7e1-4b6a-4567-bf29-59e9fac88c71", "comment": "Malware payload", "value": "363f6a92aaeb482e4994393be373271de27109cc3e15f5b7d5cd9f37c65680d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263630, "uuid": "0429ae16-2c49-4bca-a3f5-3e1430850815", "comment": "Malware payload", "value": "c07ee441b45f80cc9424d94b665aa602a5238a4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263630, "uuid": "8abd2c01-4b0d-4fd2-8340-4cef927327fa", "comment": "Malware payload", "value": "3521574b9cc3213e34e4cceb485e0eccc6fc2313f31b185c6d0d5eccca6fc98554fc3e6cda6c3ef9eac0cfbbeb29c1a7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263630, "uuid": "7749b8e2-20c2-4bfd-923e-93438c624bc9", "value": "8F3302E0A806A047E755BC4DECB79D028F3AE91B077D7C93116AC0875D22AF5A70DE2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263630, "uuid": "b8c1fcc8-2b16-4d91-bae4-ea82a3d03bd6", "value": "1536:AXXtg3K7774iXfEz5lnm/hQMOEYus1GpjIdgWG:kXma7774mfCyWMB/4GpjIdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263630, "uuid": "ba4f0a60-e541-49a9-a087-821e6c361bd8", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263630, "uuid": "67b229bf-cbcc-4e75-8fe2-eeb06568eefa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263630, "uuid": "12e3d729-e2f2-4eee-bd75-741219ee3581", "value": "statistic-2056749503.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77620e3-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256906, "uuid": "6dc40f4b-518e-42f7-a3ee-b73a68c01586", "comment": "Malware payload", "value": "e9e84f0a8a0d3a0ba05f56cd862230f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256906, "uuid": "d240e5f9-2573-4f34-b3ec-23bbb3629b52", "comment": "Malware payload", "value": "365016e94ec4ac5bf0ab82ca8e92173399d1e384c719cb4762d6262cb9d6f34c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256906, "uuid": "cb730a75-e7e2-4f72-b9f9-24fc2b967f32", "comment": "Malware payload", "value": "d1ef693461555728b69a900682e892d80b63c38f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256906, "uuid": "adfc123c-607d-4f0b-8e9e-8f5209beb562", "comment": "Malware payload", "value": "c8cbb2215ce7ac8e60a508933283283e3fa534c76325f373ad584e0b88c390c963165a4891cbea1498e5e5d595509478", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256906, "uuid": "4b10dc51-633a-4d3a-8283-9f758572f436", "value": "6A33F141E655028DCE4EE1CB30F6F8DCE6DE7A030EA974E09A7F2A44D1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256906, "uuid": "bf60e9df-2881-4ec4-853d-66ea8858ae45", "value": "1536:F2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIC7:gfqhp+g5ru2kmUEt88C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256906, "uuid": "1243651a-578e-4a8a-986d-e1145cf5e436", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256906, "uuid": "bfe4a45c-9323-4e8f-ac04-9b2e00e65fdd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256906, "uuid": "e2299ac0-b892-4db0-9faa-7370d4938595", "value": "catalog-1185682597.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16b174a-b71b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261513, "uuid": "9c4e456a-612a-49a1-8087-00ea0c899357", "comment": "Malware payload", "value": "85a24ee61faa4d1e2212452df9945584", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261513, "uuid": "13c8b7b5-ea7a-497a-9245-18f63a82e29c", "comment": "Malware payload", "value": "36534cd70c52d8a031d04a73017ce0bd6245032117fdf848b06571daa583974d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261513, "uuid": "3582643f-efca-45bd-a185-37ed0d8b04d6", "comment": "Malware payload", "value": "8b6ffbbc8e02b1f1e4754b1d18fbaf94b56a9f24", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261513, "uuid": "1a0b89bc-54bf-455c-88b8-50b90dda902b", "comment": "Malware payload", "value": "5ffd3a8e81b21c7e8f2bd14c34045943b9cab6f952b63db8ea32cb93f7618231ec25d9a31c2c28a714b3c74f0058d305", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261513, "uuid": "30097c30-310c-4021-954d-1d6e57ebfc0e", "value": "2D33F1714BACD9F628B2E4AFC88BF904FFF1C455C4D786664AF871C8B6942459E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261513, "uuid": "13103d21-b459-4097-91ce-b3dd5fe44a42", "value": "1536:OjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkdAX8I:mB9wzbqtWb08UscYJhnpjyq9qBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261513, "uuid": "c91d6edc-a294-45a9-8c7c-56f27d4ef02f", "value": 52849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261513, "uuid": "4d1c1a2d-9471-42fa-a9a3-0dd8c195206c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261513, "uuid": "f0408d47-6d6b-4c3b-b5c7-50efbbf956b7", "value": "diagram-60413909.