{ "Event": { "published": true, "date": "2021-04-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-15", "timestamp": 1618531382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f173c0f9-e814-497a-86ca-b64d927c5467", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5a6f5f-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "f1c5e3df-bd85-4f7d-9a96-2c449569c1a7", "comment": "Malware payload (Dridex)", "value": "da5ef7d4039d71b2f3d01af736389a38", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "dca361a3-2c60-404a-9a40-6b2e8b5bf3b9", "comment": "Malware payload (Dridex)", "value": "00194918930f9c572dbb9b1cf0a3271f270d7298b5c22a026e2de253455c0e55", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "de5b5b56-b2dd-4dd3-a091-01ea2a4236f6", "comment": "Malware payload (Dridex)", "value": "e49779db380ad608c8621d300d193ad056defb8f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "73d6c46b-22fa-4e04-86fd-160cecb1425a", "comment": "Malware payload (Dridex)", "value": "d479699075cffb1580ba81d4bf4aa0d88142562bb566d2a6c4311fabc9c104a916f99c58cf35e9332f18e994f9b77722", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "f4722d0e-a91a-41da-aef4-92fb16b4d55f", "value": "5CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "5b69175e-97e8-4fed-bb8a-ab79e00a4c25", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "d4c049d2-3d3a-47e3-a440-6ca00fd96ee0", "value": "3072:6iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:5eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497185, "uuid": "5f20ab92-903b-4a56-b366-71783c2e0f43", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497185, "uuid": "3e831a5a-8c69-4936-b64c-a1be286470fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "5c37ee80-a47f-4be3-9f93-f1934d8604fd", "value": "00194918930f9c572dbb9b1cf0a3271f270d7298b5c22a026e2de253455c0e55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e4bf79-9dd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618482172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482172, "uuid": "c5fedb55-5f65-4aa0-8dcc-aa7ecac6a3b2", "comment": "Malware payload (Dridex)", "value": "3fc3e9a59f798a7d2e41caf459e21e2a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482172, "uuid": "e54ff36a-a31a-43e3-8843-5a1400fa4989", "comment": "Malware payload (Dridex)", "value": "00495ddac05690a488ba8e2e1339aad175748b266d345f8ca8dd58255d058f96", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482172, "uuid": "2a45c965-bc66-412f-a996-4b50039f8ced", "comment": "Malware payload (Dridex)", "value": "ddcc76b0c395f1ff2eca7dda73cd56465c73d7cd", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482172, "uuid": "cd475f42-d984-4424-9a00-5b4670e207fd", "comment": "Malware payload (Dridex)", "value": "28bbf891a916102319d44cc3f3de272247c2e9411a6fb0abb0228b4fff4a9844dce1b8df81cd1ca6b3ead8901da3c7cf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482172, "uuid": "1b700910-492b-48a2-883f-ca5294c5dd90", "value": "78F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482172, "uuid": "0b173a65-53c9-404d-bbcf-6e8e73518ec5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482172, "uuid": "58898db2-d020-44e2-9aba-ba73cb1807e5", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482172, "uuid": "e43c4b65-1ac0-4fcf-888b-00f119150ab0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482172, "uuid": "21c458b7-4b0b-491c-808a-4e918cc6b814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482172, "uuid": "401b47b8-613a-4382-8c23-e661f1040243", "value": "00495ddac05690a488ba8e2e1339aad175748b266d345f8ca8dd58255d058f96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bf3af1-9dc2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618474252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474252, "uuid": "d6858797-53cb-40bc-aa0a-36532c4e701f", "comment": "Malware payload (AgentTesla)", "value": "38764210fcc40e034fa7f3a8f1a730c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474252, "uuid": "e046da5b-e59d-436b-aae3-6e6046a90b92", "comment": "Malware payload (AgentTesla)", "value": "0092baf75f4a377758981d7f51d75b78664aee9efc7d44c7feed0d88b8729bb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474252, "uuid": "3c0ac858-da82-438e-a7d0-6ead2b630d43", "comment": "Malware payload (AgentTesla)", "value": "def0e4cbc1d0d139af323cd62e02789195b60a31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474252, "uuid": "a82570f5-20c4-4405-a40b-be5723f77a8d", "comment": "Malware payload (AgentTesla)", "value": "6cb7e9c3223eeef46d31d4bf7942ac40ec3d0ff03073f6eb17431d0dad5c7a7b9a9d4f08616f8039c610c34089913e32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474252, "uuid": "9ea4cf90-5bbd-49bf-8677-b3ec2eccf9fb", "value": "BA256B98B544B19ECC1ACB318974CC3096227DABD72AC10F60DF3D5B7B7E687E9141A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474252, "uuid": "774458ee-076a-4995-8579-683e6e4d4ff8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474252, "uuid": "7beed3f9-7046-486f-830f-ad1ae0b5e274", "value": "12288:ETjnvn1Sg9rQ02n93pAhG2oBV8DwQ1ir+sLQnjl8fQeWblF0tDMfMnDKZ38d3zou:Evn1X9r893pAGV8D06ReWbP0Y1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474252, "uuid": "eca8d19d-66c1-44aa-89d4-40342374f80f", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474252, "uuid": "fb974e9a-92d5-4ee4-be62-80d3ce2b2feb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474252, "uuid": "dfc320b0-3a05-4994-8b5f-5d1bffcd44c6", "value": "Payment Assistance'.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238e297a-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497034, "uuid": "8a76461b-e637-4c88-a434-19ad87bc0cb7", "comment": "Malware payload (Dridex)", "value": "7311e8acadb3befc9e1db744a18d095c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497034, "uuid": "8d13e871-df47-4ed5-a0bb-288c567665f5", "comment": "Malware payload (Dridex)", "value": "00d7ea980b0cd1621423508368abd910ea6e80deaf1c31be5609f141064611e3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497034, "uuid": "11029e79-7b3a-4863-a0bf-fdb66ed4f2ed", "comment": "Malware payload (Dridex)", "value": "7da004ece4032edaba1081049546552dd4ea6a8d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497034, "uuid": "3bfa6f12-cd0d-44d0-bb1a-2f412776ba30", "comment": "Malware payload (Dridex)", "value": "22a4e55a3bb613f4d8e407769d282c0cd0b2f2e4eb4c187458a7d8d75a8f54b478076930d9cb8560f5d61b55b03207e5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497034, "uuid": "5e0081e4-6f1f-4165-a9b4-ab97302bc586", "value": "65F3E00AED9FE988E84C55F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497034, "uuid": "c0307809-c173-47d8-82fc-f9ae0ae6473c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497034, "uuid": "2089cf16-4f03-49ba-a897-f37c84f2cf4e", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497034, "uuid": "a87ccf0c-8e08-48ee-a019-1af93a9e4b97", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497034, "uuid": "8dc75fe1-ba06-4309-8e88-56cd64b171a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497034, "uuid": "c0d5128c-f807-43ee-b428-b00db45d4143", "value": "00d7ea980b0cd1621423508368abd910ea6e80deaf1c31be5609f141064611e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b79214-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480697, "uuid": "21203063-2182-48af-8ae4-26bbcf7149c0", "comment": "Malware payload (Dridex)", "value": "88c5003a0df6fa5b757af87faf258304", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480697, "uuid": "d57de55b-1df5-4048-b034-9d80484648d2", "comment": "Malware payload (Dridex)", "value": "01227fc91ae40550a592adfc85205097eded4f06bfaf76d21917b6729c7b1217", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480697, "uuid": "bc0eabba-88be-4cd7-8b75-550c753af443", "comment": "Malware payload (Dridex)", "value": "8316c7fd648d18960761b465d92502c7dffe9e10", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480697, "uuid": "976bba6d-337c-48c4-9478-71e9f1ae2f63", "comment": "Malware payload (Dridex)", "value": "a0f240e9d5aa2b92c51bdd35dc09324f709b3fed3193ab8e8fb75d371e95c51125713d81e0a4284d4e4fbc68cf6dda66", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480697, "uuid": "3b7ce6be-c597-42c0-8775-7394a7df9aeb", "value": "DAF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480697, "uuid": "41657748-5b83-4dfc-89c8-0a740fd3d845", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480697, "uuid": "6aff6368-af38-4195-a67d-d14f96d4b7dc", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480697, "uuid": "a8cba5af-377b-4428-b8e3-b4c7fa282402", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480697, "uuid": "7d98f64f-b256-416e-b4b0-1ba4de3785e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480697, "uuid": "db6d9f76-b21e-4a73-8eba-56a4f436683a", "value": "01227fc91ae40550a592adfc85205097eded4f06bfaf76d21917b6729c7b1217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b952a10-9e05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618503168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503168, "uuid": "d3105a4e-5b80-4c65-8753-23c60bdc3366", "comment": "Malware payload (Dridex)", "value": "5e06a1c2a3ecea2b8468c4d591143936", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503168, "uuid": "eba2e9a2-6cab-46d1-a471-1fedcfb60704", "comment": "Malware payload (Dridex)", "value": "0125af151aac7232220fdcd33d4a787d55763677f720b2c0b7a711dad6c2c36f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503168, "uuid": "423eaac6-c30d-4fb5-9df2-59e89f0fb217", "comment": "Malware payload (Dridex)", "value": "404be468e812a30b7cf149c31a5ed65bd5f33939", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503168, "uuid": "fa382d10-5b17-45aa-a6d9-e21c491dac01", "comment": "Malware payload (Dridex)", "value": "f445eb5770ae1eeee8471c29e63f131e029bf3c9d66199357287f5f5898c3631566c0349fed0a8946b2bbb42732e9fc9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503168, "uuid": "88b48d9a-4839-460b-bf70-acad9efe4764", "value": "0DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503168, "uuid": "f10dd1b2-7c62-426e-abb8-f31f7d3e187c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503168, "uuid": "01707de4-0a68-4c92-8dcd-2aabda56a595", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618503168, "uuid": "47c8f144-db7d-4299-b795-58a779c49e74", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618503168, "uuid": "3fb49d31-df9b-4f54-8e30-e347aefc402c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503168, "uuid": "a7eb5980-fc88-4567-ae57-b3941f89f5c5", "value": "0125af151aac7232220fdcd33d4a787d55763677f720b2c0b7a711dad6c2c36f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc63ded-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618514820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514820, "uuid": "db2b7a8e-7dcb-4d5e-9085-2491329b5a5b", "comment": "Malware payload (Vjw0rm)", "value": "e7e2709403d0d4d54e8d8eefd41b7470", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514820, "uuid": "a0b6020a-6453-4934-a70e-9ab9327a5c8b", "comment": "Malware payload (Vjw0rm)", "value": "0160270623bcd2a9ab002f704ca81985238a7a8b9001ab658aa39a65877e1352", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514820, "uuid": "50a5f7e1-44a6-4ac5-8765-6bc1939597a4", "comment": "Malware payload (Vjw0rm)", "value": "9a0c36dce9a36fcee6c11629ad883d061e9840e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514820, "uuid": "0509f44f-1e85-4250-a0b7-6f302e15df11", "comment": "Malware payload (Vjw0rm)", "value": "20fe0646e1e7a839a4e6b9cbec8543f39071214441cf2ee50f9e8d51cb05d47436ec01e31cc79e10aee6dc0949d4c7eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514820, "uuid": "b0d147fc-a6f4-41d2-a88c-5e39fa2dbc6e", "value": "9ED24968B81B1F11EC61A10D64669180BC6F23DCD4B424B4BC5E9BBA3D6E624ED313F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514820, "uuid": "235cd88b-197b-4287-b04f-b4e9c864df11", "value": "192:BPDFXHhDocC42bNSbqkDkQH9ftOF6dvy6d2U6k8DQDh7MvqqSHgRSHX+BqgC4Xh5:BrdHghkQAFO9cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514820, "uuid": "fe0a2a94-e901-4cf2-9d08-cfa79bf565b3", "value": 30642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514820, "uuid": "d87c0635-635d-46bd-b3e0-947768173ad4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514820, "uuid": "02bccdb3-a40c-4348-abe9-68d6c61ec40a", "value": "ID840839370101.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af28fa1-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496348, "uuid": "65d71790-0170-4726-981e-49cf87c70210", "comment": "Malware payload (Dridex)", "value": "a6571015a37de239a83e516d17b2ef5b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496348, "uuid": "ca4081be-98ff-4b4b-939f-623f265c324e", "comment": "Malware payload (Dridex)", "value": "017901e05feb21c1a80640c8f8d8b9575fefea75be56f82ae7303426bb665670", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496348, "uuid": "53ec61a0-5d3b-4272-b52f-71d4bf1d1e52", "comment": "Malware payload (Dridex)", "value": "73e8fd6ef6f1f7274b24b6aa35763fbdceaef706", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496348, "uuid": "9ed17dae-043f-445d-a35d-9131b41e08b1", "comment": "Malware payload (Dridex)", "value": "8237eee8b82c6d943a156703e129f74c182af89bc8b98e7bed07eba32a59ead18293b1e95145463d52ca723ad9aa70c4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496348, "uuid": "2cc4d48d-47ce-42ce-a8f9-0e3a67dd2d34", "value": "ADF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496348, "uuid": "fcef126a-cbaf-4829-9962-7c9627df6001", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496348, "uuid": "8732d409-1a87-4720-aef6-57331176f9e8", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496348, "uuid": "51300f84-869d-4cdb-8977-763a022a8b41", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496348, "uuid": "7de86f5d-85d4-4728-93a3-e0b8351be3ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496348, "uuid": "e393dcd2-3371-4e25-b3d3-d062803291ad", "value": "017901e05feb21c1a80640c8f8d8b9575fefea75be56f82ae7303426bb665670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c82a54-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515956, "uuid": "a649b85e-d1b5-434f-a278-e9a57906a1a6", "comment": "Malware payload (Dridex)", "value": "689e0dffe2b723730f7ddd13a34a522d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515956, "uuid": "ead34fc0-80cc-4d50-9ce9-4dc04b9b5286", "comment": "Malware payload (Dridex)", "value": "0185644b208315d95d4b2257327947b9e2590de6ee1055ccf56bcf978bc432bf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515956, "uuid": "b3dca959-b90d-4a80-8363-11416dc84127", "comment": "Malware payload (Dridex)", "value": "89f24f21b8b3d86f2bd1cd76ae27f09c8e6e7537", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515956, "uuid": "782862b3-82e3-4e0e-909b-011d8d6cb770", "comment": "Malware payload (Dridex)", "value": "c7ecfdcb079aec5731fe0b1d894a916acf1cf07761b6cf4478207506305db4532f099514527bcae7e5cccb17ad640286", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515956, "uuid": "d4ea86ca-8809-4ddd-8f7e-24baf8f25acb", "value": "74F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515956, "uuid": "943adeff-991c-4e1c-9503-37c2daa64397", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515956, "uuid": "88f34e43-4324-4ad7-80a0-4e0ebe155990", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515956, "uuid": "23ad3be5-710b-49b7-83dc-72dd2db8c23e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515956, "uuid": "7dfa19b3-e73c-49d7-830f-80da3fbf12a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515956, "uuid": "36724fac-4e65-4905-b7ee-e221d3614f10", "value": "0185644b208315d95d4b2257327947b9e2590de6ee1055ccf56bcf978bc432bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04b4bb4-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618499042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499042, "uuid": "55b63299-a4fb-4024-bfb4-67514b813c6d", "comment": "Malware payload (Formbook)", "value": "4659cead2d6d625628fdaa165bfa8915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499042, "uuid": "c8634578-2c6f-4127-9b55-4935e8738032", "comment": "Malware payload (Formbook)", "value": "01b7af0ac3fa923e99e04eea39ad50e1a66649dce96c1e5ac93c40cccab228e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499042, "uuid": "f2c3901d-f2d4-4921-942b-9aa6742e597c", "comment": "Malware payload (Formbook)", "value": "e505ca1cb64689f11a3bf2db833295b9db59ec24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499042, "uuid": "8ef37ce3-c14e-4aea-b42b-8ca000bc05f0", "comment": "Malware payload (Formbook)", "value": "91783f6efc5a5a7335867de68c38fb4373013a6741308971030dc766c3845630deed3ca44d3f69dae614e216e7c0ba9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499042, "uuid": "69c451fa-a522-4c07-ac33-f44585609f72", "value": "C5141273F7D0C87BEB51CE765A23562EC3B582280026590383F46F9BDBBB951D176122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499042, "uuid": "931f9244-43b4-43e9-91c2-0f531d740f1d", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499042, "uuid": "aac33421-9a4b-4073-92bf-7cb59b3685f0", "value": "3072:HyewmN4skJ6J6Z7IXqEJrsMKf+PyE3PqC+BP7iZXrCe+oiIAAqv08keNkOjP8Tmb:HdMyXqIs9+K2yBPGwQAAqPkukEP8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499042, "uuid": "f585818f-96a7-4eac-9b7a-ce8d2366e11a", "value": 206361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499042, "uuid": "90812c9b-25f6-4d37-8644-7c22ee00a926", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499042, "uuid": "20f6306e-f3fd-4931-aa76-25c34124ff05", "value": "4659cead2d6d625628fdaa165bfa8915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f4c2f3-9e28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618518303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518303, "uuid": "b540818a-4ea3-4127-b442-09dd00045f54", "comment": "Malware payload (Dridex)", "value": "c29c6e7caf0f77ecc57d7bd9b0d80199", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518303, "uuid": "53fee4a0-9e1f-47ac-b066-ece38076a07d", "comment": "Malware payload (Dridex)", "value": "020adfc4ee65f1a66058b18a70a7a032e425afb7549bd424024f202ade30c254", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518303, "uuid": "c4ff6ea3-9c39-4aff-b759-79756924cc23", "comment": "Malware payload (Dridex)", "value": "0d7bd23309a95fa4ebe3152e098b6f1310414e13", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518303, "uuid": "15cb7e67-3492-425c-ad74-275062c39490", "comment": "Malware payload (Dridex)", "value": "79bf36b41e0bdf8964c476d6925e6803b12febca1b933b05fc898b1f9d79c757264bdb7887aaf1b457a7a8239137ff73", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518303, "uuid": "5593791c-679a-4b7d-88a1-6e53c0c31967", "value": "C4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518303, "uuid": "88452a2a-d031-44f9-8611-101683331133", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518303, "uuid": "b3faf5b5-3c17-4e48-9c28-9bc233c04a55", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618518303, "uuid": "9adc4ea3-fbad-407c-8ce7-366e695de214", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618518303, "uuid": "77479ba6-8ea7-44e2-a9d8-05ceca518604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518303, "uuid": "5ccdad01-f0e0-4b7a-8b77-1696ba166a6c", "value": "020adfc4ee65f1a66058b18a70a7a032e425afb7549bd424024f202ade30c254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d9e2c7-9dd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618482275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482275, "uuid": "b4ed481a-b9cd-40c8-8653-d0c7a17312b1", "comment": "Malware payload (Dridex)", "value": "cb4ea2362890f731a4bcffbe517c4beb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482275, "uuid": "e6e569c7-a6d9-4293-a21e-49948233821a", "comment": "Malware payload (Dridex)", "value": "021c9085661bc5759ea2bc77196b224a5f488fbf34af5033ef63de2d6c672053", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482275, "uuid": "f6756220-e771-4b34-ba33-a54409ee71fe", "comment": "Malware payload (Dridex)", "value": "fe970180ea473451bdf27bb3483ad1a9381a26f2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482275, "uuid": "4f0b77a8-fe4f-4f53-9c36-c528ace4c180", "comment": "Malware payload (Dridex)", "value": "f0bfd53f7e4e3e0f563deff6d15cb9fe2079c1a751745ae12b3140fe8ca6ea403fd5f04abaf6b84f102f704ca6d35b79", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482275, "uuid": "3bcecde5-aaf3-4ba9-8cf5-65b799a94719", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482275, "uuid": "362a7a1f-6877-48aa-be41-bc5c2aca1895", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482275, "uuid": "60a9909e-60ca-4374-9ee2-a37833723b07", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482275, "uuid": "d337490e-4d88-4d50-b192-c2392f959f46", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482275, "uuid": "37384ab8-5171-4de0-90d7-51d63724273e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482275, "uuid": "45faa46c-ce1a-4cc7-b289-2c2d6014f1f3", "value": "021c9085661bc5759ea2bc77196b224a5f488fbf34af5033ef63de2d6c672053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c6eb8e-9dc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618475051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475051, "uuid": "a185f261-2504-4c1d-8529-4f14c03f27e0", "comment": "Malware payload (Dridex)", "value": "eda4658afcf9779d96232bd5a6856cc4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475051, "uuid": "c7b033b3-ff86-4093-961d-8a8d2743c200", "comment": "Malware payload (Dridex)", "value": "023383dd3c872449d191da6161e92748e2978ac0ef1c50171e935665a0749206", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475051, "uuid": "805a0e13-cc97-45b7-8023-9ac0ff08c81f", "comment": "Malware payload (Dridex)", "value": "3acc9b9ca159bb816b54791674f73ca4e28a327b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475051, "uuid": "b84c8ab6-dc00-4fbb-bcc9-f1bb6407bcb8", "comment": "Malware payload (Dridex)", "value": "7534bef41eb0b631639fcd72dc8ebe1ba6da9f027eb95bf0e9aabe5b5a6c0dcf9cdc8ed314f0c5201fca06be9bca8051", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475051, "uuid": "347f573c-5f93-40f9-b900-a404eb5053b3", "value": "ECF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475051, "uuid": "2a4c47d0-d17c-4ba0-a847-1b23f7b6dd3e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475051, "uuid": "d01c4993-4938-4279-ac25-b6300e131a47", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475051, "uuid": "90d30016-446c-4776-b4a7-f17d12626061", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475051, "uuid": "c81dde8d-95ea-49f3-8913-c1fe7d3b8b07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475051, "uuid": "84be8e81-5984-48c8-888d-7f3d0cc4b696", "value": "023383dd3c872449d191da6161e92748e2978ac0ef1c50171e935665a0749206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e035430a-9da2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618460843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460843, "uuid": "a9b0be93-ab5f-4545-ad8e-8aba1e3ad2bb", "comment": "Malware payload (Dridex)", "value": "d0b4069a96f76ba054f04175e217d01b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460843, "uuid": "516b62fc-c797-4dea-ae43-d2ffbb57d1bd", "comment": "Malware payload (Dridex)", "value": "0265a57ab1dea3b1a8aee70b1032223ebae93858ae9800b7fd82518accf7036a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460843, "uuid": "612b3b73-98cf-401b-acff-4005a28ac807", "comment": "Malware payload (Dridex)", "value": "e738a8a35eaffb0adcde4cb8720a188850a1ade2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460843, "uuid": "a78f7a2d-d9cc-4734-8578-45098b3c3948", "comment": "Malware payload (Dridex)", "value": "02542e980c39657af412497f93604730c73ef510646827da914e036ee22a900a08d01da7d4326190da5b66741707996d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460843, "uuid": "b4b3bb77-d355-455a-8394-e4b7015beeb4", "value": "AC249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460843, "uuid": "e169ea88-5e7b-498a-9633-d13a319abb24", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460843, "uuid": "4030fca2-b37f-4927-a256-11ca4237120f", "value": "3072:v0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:upepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618460843, "uuid": "da045d7e-c2b7-4d7d-9149-fa772f040947", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618460843, "uuid": "5a630060-171f-4b89-94d3-a9d304fd866c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460843, "uuid": "528cd3e5-902c-4aae-a3d4-0b56dbeaabd7", "value": "0265a57ab1dea3b1a8aee70b1032223ebae93858ae9800b7fd82518accf7036a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00338bad-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464333, "uuid": "ff3c3460-e607-45e4-b29a-b74cc4aab5db", "comment": "Malware payload (Dridex)", "value": "f44b483cc9b26b95880f7c9d47be4f34", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464333, "uuid": "bd515769-5850-4fbe-8ad4-6a1eb23d7396", "comment": "Malware payload (Dridex)", "value": "028ada2ab2c2037797e004efc4a1dd7afb49a389d18faac04ce54d5955cdd276", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464333, "uuid": "a1ad0633-462a-4bff-b327-924cb6cc65e7", "comment": "Malware payload (Dridex)", "value": "66c597d2d9391df602ffce2cb2e7b8cdbff0659a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464333, "uuid": "bc84287b-7042-4e51-8271-813bf74186e3", "comment": "Malware payload (Dridex)", "value": "111a0dd40af40d4d81c01e21eaf71af3867b23a7abef3e3f6a71c9515744a1b346f66c7e5bb6b2648c6ba38040fe5417", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464333, "uuid": "aae24fd7-c98e-498b-969e-264a1050c201", "value": "E9F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464333, "uuid": "2a873919-7a89-4292-94fe-8c43b99d92e8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464333, "uuid": "a3280aeb-2987-4828-8bcb-7ea6e3faaf36", "value": "3072:LA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:L3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464333, "uuid": "7ae1fd33-8519-4762-8f18-cab2c6af62ce", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464333, "uuid": "0c313a58-9db2-4ee9-9178-77cb990af86b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464333, "uuid": "aced9b96-1202-4770-8cee-a590f2271b90", "value": "028ada2ab2c2037797e004efc4a1dd7afb49a389d18faac04ce54d5955cdd276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04be5f0b-9e36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524040, "uuid": "99ef2e22-82fd-4ad7-9d16-da91a0d24f42", "comment": "Malware payload (Dridex)", "value": "0238f81829538605c6885b22b233c183", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524040, "uuid": "7f98180d-0ea0-4c49-9d67-9d2fdc8424eb", "comment": "Malware payload (Dridex)", "value": "028e0f07b68fe7c7dc77c4c07df2bfff6fd8db2bb372f438bee545de9f1a3ea7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524040, "uuid": "0f28db83-cc9b-4f3e-9a2e-c2a49cd9cb9b", "comment": "Malware payload (Dridex)", "value": "b200b09f30d178005158048e12eda29fe99e9b89", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524040, "uuid": "addcce40-e59f-4431-87be-bfbb0cadd274", "comment": "Malware payload (Dridex)", "value": "fef1ce7b0169f1e876b0c2bad09f4eba8ebe0cb1ae72e43ffb18bfa85b5ee6ead3d3fbf671eeb901b5eca7526821532f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524040, "uuid": "7c14e07e-86bc-401f-9096-805373a4f398", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524040, "uuid": "3d3fc136-dad6-46d4-8ac3-5cc954d88486", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524040, "uuid": "33be18d5-060f-42c8-87b3-fb090a8accdb", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524040, "uuid": "9f2c3bf9-57c8-4891-adc5-f57697c9839b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524040, "uuid": "29328322-3662-43c4-b615-848b69173551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524040, "uuid": "ef634e85-b621-44d3-a5d8-a4de9b8137a2", "value": "028e0f07b68fe7c7dc77c4c07df2bfff6fd8db2bb372f438bee545de9f1a3ea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285d502e-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480721, "uuid": "147ca819-6ba4-43ec-b9a9-902f43aac7b6", "comment": "Malware payload (Dridex)", "value": "095756d4a0af7f4292dcfd62688e8c48", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480721, "uuid": "bf49b408-38c4-43a7-a157-4b97f4045a14", "comment": "Malware payload (Dridex)", "value": "02a0fd5a6af4cd0b5d037fd7b9ee19d51b42556a93e0f5995201c8f996d9cf0f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480721, "uuid": "57428edf-a98a-4fec-abd9-f2a8d87be04a", "comment": "Malware payload (Dridex)", "value": "9dc26a69fa751988408cc9d33ee691f5f30b65fe", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480721, "uuid": "6c16ea99-b6c9-4a87-901b-d80fe5831598", "comment": "Malware payload (Dridex)", "value": "fe05a539dc6ad150138b0abda145367be449df815f5f24906f60281825d226df906d1fca6907324eb4eb06d225c2a86a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480721, "uuid": "fdba8c36-e3c2-4004-89f0-43129c5200c2", "value": "F4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480721, "uuid": "da699e6b-130f-4eab-96cb-01ce4242aa55", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480721, "uuid": "38df97aa-e7df-4bad-bcb0-f64e049f0c4e", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480721, "uuid": "90e2e65d-7337-4be9-a98b-f17d50e89262", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480721, "uuid": "8d555b9e-05b8-4b4c-98d6-af6aad1b3c4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480721, "uuid": "3b2e2e24-2fd9-4c9b-87b9-d539f9dd9506", "value": "02a0fd5a6af4cd0b5d037fd7b9ee19d51b42556a93e0f5995201c8f996d9cf0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bb875b-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498962, "uuid": "295e4c3e-9483-4bbd-b2fb-2a34165b432d", "comment": "Malware