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcde35b-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261695, "uuid": "14d6fbd1-efd6-410c-b910-e6b4cb8b94e7", "comment": "Malware payload", "value": "0ada167065b16fe250e8f08148b18033", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261695, "uuid": "d2cdfdde-e59f-4ddd-8f81-cb6e2ee1fbcf", "comment": "Malware payload", "value": "365bece5adae3ffad6ede8fdf2ac29ac7d10d589374e231ce95fb6e7ba03a1e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261695, "uuid": "183663f5-883d-433a-89ae-bfa4afbcac0b", "comment": "Malware payload", "value": "98668958aa2235ac4f01b694e384c8dc102bd9e5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261695, "uuid": "bb77dd39-abf1-4bfa-ad96-dec4c51f05bb", "comment": "Malware payload", "value": "f5b3dc6156677c58291563d2bb9e32db9607e36e8547bc022cfbf236a10cbf4aca21d3533c8b7bad344e5829ef0ba624", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261695, "uuid": "ca11de0e-ff67-44b0-9ece-6b27af24c4d1", "value": "8833F1715BACEAE66CB1D4BFC486F904FFF1C869C49A861286F870C8B6D12504E72E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261695, "uuid": "8f84e36c-0fe7-4687-91dd-3338ab5ec7a5", "value": "1536:WjfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67Fa:OB9wzbqtWb08UscYJhnpjyq9qawFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261695, "uuid": "af91d8f9-6525-40e8-b673-4e97fe1d8675", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261695, "uuid": "7b05e030-9910-4eb3-8eb1-8e7e2f39455c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261695, "uuid": "80e6933e-4324-48fd-8646-317d9a8fc3ae", "value": "diagram-723807318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5b9805-b712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621257555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257555, "uuid": "4f9617cc-1154-4cc2-9441-d794a9238c19", "comment": "Malware payload", "value": "3dc398a1a494b0e16253559bf561c116", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257555, "uuid": "872e5989-2a17-427b-a10b-3a0471382b3c", "comment": "Malware payload", "value": "366677436b3242037de3e476d05e9d7c6ed0f5e5b183c39d20238457c7a9228b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257555, "uuid": "ebe9c4ef-f972-44fb-b893-9653db259872", "comment": "Malware payload", "value": "ecfceab7100d2e349e5a5d915831fc39f6982cf7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621257555, "uuid": "d69bb02e-6630-4c51-8983-b10dabae90be", "comment": "Malware payload", "value": "d4a3fa6b96c80aa3294c77e31453cfe24a44e10afbab531dae8d1c30a291d67d6f8f51c28079af58961e21f2a7358505", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257555, "uuid": "3888bea8-9043-4d0a-9b1e-e22cfd93e4a3", "value": "F833F241E655028DCE4EE1CB30F6F8DCE6DE7A030EA974E09A7F2B44D1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257555, "uuid": "d0343c74-17a7-4773-89d6-bdd8209fbe5a", "value": "1536:T2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jI60:yfqhp+g5ru2kmUEt8860", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621257555, "uuid": "baf29fe7-a550-4d2c-9f17-289d2fdeaf86", "value": 52732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621257555, "uuid": "91b963f0-4e85-46bf-b3a2-2303006d64db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621257555, "uuid": "57f5640e-480f-46ff-aadd-07fbcc19b304", "value": "catalog-1688499568.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a56fc4-b723-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621264694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264694, "uuid": "a633265c-5614-4c02-a8f1-51da6c0a973b", "comment": "Malware payload", "value": "fe58aac0b821175b72341b0b0703f6fd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264694, "uuid": "43873da6-5241-4811-808a-fed3612e709f", "comment": "Malware payload", "value": "3667a1bfad952feafcd7fa3e15b5efa049b82fb66ce559631337bffa0f730e2c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264694, "uuid": "bc508276-ee6e-4564-9dc1-a3e1e118ba0e", "comment": "Malware payload", "value": "a8d22fabed1ca865cb64497837df0062483e2d54", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621264694, "uuid": "21667cd2-d6d0-4cc1-913c-f38d59a53787", "comment": "Malware payload", "value": "21d26517bf26e865eebb67eb54715bf24404ff93d8127e16c8ff65b96fa8336f063a67b267f058ca98d02d47ff1544df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264694, "uuid": "09d03017-5941-4c13-8c05-534e103a39d4", "value": "D23301D4A502B08BD754B84CDCAE6D134F3DDD5E433DB892413AC0C74D62AB5A709E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264694, "uuid": "501b752e-f7fd-4dfc-a3af-e476bf2fad4e", "value": "1536:IXXtg3K7774iXfEz5lnm/hQMOEYus1GpuVDT:cXma7774mfCyWMB/4GpupT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621264694, "uuid": "e976c023-3932-4aa3-9cae-bf2081fa658c", "value": 52860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621264694, "uuid": "b1267885-5377-428f-9b65-ac5f5b5781b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621264694, "uuid": "eac613d6-2336-4be6-a288-f46b64061c99", "value": "statistic-896400438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996482fc-b71c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621261902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261902, "uuid": "0c9b7575-489d-49fd-9034-399d4004cd74", "comment": "Malware payload", "value": "4bb1f69d2fc071237407acc1ef0312f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261902, "uuid": "98fd755b-146b-439d-b7eb-8d570e7629a7", "comment": "Malware payload", "value": "36725765bb36f78fbfe9da6b0fa8a84b9057ae72771b280a7bd88efb7e0c3b33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261902, "uuid": "a00be71a-17b7-4eac-beb0-4765419cd12e", "comment": "Malware payload", "value": "4e3bb1cdd7b14785409993b7a6052ecfefbec836", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621261902, "uuid": "8ab4dd08-9084-4c14-ae12-7bfa8be530cc", "comment": "Malware payload", "value": "ae763dfca5e2cac79cdba7c51582e6776153b5abdfa260c7755cea89ed6fc67d00eb5895121f292858f84937fcb1797e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261902, "uuid": "27d0086f-38e1-45ab-bf7e-177e959a43d1", "value": "A633F1311BACDAE66DB1D47FC486FA04FFF1C8A5D49A871685F8B0C8B6D12519E32E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261902, "uuid": "e62fb990-f112-48a1-b825-817c096f06ae", "value": "1536:+jfpagmHzyEqtTSb02jpUsEdYJ5vn8k4syq9qkd2q67W0i:2B9wzbqtWb08UscYJhnpjyq9qawq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621261902, "uuid": "751ad946-e437-4c3f-b920-5a946c41ceec", "value": 52854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621261902, "uuid": "51234ade-c591-4541-95db-d4d8f87cfec4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621261902, "uuid": "23084da5-61ce-4fab-a50b-ba15bff33dd0", "value": "diagram-866881698.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2cae37-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259117, "uuid": "78a89e0a-89ac-4133-9f26-35c284fc15f1", "comment": "Malware payload", "value": "63bdd7deecfafb5070de1f9273ae2c4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259117, "uuid": "d416ab08-ec31-4111-8aac-c8588bea30be", "comment": "Malware payload", "value": "36834bfff7e02e5cbff15efd9405cff7612b203104a3ac2a261cbc0881375b83", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259117, "uuid": "fd71f963-2ddb-4da5-8882-361fd9100dc6", "comment": "Malware payload", "value": "79a4ebb40cf7739a1343eb5c3f56f21ce2eaeda2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259117, "uuid": "04475c84-b170-4141-bae9-72f2bc68f007", "comment": "Malware payload", "value": "0d500bd4495f59843b9b0ccdcf642edc4713e29b504862c4bbf1106b3122cac92d4d9ffd9426db0a854bdd2d1941adce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259117, "uuid": "17b0b1fc-aecd-4769-b2f3-62cc6c459b54", "value": "9033F141E65502CDCE4EE1CB30F6F9DCE6DE7A030EA964E09A7F2B44D1560F4492A68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259117, "uuid": "d58ac98d-96b4-4e64-a714-055b14ac6b10", "value": "1536:82fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIpC:Nfqhp+g5ru2kmUEt88pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259117, "uuid": "0fec1a24-85b4-479f-9b2d-210c421fd553", "value": 52730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259117, "uuid": "40ac22f3-280b-4c94-93be-33f3dad6082a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259117, "uuid": "b0aaf4ea-990a-4641-aa53-9b343952dac3", "value": "catalog-806841017.