payload (Dridex)", "value": "b94953c4debbd254b432ec74275c6c31", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498962, "uuid": "f367d245-e43d-4086-b097-d68f56ec6ad5", "comment": "Malware payload (Dridex)", "value": "02a8b9fc9a425a1e0ce3fd213870536c66e45bc3d94893fab6edc9066e0d3917", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498962, "uuid": "a60e1d55-eef7-440a-8d19-f79ea7c4d4c3", "comment": "Malware payload (Dridex)", "value": "754f806a7b5fdda76d5cf833037618ceb867279d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498962, "uuid": "faa5c572-4536-442f-b2a0-37c93ca16c5a", "comment": "Malware payload (Dridex)", "value": "66c90976d822bf7452afc72b0a4bd0d6688881520d77b2132557a9c2d6b518a0d8397269ee7eb5775549b0eb108d416d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498962, "uuid": "b5b6315f-6329-4d54-83f9-89c39d50fa7f", "value": "D8F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498962, "uuid": "a7632c4e-947a-4eec-9305-61dc2cde6aa0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498962, "uuid": "c2772264-3de3-4aef-afdc-e0a3860358e0", "value": "3072:LA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:L3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498962, "uuid": "3639fdc1-1369-4bf9-81cf-f069d7dbcf8e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498962, "uuid": "f4cdf6d8-dfce-424d-9251-5b9f26f6bb60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498962, "uuid": "a74bf026-322c-4dad-a736-d305b8b09ad8", "value": "02a8b9fc9a425a1e0ce3fd213870536c66e45bc3d94893fab6edc9066e0d3917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7701f9b9-9e13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618509200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509200, "uuid": "c63f5e3c-6edf-4a17-be01-c6bb8c3bf9cb", "comment": "Malware payload (Formbook)", "value": "263858c1aa6a7df15d12bbd0a77aa300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509200, "uuid": "d2b08596-9f58-4089-be5e-40094bd3eb10", "comment": "Malware payload (Formbook)", "value": "02b07b8086d052cca5b1f10089f93da604dfdf71d09f0370750f371e50bb0221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509200, "uuid": "f478f9b4-7c26-412c-aaf5-c9970493337d", "comment": "Malware payload (Formbook)", "value": "527ee687c4705373ec85899c09246d327314110d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509200, "uuid": "3c37aaf1-cb4c-4d3d-aeae-b2278c31d9f5", "comment": "Malware payload (Formbook)", "value": "28376698ee4a25379117c082987cb607e2c8fa15b915481dfcf784ebff650fb9e4f675ec92dcd67158c430260753698a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509200, "uuid": "e7e88fa3-6d6d-4d9a-84a5-1bb190643c87", "value": "1AF4AE2037D99709D8BE9B700C34928117B6BE6BFE11D71D2D94315CEE33A528722BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509200, "uuid": "698131ba-a570-46de-b9de-0efa3d270087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509200, "uuid": "9679b727-42f4-457e-92f8-dbbeefe9bd6d", "value": "12288:Z7dI8tVK4E5FIv+6JRjUCrtc73QcgHKox/GeFDh:ozFe+6Lj7riJeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618509200, "uuid": "e95ce026-39cf-4b0d-a562-eb93a8c6e53a", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618509200, "uuid": "8a5caac5-94d6-406c-9cfc-96769ad66693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509200, "uuid": "05401c72-6fb8-410a-9d92-14b4c5af382b", "value": "payment recipt pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a61053-9dee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618493174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493174, "uuid": "007dfc3c-1e1d-4165-8d11-1d45778749f1", "comment": "Malware payload (Dridex)", "value": "9cd076cccb6468b779a0ac13cd6379ee", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493174, "uuid": "45e69d4a-8a60-4ede-9ba9-62a804d39488", "comment": "Malware payload (Dridex)", "value": "02b85a420694a0f00576aff37539d7e0e5358c9d168e7ad3ada4f911e53222b4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493174, "uuid": "5539a011-3e70-44c2-b2ca-bddb1949a6a5", "comment": "Malware payload (Dridex)", "value": "afccfe82375b947f9a90e253867953d4e5561680", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493174, "uuid": "7da897cc-2694-49db-9cd8-8b01fbe03e87", "comment": "Malware payload (Dridex)", "value": "47c38c064fc7b6a138969933369234f3009760bc1cfa50c20bf3ce644ac2b3355fab3c71ef30fe87102759d03cab6c97", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493174, "uuid": "6d8a3e3c-7ccc-4078-90f5-31fb69a2dfee", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493174, "uuid": "eac02fa4-8ce6-4242-b69c-3cc3b80a5981", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493174, "uuid": "2f9c4954-8993-4ac9-ad25-4cc59405249a", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618493174, "uuid": "7d674db0-62fa-4ee0-bca1-679c36fd4329", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618493174, "uuid": "3ed33c9c-2c9b-4be2-8163-3c40281df648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493174, "uuid": "84b300cd-24df-4272-9d22-f12f2688acb8", "value": "02b85a420694a0f00576aff37539d7e0e5358c9d168e7ad3ada4f911e53222b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39ba851-9df2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495182, "uuid": "39b3c61a-1ebf-4a41-a157-bd27e5cab2dd", "comment": "Malware payload (Dridex)", "value": "04bb5f042d10662a1cfd7a9d9ac1ab52", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495182, "uuid": "9623a5cb-f248-4db1-be9e-418de6853226", "comment": "Malware payload (Dridex)", "value": "0317de2be496d387be153a38b2ef785efdd485548ba1822deb2e3389f6706d53", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495182, "uuid": "28116a9b-60a0-4de7-bb28-d6b812ad7ea9", "comment": "Malware payload (Dridex)", "value": "6fa4e231d6a6fa035de54f72e281b9cc61c0e1e4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495182, "uuid": "e6c9a2e6-79e0-48e1-9aa7-a3e57d66bd75", "comment": "Malware payload (Dridex)", "value": "f19692f1fcfcd6a544b8167cc5943cf3b6c1593dfa40f5f4eb051fbdc0836b4ad6d5f3cac2e5137a5699781f8e98a3b2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495182, "uuid": "a5546e45-3129-48e2-9844-8d93353b4b6b", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495182, "uuid": "807b9ef8-a9cd-4b71-bff8-67fd5fcb72bb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495182, "uuid": "fa56687d-e1b2-4401-949c-13d343baf4fd", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495182, "uuid": "bbce17e8-205f-4ff4-8ed6-21b77cd05380", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495182, "uuid": "31990947-6992-4a7d-8e3a-7367fee4a10f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495182, "uuid": "6c4c387a-6373-4181-93a6-4d4c6209593d", "value": "0317de2be496d387be153a38b2ef785efdd485548ba1822deb2e3389f6706d53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42f1527-9e01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618501679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501679, "uuid": "5e4b6450-7a49-4f1a-8420-9a30fc3bfc09", "comment": "Malware payload (Dridex)", "value": "a987d71f452123f0996341b588caa013", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501679, "uuid": "ff53c4ac-6224-46e4-a422-e27cbd616365", "comment": "Malware payload (Dridex)", "value": "0345d4b53c2557410f692fc58cf3adbc70f20fcf395491c741d0c9a9c6bf9b39", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501679, "uuid": "e168528d-be3e-46c0-9a16-df3e54d169f1", "comment": "Malware payload (Dridex)", "value": "c46985385e37e35ed902617a58e11932d9d5fdc8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501679, "uuid": "7b24532c-bed4-4003-978e-7fc97324869e", "comment": "Malware payload (Dridex)", "value": "5455ad9c6cf67953187587c4cdf39ac8ff14f51f8bbf0fb999e62c1af3f62281046277603db7e036b20afaf352820507", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501679, "uuid": "59379fd0-b327-472a-9dbb-af8a8ba96914", "value": "77F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501679, "uuid": "928f3f59-f0ce-4e91-a6cf-4a4dbeac5404", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501679, "uuid": "1284fc82-7061-4921-ac06-10396f16296d", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618501679, "uuid": "8719cbf6-76ab-44d6-ae62-ae27095da157", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618501679, "uuid": "1f5a0b59-3d4a-4ac1-a47b-120d5554e462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501679, "uuid": "99bb649f-8b51-4c3c-b2d8-a0dc02d9225f", "value": "0345d4b53c2557410f692fc58cf3adbc70f20fcf395491c741d0c9a9c6bf9b39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cce748-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618523562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523562, "uuid": "c0150a6d-b45d-4273-ab91-b51f3cf59d24", "comment": "Malware payload (Dridex)", "value": "8c9523c652712625b1aa109f01e21191", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523562, "uuid": "43a42d45-ddef-47d6-9635-b59b32bf2f80", "comment": "Malware payload (Dridex)", "value": "034ca9f0a30fc2cd5ccb49c2bc34526b90e08cb73e6e0c06736a5858d1b01a35", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523562, "uuid": "add4a165-bbaf-4d2a-a783-78927dbd650a", "comment": "Malware payload (Dridex)", "value": "a5704dd2f64ee3f66e769691a30376e597e0bd71", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523562, "uuid": "84737676-72ef-4d4d-ba39-12239dd96cbf", "comment": "Malware