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11a43fb-b6b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621216872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216872, "uuid": "461c4934-aca1-4c28-9970-ec65ee6dbf42", "comment": "Malware payload (Dridex)", "value": "55c378f86b62fa2bfbe022daeeb707d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216872, "uuid": "0d9f7346-5706-4e21-8b2e-aa9df017830b", "comment": "Malware payload (Dridex)", "value": "368a08c5b224a730c539c25a8831f642abf735b4792ce0edae53eebc100a0da3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216872, "uuid": "26040f36-3b3e-4342-8676-14561b3c77f3", "comment": "Malware payload (Dridex)", "value": "8bc1aefbd41d3aee6c55f5f5a04551a015b6e1ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621216872, "uuid": "32d22c41-588c-45f8-8999-b712e640e761", "comment": "Malware payload (Dridex)", "value": "ce05262918f9c3e0d301e9656455389df5fa25f16ba76d9b760def6ec46af47ed8c891031ab66b8086b684b6a9874ee4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216872, "uuid": "323e8872-aa71-4122-86e0-f7d9d61a7d2e", "value": "73F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216872, "uuid": "5edcf697-4c4f-4965-816d-cfa10410d8ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216872, "uuid": "38bb06a6-01ba-4e24-8509-6c89ef6e76c4", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621216872, "uuid": "7e24b229-3653-4a9d-9872-d72c92baae48", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621216872, "uuid": "5253d3f1-628f-4525-8f1a-093a60b47989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621216872, "uuid": "1f4b9ba7-dcf4-4693-aacc-c9bd17a1ec9d", "value": "55c378f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48873ae1-b715-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621258760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258760, "uuid": "91f647b6-cd3b-4f2c-a79b-76b7c8c19f3a", "comment": "Malware payload", "value": "cfa59454135abda7c015d456259e2dfc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258760, "uuid": "4a1793bf-9914-496d-980a-efbeca6b6723", "comment": "Malware payload", "value": "36a646b0a0f56e4d9f24ed8eedf8c43e19b45adb805e9a9bf4ebd51a4408adb5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258760, "uuid": "c828bcee-5480-4c1d-8886-a6826d6a6424", "comment": "Malware payload", "value": "9ccca9d576ba176b3a64294634eeaa95c28715bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621258760, "uuid": "d63acdca-2082-45c8-9402-78bb153ceee6", "comment": "Malware payload", "value": "00839a23aafda1e255299d7b6a254ab9810ba3e98065f57129a575c024a72c816c86a84eba18c3fe3cf667675fa2ac28", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258760, "uuid": "ca356749-d603-40bc-8d56-a68ae40119d7", "value": "8233F196D754018DCF8FE1EB24FAA9DCE19E7E030D9A74D0DA6E6A05C1930F0192E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258760, "uuid": "ac623ab1-6840-4821-bf7d-dab85a3dbf66", "value": "1536:B2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIDJoR:sfqhp+g5ru2kmUEt88Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621258760, "uuid": "3a5f461f-64ca-44c2-853b-9ab8e8cf6d54", "value": 52729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621258760, "uuid": "2c46362e-d5ea-4a2c-8957-00063ea17c18", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621258760, "uuid": "78692aea-4925-4656-82da-777ad4ec70ef", "value": "catalog-543181912.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58588ea-b710-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621256849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256849, "uuid": "c1ff214a-628d-4ba7-842e-e8a11ea1d547", "comment": "Malware payload", "value": "050676d1ebe1de02f90931acae840af0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256849, "uuid": "305faa2b-ac8d-4791-9d9b-66c355d93821", "comment": "Malware payload", "value": "36b33d3c696a6039ace68555232296f5287762b5e3a0a14efd3c7166cd025e99", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256849, "uuid": "6bb0a336-6d51-4bba-a9a5-6d1086643593", "comment": "Malware payload", "value": "a59f5c38bb2c96af8bab563406f0c3b1004b3a1e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621256849, "uuid": "f87ce53a-e051-45ca-b80f-ff769d26b9c7", "comment": "Malware payload", "value": "d66849d056ff31a8bf613372d657ff09db2b2753f612eaa7d37b773c24daa50e953b70c0257f11424af0720b63283bf8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256849, "uuid": "c604d158-33a1-49db-ad24-472f173ab9fe", "value": "8533F1469219118CCE4BE1EB30F6FBD8E6DD6A430EA9B0D09B7D2745C1A30F5482F55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256849, "uuid": "e919af54-3b50-4c68-98c7-075da3d3c499", "value": "1536:w2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jIAuWSl:Bfqhp+g5ru2kmUEt88AJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621256849, "uuid": "1d897c9b-99a2-4766-8e7c-4209b372a344", "value": 52731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621256849, "uuid": "8c560c16-f7fd-4b06-a431-7ba818a4d02a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621256849, "uuid": "e6be6174-9154-4889-a12b-1f8c3b692269", "value": "catalog-1139651173.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b60d78-b716-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259267, "uuid": "b7a4dbac-8b27-4b8e-bc9b-b330a1bfdf96", "comment": "Malware payload", "value": "20f9feb66f4d9271882e4ddb773f7ac5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259267, "uuid": "6062b29f-0d23-4fe3-947c-e433a96dae8d", "comment": "Malware payload", "value": "36b8f5d9dce860e59f245ee7149c25456a8477a1b9407a3923f34d9a3bc504b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259267, "uuid": "f6c0a5c4-eeb7-4d61-8ba7-da05e9d7cfc8", "comment": "Malware payload", "value": "cfebc79b4d645827d49d9dfd946cd591336a10fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259267, "uuid": "04b7b6d1-cee2-47d3-ac85-5be65aa701a3", "comment": "Malware payload", "value": "b9751592c7a114b686ca5f498eb3244c2e35bf5557b3f05e555c16e0107a4b4d8d4d60814c070fbfb8d698b8dd96c37b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259267, "uuid": "f21a7601-b042-461a-ae4e-ce90a7417c9b", "value": "0B330285D644128DCE8BE2DA20F6F9DCD6DEBA430DA974C05A7E2B05C6970F1482E5CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259267, "uuid": "22cb4f63-d583-4514-9c33-d1edac518e69", "value": "1536:q2fq+YpdQg5re6enGS3K78v+S1KmoFZStEtnA5jInwdamz:Pfqhp+g5ru2kmUEt88mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621259267, "uuid": "9995ea35-1c99-47c3-9a59-30f4e79753ad", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621259267, "uuid": "ec910b78-a361-4189-b852-fcba76f5d58b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621259267, "uuid": "d51de14e-4a17-4f4f-a276-1d8998ef0ef5", "value": "catalog-910385343.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e1a82b-b71f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621263057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263057, "uuid": "28b37726-cc3d-461d-a766-44113dca1280", "comment": "Malware payload", "value": "ef22c24cf36a048ace02005ff28a3cb2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263057, "uuid": "059e741a-e156-4125-ad94-59b8af2cb6f3", "comment": "Malware payload", "value": "36cba17f8af64ef336dcc791e61e81acfb8a13ec5946137cf1f3e77c24c8bf6d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263057, "uuid": "089b1757-a9ca-476b-8143-da2784452c77", "comment": "Malware payload", "value": "104fd28f8fd11095978dfa3beeae3dd09f4491ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621263057, "uuid": "c83978d0-749a-4182-8dcf-9ea24eedfa6e", "comment": "Malware payload", "value": "330009e05d1ee24752c3aa9c2665f0da896c052c4b16a5cf137c24a12b25933fdbd08efe3b9ce08d51e55e938d072db7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263057, "uuid": "0997f9fd-2b63-4506-90ee-73abbbccc9f4", "value": "243302E09902E087A7597C68DC6E6D079F3CED0A473DB853112ED0874EA25F8A745E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263057, "uuid": "011821da-f99c-4143-8e54-bc3aa3fe7e41", "value": "1536:tXXtg3K7774iXfEz5lnm/hQMOEYus1Gp07qRe:5Xma7774mfCyWMB/4Gp07T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621263057, "uuid": "267f7fb9-b98e-4aa0-ba1e-4f74463fb162", "value": 52862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621263057, "uuid": "16f147a4-d4f2-4e8b-b909-77d8fdd9ec42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621263057, "uuid": "bdae23f8-a0d3-4214-8e37-9a408f847472", "value": "statistic-1586244274.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72560bc0-b717-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621259689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259689, "uuid": "f15e0864-0184-4888-a6db-9c51e7cebe8f", "comment": "Malware payload", "value": "ad4521e38a2ca1546f3b785fd19e211a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621259689, "uuid": "29602fa3-356d-49f9-b6a4-14bbc8061489", "comment": "Malware payload", "value": "36e0c711d77f916ba0da7cb283e07271ace694a4dad69d6c8031b718c4afc885", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true,