payload (Dridex)", "value": "da180f98612fdddf6f23c90832fd3d94da02a86c1da2da2255b4c9c25ab095bf0947be3eb3b5abfb68a07ccc1f024140", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523562, "uuid": "c44301f0-78ac-4f78-8997-eb4c2fd11d44", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523562, "uuid": "555ebd90-754c-40cc-9215-59cb37f46b47", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523562, "uuid": "402c3d47-b5ef-4b88-93ba-ef44c2f43600", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523562, "uuid": "663b8d95-d6f8-45c2-95de-952e90fc15a4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523562, "uuid": "8d880cae-e47a-4d12-b90e-486b014d4d3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523562, "uuid": "ac2d8f1c-02b2-40f9-8d29-12c61e57992c", "value": "034ca9f0a30fc2cd5ccb49c2bc34526b90e08cb73e6e0c06736a5858d1b01a35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336f2885-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515958, "uuid": "8adc3ca9-9792-428f-b398-e4b630079525", "comment": "Malware payload (Dridex)", "value": "c530e963761da22f6e4247334d6fc06b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515958, "uuid": "b643aba0-f1fb-4a3f-bf35-32299a264049", "comment": "Malware payload (Dridex)", "value": "03a29ae62d5c4109770c093c2432c2759b9ec128458e6d28e40a922f047c1ab7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515958, "uuid": "20d7a7f0-827d-4b88-b353-0297cc4ed4df", "comment": "Malware payload (Dridex)", "value": "9a4b982e4458062cd14d10f0aa14eeae120dadb0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515958, "uuid": "eeeefc26-7169-4e8c-b764-41353bded5f2", "comment": "Malware payload (Dridex)", "value": "0ac82bc8e29f0c709511823cd81b49c5b6fb17961186e93f3c1ee411b13789ee74efdee5424e718e14ba4bf4a45ac96b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515958, "uuid": "a8d4f4ed-e101-40d8-85d4-ae69607ed6b7", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515958, "uuid": "137ee0bd-8fe9-48a2-9328-f500488ceb38", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515958, "uuid": "14f87c5e-ffad-4767-a5b7-f26f19e88b6b", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515958, "uuid": "49f63bf1-af7f-4151-aa95-e50400cadd7c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515958, "uuid": "0ad2bfae-536d-40cf-b831-d4a0b16557c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515958, "uuid": "d5f7cd78-efaf-4eca-b521-947a71e6e955", "value": "03a29ae62d5c4109770c093c2432c2759b9ec128458e6d28e40a922f047c1ab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915e3dd0-9de3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618488628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488628, "uuid": "9c78a24d-8d53-4279-a462-ce1ee587d0d9", "comment": "Malware payload (Dridex)", "value": "682dab90f2007863eb2af7650ae361ca", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488628, "uuid": "b55a58a3-13fe-4b84-987e-06d052c9a96b", "comment": "Malware payload (Dridex)", "value": "03b2793d9a4abea448d1f9f14283a4d836825c99c612e0e7ad4cdc383b9f8308", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488628, "uuid": "014b2b5d-4fdf-435d-9346-990d85ba04e3", "comment": "Malware payload (Dridex)", "value": "3fef64dffdd3a3b28ed25b86ee5695f391a59f0b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488628, "uuid": "9a2b84a0-b1b0-46c1-94d0-1e9b7ae09a15", "comment": "Malware payload (Dridex)", "value": "8792fe9298260eba1a72c391a2113a8c2e8cf24f10cfe38c2b2a88749d67547f79bb7583d84353efafd1778a9bbb281d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488628, "uuid": "7d54087a-2aca-46f0-9ee4-a45b7d314d21", "value": "FCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488628, "uuid": "18652a50-f6ac-4cd4-94aa-58ac78786a41", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488628, "uuid": "8e08027e-d14d-474a-a621-7ab1c7b6382c", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618488628, "uuid": "1f416800-d271-4c85-b850-764dfa1279a1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618488628, "uuid": "65953d75-c43c-4128-b354-12fae8a71a15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488628, "uuid": "a13da0e9-b890-4da9-ab42-56f2a6959077", "value": "03b2793d9a4abea448d1f9f14283a4d836825c99c612e0e7ad4cdc383b9f8308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cda81c1-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495868, "uuid": "b82e8f3e-bb6c-47f5-972d-2f6945a3d288", "comment": "Malware payload (Dridex)", "value": "acca7e080673be052b7bcecfab3b9b86", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495868, "uuid": "b36086dc-f18f-4cdd-9928-fa4af98818d3", "comment": "Malware payload (Dridex)", "value": "045030fab297036fce02f3bb387990fcf22097f229f228f6f32b9358c30de915", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495868, "uuid": "76c1c174-140b-42c9-83c9-2f55cee5acfe", "comment": "Malware payload (Dridex)", "value": "9e43bd633621e077d8bf7baef82f9fa28265ea30", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495868, "uuid": "98587e03-4612-4698-9312-a3405bb40520", "comment": "Malware payload (Dridex)", "value": "3d699ba664e688b0d8d0226f3010911ee8291ef0f2babf451b020d891301143f21e2bb72a82b6ff88f15f7f73bb67f9f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495868, "uuid": "2cb56a60-6170-4c0d-82f8-fcbbe910b443", "value": "65F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495868, "uuid": "b8041245-cd8d-4858-a914-3081019eb131", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495868, "uuid": "835d3ef7-f2bb-4c5a-bb62-1364f029dec3", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495868, "uuid": "56372a1c-cee8-4e3a-89d7-69198722d05c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495868, "uuid": "6727fea0-5e34-4d5f-980f-edc4b41aa800", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495868, "uuid": "f89f32ec-19dd-4a40-a8a6-640c1c3ee593", "value": "045030fab297036fce02f3bb387990fcf22097f229f228f6f32b9358c30de915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640eb6f9-9d86-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618448609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448609, "uuid": "281b8df5-0dd5-474e-abb5-ada069d2b9cc", "comment": "Malware payload (Dridex)", "value": "ea9863982407c46d7011964d305f3629", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448609, "uuid": "93e02297-2ce0-43ee-99b1-3559604cbde7", "comment": "Malware payload (Dridex)", "value": "04a14f8f27b2fbe776a99ba3657d224368d0380f1468b4a674e8394ca2d0406f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448609, "uuid": "79259cbf-2410-4fe1-b3d3-89a050408008", "comment": "Malware payload (Dridex)", "value": "c670ee412160eed8cb09f97d8d53e10eb6b6543b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448609, "uuid": "e3211080-26cc-41d0-9927-6504fc1e1a6d", "comment": "Malware payload (Dridex)", "value": "a4f2da66a98f2f8ddafc115ede45b9b23e61e83d35ffd1aeb01ceef36f0c4313d31acf6293f1a212237484101c28ae14", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448609, "uuid": "0e07c845-6c94-4d98-9bf7-a2520b65a3fa", "value": "5F249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448609, "uuid": "16c340f1-ba78-470d-aef7-2cfed5f4c451", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448609, "uuid": "51c06963-0e31-42f3-8ec1-178ec98fd232", "value": "3072:N0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:QpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618448609, "uuid": "419ce375-1715-42a9-bd14-21115be919c1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618448609, "uuid": "d35fe605-bff3-4241-8df8-5cd0848e33dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448609, "uuid": "0e6f55c0-5cbd-4d90-86de-401f0f170aec", "value": "04a14f8f27b2fbe776a99ba3657d224368d0380f1468b4a674e8394ca2d0406f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b96561d-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498953, "uuid": "daacdfa4-37dc-4986-b881-ee437387278a", "comment": "Malware payload (Dridex)", "value": "02f0e380dc298ea906405285d3868619", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498953, "uuid": "e8677c03-6c0e-494a-a1bd-171a383e8ef4", "comment": "Malware payload (Dridex)", "value": "04a6f41184b05b38dc9a3628eae59cb54abd13a0c3c203fa0666382e7953705b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498953, "uuid": "70894540-3003-4284-9014-25fbb4af7f7f", "comment": "Malware payload (Dridex)", "value": "36e0cba37c3ae42ed73b6e92174d910caf0d3ed0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498953, "uuid": "a5adae16-413a-465f-b8e8-deab08d63dd9", "comment": "Malware payload (Dridex)", "value": "bcf5251b40fba54cf9513ef12f5097241851e426ac808ed02edc001ffe97187a07f88439bd144a4f0d2dd6f2bf4a1392", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498953, "uuid": "8c64e766-0caf-45f5-9e58-7bee30d250e2", "value": "02F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498953, "uuid": "71a9b353-4ac9-4b54-94bb-9b5fbe5b45c3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498953, "uuid": "da45c523-a274-4142-9924-bf848528410e", "value": "3072:niFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:8eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498953, "uuid": "a8e162a2-052f-4a88-a1fa-1dce75c54a7c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498953, "uuid": "591076a4-c95e-4a3b-9496-2b1e2393151b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498953, "uuid": "a13f55b8-3d36-4f20-8649-b3238cd949c3", "value": "04a6f41184b05b38dc9a3628eae59cb54abd13a0c3c203fa0666382e7953705b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f67b1f-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496023, "uuid": "67b4e611-0a74-43db-9472-00fcf23a6d86", "comment": "Malware payload (Dridex)", "value": "dbca19bbb83ba6bc4fc3f7863b384eb6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496023, "uuid": "dd6974c4-4d55-4d91-a813-21f80b31d683", "comment": "Malware payload (Dridex)", "value": "0510de6863df79eecd1027527803285bcf890556e78688fc4b15865cbfa48594", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496023, "uuid": "d5f3a845-3821-4d93-963d-f6d59e52889a", "comment": "Malware payload (Dridex)", "value": "82d0bccc9f32ffab2aae24a6e6c790416248ea8a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496023, "uuid": "e6b02c8e-bd8b-46b7-970e-6e69dd78f64c", "comment": "Malware payload (Dridex)", "value": "d0152d0e404d123ea864cf2f258e1a83e1689feec39835db2aa402f2c368ad33cebfc3cad0c3d670ce526f705787d7e6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496023, "uuid": "90b28d57-ba68-46c2-9824-abc8d73c99f4", "value": "07F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496023, "uuid": "61f3b31f-156d-476d-958a-89bc5bb41ad9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496023, "uuid": "122649f3-1cbe-4520-85aa-1edada1d6fc2", "value": "3072:gA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:g3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496023, "uuid": "6772ee1e-f8c9-4b59-9e1e-12c8c74336a9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496023, "uuid": "1fc2993f-3e03-4b64-8830-ef5a0ed87ddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496023, "uuid": "34cd467c-f7c5-4d84-b3fa-34600284df05", "value": "0510de6863df79eecd1027527803285bcf890556e78688fc4b15865cbfa48594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809d43ee-9dd6-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618483017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483017, "uuid": "ac67f3cc-fc80-4d5e-99af-8d699ce2771b", "comment": "Malware payload (SnakeKeylogger)", "value": "697c024ea229f79e51ffabdfa4b86538", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483017, "uuid": "2839301f-d839-4b28-a50b-d917ece7e5b9", "comment": "Malware payload (SnakeKeylogger)", "value": "054d7b168961e3076ca2734d13f096b1d165516546b57516bf750f4655f25a4a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483017, "uuid": "1b86ed82-5a8e-4d7f-9f00-369d50a848a8", "comment": "Malware payload (SnakeKeylogger)", "value": "a44056d0e356a08bcc7b313aa68c50e2e310b8dd", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483017, "uuid": "a7e05f30-c2c3-4fbc-b21f-7ab7bcfb2383", "comment": "Malware payload (SnakeKeylogger)", "value": "6f7348bb4059f9674262956cead1fe25502120e1f4b3fa8d4981e15665de33f5040a75863579fadb99d4dd63ea66aeda", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483017, "uuid": "fba6478f-dcb7-4f54-8afb-fd36c977d41e", "value": "8905696132B7D614D6E95F38519D0E144EB0AD126933E70C1AA670EF0BB67838F1EF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483017, "uuid": "bcca89e1-fcaa-4222-b076-5300d417f8be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483017, "uuid": "2f0a813c-a442-4e7b-ba0f-ba648d09b501", "value": "12288:Rc+ayqfC1hAUXsYIi4KozkQ+sgdq+c/J7UKkZrROAJgeUWw6JK:W+L6Cw1Y0K+km5h7UKIRO2Qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618483017, "uuid": "b5f3c780-e93d-40a6-b772-1f69b59bae6f", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618483017, "uuid": "7b6014ee-5288-4972-aa3d-295de6c84048", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483017, "uuid": "f7ce8b4d-6ed1-476f-9274-c79e9e5440f9", "value": "RBL 053980200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30496af3-9e13-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618509081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509081, "uuid": "ddea1dae-e916-48aa-8df8-25092a205bf7", "comment": "Malware payload (ArkeiStealer)", "value": "6ed7cf9e93e2474d7a0100208e5de920", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509081, "uuid": "2b51e8bc-62e0-4891-9447-875ab49d3fa9", "comment": "Malware payload (ArkeiStealer)", "value": "0552149181395fb0685b2dfa9b123334cb598173a13fbedf458f8c3613f8ff81", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509081, "uuid": "90802c54-9355-4285-a1ae-0b2435a27f07", "comment": "Malware payload (ArkeiStealer)", "value": "d6f20fc09517b061fb45b67e11a9181e0024510b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509081, "uuid": "454abc17-ffcc-4666-a377-e67a43ddfab6", "comment": "Malware payload (ArkeiStealer)", "value": "44d42f301d86d502db76a90f5aefe61b7ecbdbc015d039d513a33f806c42a9c68bc5c5552cac5eff66f537a4011ce366", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509081, "uuid": "70517ad1-9bcf-4cfe-85c5-a8568f1f3893", "value": "2605121172D1C0B2C05764B68415CBB59BABB43063B68ACFBBD50AB95F2CBD2573630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509081, "uuid": "b48a6069-d630-4cd8-940b-0fc6b3243b45", "value": "8ff2023a5297e7b6f39e31d9b6aba294", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509081, "uuid": "a206c6cc-4686-48f0-8706-cfe1e3f5623d", "value": "24576:hZMWB4tlk3OAxJKeM6A7a7wqiYEju/JiaDDM:MtlFAY6riYEjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618509081, "uuid": "606a494a-b976-4936-807d-aeb8073251a8", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618509081, "uuid": "50937569-5a38-4c8d-9593-c8fb29466866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509081, "uuid": "0d8d15ad-a73b-4236-99fe-ab707ec55a98", "value": "6ed7cf9e93e2474d7a0100208e5de920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f472b68-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "9fd13bc9-d3e2-485b-97fd-bf5c2c62c00f", "comment": "Malware payload (Dridex)", "value": "33e99ffe3663fe3d9159c572bbb0abfa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "79d82b62-b390-45cc-8f97-d189957d0886", "comment": "Malware payload (Dridex)", "value": "055fca4e165a426d0e9d80822a0b067a830cd23afcc2f83bca7389a50727e266", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "20cab1e0-d488-4638-b3c2-35f151a2772d", "comment": "Malware payload (Dridex)", "value": "6ecb5cad4606a90f5e936036b2e2efa934d0d0c2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "aba2271e-fc07-4772-a6a1-0f4058fa19a3", "comment": "Malware payload (Dridex)", "value": "a4c9b199f60a11320b5ffb55672c50606cc538f2b6b62faa83bf8abb9777aee22c117d296aab43b7317780d103593f27", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "3c35a1c1-5625-45e8-8719-929ccfbb8025", "value": "D8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "1b10b0c9-5a52-425c-9f00-2b9016148db9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "07a7aa03-91a9-454c-8608-38bb4a751e1a", "value": "3072:4A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:43J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495872, "uuid": "a43275c7-2e64-41f4-8f0b-8b6c3baf0883", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495872, "uuid": "f32712d2-889b-4bb9-bc1e-b8e9344cafd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "1cacd759-892c-490b-852c-2c090dbc9125", "value": "055fca4e165a426d0e9d80822a0b067a830cd23afcc2f83bca7389a50727e266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc0bd1c-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516006, "uuid": "dfecb114-a5e6-4691-89de-9fd21f261421", "comment": "Malware payload (Dridex)", "value": "21e22abfdb80048be3082c58be3444ba", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516006, "uuid": "7e337c57-fd6f-4842-9a59-961c24fe1d89", "comment": "Malware payload (Dridex)", "value": "05845f8b0c93433bea369ea58ed337653510924ed2a94505f7a2f4ecc202c4c5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516006, "uuid": "c212f245-3169-455f-b695-db2dfba6c9d5", "comment": "Malware payload (Dridex)", "value": "b0f800a95d46b4422e48bd5d62f29e4f5e2efa92", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516006, "uuid": "f5e7cd8e-f6c3-4675-8b91-83c18cf334fb", "comment": "Malware payload (Dridex)", "value": "b4d85d002c9cec56b23e9edf95fa8d26b17b44e7c3fbad68f73488c145a0d802e3d392de2a03bc493ef7ff76a320a8cd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516006, "uuid": "091fb1d9-0877-4636-830f-819da134e186", "value": "0FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516006, "uuid": "26c15867-99f2-4747-b672-48ba07e9870e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516006, "uuid": "1a59599f-93a0-44f7-95fb-ff040b617888", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516006, "uuid": "71e0f053-44ae-4c73-aa45-0a951ff7e69d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516006, "uuid": "8e8d9e3a-73ee-42a1-87ae-8853d9d2d693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516006, "uuid": "c0df17e0-42cc-45ca-ae41-11b6f2615c22", "value": "05845f8b0c93433bea369ea58ed337653510924ed2a94505f7a2f4ecc202c4c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c24b5c-9db9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618470600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470600, "uuid": "5f7aaac5-dc68-433a-847a-2ba126ecd1b5", "comment": "Malware payload (Dridex)", "value": "c94e356afc35f53f8d8476423dcda3af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470600, "uuid": "afae0852-144e-416b-9d41-4ff1508aa538", "comment": "Malware payload (Dridex)", "value": "06367da194bef0ce51544bca634099e02011acdab9dbd231c9c3ae93cdc43213", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470600, "uuid": "091f977c-a635-400d-9df9-b060c98e22be", "comment": "Malware payload (Dridex)", "value": "05df275ce8ea3d8d281c0b4bd823bbfefe31e24d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470600, "uuid": "2eacbf66-209d-41d1-b137-4161651a946a", "comment": "Malware payload (Dridex)", "value": "6864c2b170d4157ca6d7f7aa69a4580db474d5f3c98b22533980615319abe0e3262d511275f2a8dfe558bdaa025c0217", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470600, "uuid": "d7c9e81e-3b1e-48ce-8014-20a8536a0bdb", "value": "6FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470600, "uuid": "a850bdbe-eb02-469c-be09-7b8112557890", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470600, "uuid": "714cd22e-44bd-4ed7-ac8f-26c989fb4690", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618470600, "uuid": "7f1550cf-8b90-4dd7-9a78-f5c8c960900e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618470600, "uuid": "3ee1913f-0ecf-4fb3-8eee-e042de9d1964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470600, "uuid": "1b323b4f-c036-42d2-9f60-4e0d3503278a", "value": "06367da194bef0ce51544bca634099e02011acdab9dbd231c9c3ae93cdc43213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35257751-9dd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618481602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481602, "uuid": "4f846f2a-ce39-4445-ad38-6876618baf98", "comment": "Malware payload (Dridex)", "value": "7392aa0b9952f42d526a8eb9a6aac15a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481602, "uuid": "ba25db5c-ff03-46c8-a8cc-40642b9ccebc", "comment": "Malware payload (Dridex)", "value": "064dcdb61a1e5e135f56eac519d2e1ce1d0be5d9e756d4b95efb2c7d4927d4b0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481602, "uuid": "6d53ed0d-3b92-417d-9ab3-a53114f29db0", "comment": "Malware payload (Dridex)", "value": "f4fe12102035767e7137d61ae1e82f9bb66f4dfa", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481602, "uuid": "e4b2b2e0-24b9-4e5e-9868-89cc339c5e32", "comment": "Malware payload (Dridex)", "value": "cd5de00faf37ea4bd6567d6781ae98173613e03a7246bc15c0e3510a8e3c98c0b3820188aebe9aff91e299aad49ab13d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481602, "uuid": "9a520a49-a001-436b-aa46-abd054d730cc", "value": "89F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481602, "uuid": "fe673f33-5cd0-4f8b-84b2-233ba8f87f9f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481602, "uuid": "dd4a3b3e-7f74-413f-acad-b04366d60346", "value": "3072:Rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618481602, "uuid": "6b57d6bd-8d89-4f87-8484-93078d578614", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618481602, "uuid": "9b0051ea-1e1b-4cfc-8d48-47be6da40e49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481602, "uuid": "0ad19776-c188-4b28-b1e2-f2cd91cd52a3", "value": "064dcdb61a1e5e135f56eac519d2e1ce1d0be5d9e756d4b95efb2c7d4927d4b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c5417a-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497516, "uuid": "60c3b992-4b28-46af-afa7-475a051b02b0", "comment": "Malware payload (Dridex)", "value": "3c0477d29c2aa53c2c5897fd8cc6dc3c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497516, "uuid": "35f8a9aa-fd63-408c-9b14-a39d63344ac9", "comment": "Malware payload (Dridex)", "value": "0662f45d92e73b3c7b2eb8420299dd74fd9721191b57239475436a0f8e6ccdfd", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497516, "uuid": "b47bf853-54e1-4242-9a5a-14cecb1bca09", "comment": "Malware payload (Dridex)", "value": "d188c97138b09d91fa60db4017a4eaf53a80a021", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497516, "uuid": "8561cd9a-5098-4c6e-9914-14c905107bca", "comment": "Malware payload (Dridex)", "value": "45eec848ccb476dff35ad6bb20501e0d3bb2273bc2be1d697720625ba5f420006d925429afb77219ec1a94777432fab8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497516, "uuid": "1de67ec6-ecac-4d9c-afda-0c0895f7d826", "value": "ABF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497516, "uuid": "3dbd0415-42fc-499a-a72c-bf48afda4712", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497516, "uuid": "c34faa7f-0f06-4e39-b73a-a43f6245052f", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497516, "uuid": "0f4ae71c-b118-4ca3-bd2b-69abed2f8a96", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497516, "uuid": "4b6a5e6a-384a-4f6b-9afc-5c1cf43bb629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497516, "uuid": "809ff05a-f6d8-450a-a2c4-f40d831a3ad4", "value": "0662f45d92e73b3c7b2eb8420299dd74fd9721191b57239475436a0f8e6ccdfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8124272c-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495902, "uuid": "6a1f2305-286b-40d2-90fa-1490ed4419f7", "comment": "Malware payload (Dridex)", "value": "d72eb24646da999f96a56bf1fd509657", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495902, "uuid": "7c8de1f3-b281-45b3-8f3a-1d840f7edaf1", "comment": "Malware payload (Dridex)", "value": "06e2f043433ad2fa70c7c59e344b6102f01a04261bf4edfdeb26111cc2f74a6f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495902, "uuid": "ac5d56e1-19f5-49be-9966-5e463bd5b88b", "comment": "Malware payload (Dridex)", "value": "c247bf4cd05bf0e76809ca95be133f76fd59291a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495902, "uuid": "011507ae-383c-4f4b-bd7a-fb8c20a63653", "comment": "Malware payload (Dridex)", "value": "92ab26efe2e33cb5f01557c2c9ff2f3b2c00c7feeb783f1bc665cfcb54699a4a709c386230b876c03ae3b39505e68408", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495902, "uuid": "80c938c5-040e-4d20-ba96-4c544fb0fa86", "value": "1CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495902, "uuid": "76282767-6647-4a29-b231-51e851e92587", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495902, "uuid": "1d254de0-8785-4f10-a758-29096d75d061", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495902, "uuid": "e27b95e8-7e22-47dd-8451-aa3e4e1139e7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495902, "uuid": "502402c3-3a2f-4e75-8ea5-f74f4f4859fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495902, "uuid": "891bb640-ceba-451a-a31a-bd03fb127417", "value": "06e2f043433ad2fa70c7c59e344b6102f01a04261bf4edfdeb26111cc2f74a6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d14f91e-9e0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618506928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506928, "uuid": "8bffc84c-62ad-49a6-b699-28459884e189", "comment": "Malware payload (NanoCore)", "value": "86b584a6a9c2f977d973e5c2b6d1a1de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506928, "uuid": "c33bcc0a-3c02-41a4-baf2-4e4ad548be90", "comment": "Malware payload (NanoCore)", "value": "073180c12531e3801569f67a0a0df8705333fe69003f2f3f797b44c6c28bad53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506928, "uuid": "de144c7a-430d-4a70-ad3a-d5572c4c0281", "comment": "Malware payload (NanoCore)", "value": "7190572f39e307428e7270655979dc9abb14e498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506928, "uuid": "1589e845-f0b8-4a75-a7fb-772aa85d23f3", "comment": "Malware payload (NanoCore)", "value": "d0f8790467b9eab261e20b7c26c2b4f4f23c65687f2d65c11087d69619be36199f4b6ead03160c4c8673af560e72f810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506928, "uuid": "ba7ac66c-c1c6-4373-9f83-03eec46d696f", "value": "6655166C75049AD7C9AB03F6A32C4C0096F19D4EA6FBF64DE8833CA6B6BD741B125143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506928, "uuid": "faa851d0-5a3a-4a9a-9e8d-271cbe699893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506928, "uuid": "89849711-6d69-4b34-97d7-11e7c3e00cd9", "value": "12288:v/Jq3zzzmKhdh6pKWGYJjiLWNrxxhdjssDaPcwgXUvQRnhKoSs98h7omgSomg/At:vxqBsD9F3NzNZwXv6hzV8NlJEAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618506928, "uuid": "d044df44-0c16-461c-9030-d4a121c3b8c0", "value": 1364704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618506928, "uuid": "04ea750a-a0e8-432f-8890-5413ef786817", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506928, "uuid": "9fcbfa42-fba1-4efe-8db2-0aee80298fde", "value": "86b584a6a9c2f977d973e5c2b6d1a1de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3075a84-9e24-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516602, "uuid": "a70b9dcc-06c8-49c9-b9ae-7651fa4381ea", "comment": "Malware payload (Dridex)", "value": "ed393fed9d155a2c04f42470fb1e7a65", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516602, "uuid": "afd00bc5-d48a-4b35-96c3-490136d57944", "comment": "Malware payload (Dridex)", "value": "07465c154dc86b2c027bb4915cbbcc6a9d2fc81abe341481c3d73b0d143fd8ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516602, "uuid": "3c982235-8995-46c5-904f-ce9f70afe0b2", "comment": "Malware payload (Dridex)", "value": "38563490638b0089216c509262816f69e53a8309", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516602, "uuid": "a4ca5320-86aa-4cba-9388-f7749ca5bb0d", "comment": "Malware payload (Dridex)", "value": "a2052ea1b14d4b43f990877f1fd54b720fbda1f9e5d0e5586c18b5b55f06b5e9177a23f58c693c2d1604c0b34604aa6f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516602, "uuid": "0077eb89-7f68-4d1e-9830-69319f122a86", "value": "C1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516602, "uuid": "fb123021-73b8-4fb0-bac6-cf84365c7304", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516602, "uuid": "70e7789c-eb1f-408d-a8c1-d66ec8a690bc", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516602, "uuid": "e2c30307-4d77-4f19-84b7-ce1392ec752f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516602, "uuid": "aab43466-b3e1-47fb-abed-b91e5aef42b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516602, "uuid": "8f0d0d9f-4c8d-41a9-961d-b9147b9dbcf4", "value": "07465c154dc86b2c027bb4915cbbcc6a9d2fc81abe341481c3d73b0d143fd8ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f892d7f0-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464320, "uuid": "c1a677c9-16e5-430c-a4a2-3252e12cd492", "comment": "Malware payload (Dridex)", "value": "ef30802432ac1b8f94e5886dd5e74edd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464320, "uuid": "91bbe5f7-3acd-4bf4-aa63-8bcc1d0bbdf1", "comment": "Malware payload (Dridex)", "value": "07896a5e64ef77a5c9863e8404f2aa110672e9ea9fa15b322144a84a3383578d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464320, "uuid": "b46e954f-0c60-4d99-bd1e-fb1c173d2b80", "comment": "Malware payload (Dridex)", "value": "608d7d0cda983b859cd4773d9b21658728d8eb32", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464320, "uuid": "3e6e437a-c63c-4df1-a253-fdc041cea984", "comment": "Malware payload (Dridex)", "value": "7d33688cf46f32f769218d6bfe92a3546e0a849738b73c1f95fa92f754059abdab78e3ed4ac318eba4e50262a1302000", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464320, "uuid": "147f9bd0-7f58-4ea3-8783-3d3fe5fae9bb", "value": "EAF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464320, "uuid": "aee2dfc0-4d63-4a23-b732-48eef272cdf3", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464320, "uuid": "51f740c3-d531-43ca-8c2e-da748901b3d7", "value": "3072:xA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:x3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464320, "uuid": "934c8dfa-d6aa-4f5b-b425-96c8b7cc7604", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464320, "uuid": "0a901172-9e63-4d6d-8796-645a96326cfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464320, "uuid": "abcd34f2-4e39-47fb-8ad1-a332dd6a87f8", "value": "07896a5e64ef77a5c9863e8404f2aa110672e9ea9fa15b322144a84a3383578d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d31a29-9e2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618519687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519687, "uuid": "82f8f549-b51c-4130-9d11-03a8801fc45c", "comment": "Malware payload (Dridex)", "value": "bb880eea987a083fe9f9165abc741cb2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519687, "uuid": "bb41d500-e62f-44a2-9bc2-ddc9e3387ea9", "comment": "Malware payload (Dridex)", "value": "07a5daa56ac9912a4e2250996f64d96c7b272cce733d571033947a7615209688", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519687, "uuid": "8067234f-d9cb-4fd1-acc5-3d3d822cf74a", "comment": "Malware payload (Dridex)", "value": "243165e7ef3a19f135709812954cc7cd6d235275", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519687, "uuid": "725555ba-1b50-4c6a-ba0e-836bec73f8ff", "comment": "Malware payload (Dridex)", "value": "1be21b6b7e78c456801c83c28148321ef081c28b58e7681cbf84a85a493aeaabf0f023447f601f54b1d61c1a1d1ef8f7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519687, "uuid": "9752beb4-5f3e-4a62-92c8-871913e4c455", "value": "2CF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519687, "uuid": "80baf8c8-096e-4b14-a49e-3121b713b926", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519687, "uuid": "aeac882b-7aa5-48fc-94d1-20381d0e583d", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618519687, "uuid": "73f7b16b-3407-4145-8cc9-c9fa8c88c8ba", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618519687, "uuid": "67dc3319-5a1c-41e6-bb98-a9669ce779c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519687, "uuid": "0ea86d87-4be0-473d-a2f8-4c8c13f043a4", "value": "07a5daa56ac9912a4e2250996f64d96c7b272cce733d571033947a7615209688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e02671-9e1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618513795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513795, "uuid": "1278c785-e90f-4c01-84c0-dbedd3985748", "comment": "Malware payload (Dridex)", "value": "bef6de8675e065b535b1364fb18656ac", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513795, "uuid": "bdef3d0b-7463-47da-8c0a-f4ce8597e97e", "comment": "Malware payload (Dridex)", "value": "07a73e5a46f58521d62eaae747afa0f9a8e32c2b1cb329925907449b2b8a277b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513795, "uuid": "15c7b87a-f133-43c1-bf4d-0134785cd2bf", "comment": "Malware payload (Dridex)", "value": "5a70f74968598199f724ac445bafdf5fd8e49435", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513795, "uuid": "b36c363d-82dd-4420-831c-159c3b14305d", "comment": "Malware payload (Dridex)", "value": "cc77a8abba0fa339ef85ec93dae8ccb6e59ddc499936e06a411edf5fc6c125a3893007669e0d1e5c509d5104a39d201a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513795, "uuid": "f68188a4-3728-4339-9542-bf6e384ccebf", "value": "93F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513795, "uuid": "f2817359-489f-4c24-a24b-68b2136b65cf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513795, "uuid": "852d9ede-86be-4dfe-a985-dbc14b8fdce6", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618513795, "uuid": "270532e0-7425-4a36-8123-4ec7b89bf5ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618513795, "uuid": "6455d600-9381-4b79-812e-acc76e63357e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513795, "uuid": "0ea25ca6-32f1-4ef2-a07d-583f95acd051", "value": "07a73e5a46f58521d62eaae747afa0f9a8e32c2b1cb329925907449b2b8a277b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf770da-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516107, "uuid": "d805f62d-20c4-4403-b817-ec7691df5416", "comment": "Malware payload (Dridex)", "value": "af3413273661d6cd506d183644a7e571", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516107, "uuid": "b985793b-01f7-4f2f-9f51-c877ed2eca29", "comment": "Malware payload (Dridex)", "value": "07ad4a6fd9b08eef1ff5bf7f9f37c9c0a09414c5985da3e0b7c6804ee24f61f8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516107, "uuid": "3e0d5d98-1afe-413f-8562-80153d348a33", "comment": "Malware payload (Dridex)", "value": "21109a2874e25fcf40bd3ea9c048881376673073", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516107, "uuid": "e5ae357f-ab0b-4bf6-b8eb-5fef7461fd02", "comment": "Malware payload (Dridex)", "value": "2ed5f23c6027391cb0df22daeb91a8d18fcb795aaef532282c9ba602218d97fa86b6a350338e56cef6c6bdd15dcbfc7e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516107, "uuid": "c594f285-03e6-4d52-8a82-509860baade6", "value": "A1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516107, "uuid": "d08aa15e-39a9-4177-bb7e-189ef3d21a69", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516107, "uuid": "16dad474-a8ac-4dad-9888-b4fec045b498", "value": "3072:Rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516107, "uuid": "a0ae4e1e-3b7a-488d-bb79-92390f59f09e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516107, "uuid": "198f069a-17dc-4385-b10f-af7c5fa20a97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516107, "uuid": "abe473d5-9eeb-4c8d-9b7f-ecf588e402f5", "value": "07ad4a6fd9b08eef1ff5bf7f9f37c9c0a09414c5985da3e0b7c6804ee24f61f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169d7e4d-9e44-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618530083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530083, "uuid": "2a19b9ff-7e06-4334-b88b-c23c984bd4be", "comment": "Malware payload (Dridex)", "value": "f3763ea35b99ed2d5df3e5b5ab7bd1bc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530083, "uuid": "3059b52f-df50-45e2-875e-a44f9ebf18e2", "comment": "Malware payload (Dridex)", "value": "07eb7f4ddaf4b24b4185906856c1cb0b7bb961461ac8101996271f01961af8bf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530083, "uuid": "8f0ea1b3-f33f-4527-9efa-7afebfdb5148", "comment": "Malware payload (Dridex)", "value": "c05e841cca23caf9fabf7aa01871d9b6904902de", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530083, "uuid": "d6a9cda8-6260-45f4-8ad5-7e83c1e1f1f6", "comment": "Malware payload (Dridex)", "value": "fd86d502ad935f439705502151293cb64bd3f1a4840c9fc454515411c00807e42742a1c75503268e1cd491c8c7395ff0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530083, "uuid": "21bc3b44-a9a7-462f-bb81-9593368f1c35", "value": "F9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530083, "uuid": "155487c4-e3a7-493e-b4c2-c4b2e41ba633", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530083, "uuid": "f8dcbf16-83fa-4e3a-ac91-5f80125e8829", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618530083, "uuid": "d51c3ec2-a2c5-453a-bc8f-76266e39834b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618530083, "uuid": "062167fd-ceb3-4953-8072-5362214d7041", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530083, "uuid": "397e0fd6-cf13-4894-a553-2b1ab4429c36", "value": "07eb7f4ddaf4b24b4185906856c1cb0b7bb961461ac8101996271f01961af8bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699e7d83-9e3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618527646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527646, "uuid": "ae618cf8-b25b-43d0-b3f9-00bbeae2b38a", "comment": "Malware payload (Loki)", "value": "ded3437747896bac56047868fa9c1171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527646, "uuid": "8f941424-c3a7-4cfb-813f-d5d51cb6f14a", "comment": "Malware payload (Loki)", "value": "0845d40154d331ca63220f0414c42f86888bec8eb7b23af8b589e8e5a72afd9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527646, "uuid": "b7e56904-72a1-4ba8-be53-45d8b11cf75d", "comment": "Malware payload (Loki)", "value": "882bd8c0d58651e49688c1f918692c3983af245f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527646, "uuid": "ab48271c-d700-4914-8038-f86a621db186", "comment": "Malware payload (Loki)", "value": "c9b1bfc8503d47688ec32438d2cf496d3046d7a3f0419693146315a56d957a32c889e557cd45533fc4912b4fd5b8aa7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527646, "uuid": "741f5e6a-7505-4bc8-9959-49be207e38a9", "value": "3425089D7650B6EFC867C872DEA85C64EB60747B830BD203A01715EDAA0D99BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527646, "uuid": "5bff4e7d-767b-4695-92ac-6b7a4136d041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527646, "uuid": "e8917d3d-7b2e-48a1-805a-49fc39867cc7", "value": "12288:/VbRezsm17elPaJ44A2u4z2tX0Gh8qIIPow3hlbNVnfY9+HWSPVDj99rScuST8RT:/JRrm17sk3Ah46t5h8qDPow3Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618527646, "uuid": "651c9812-82b7-487c-b03c-71fcc6d527b7", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618527646, "uuid": "c71fdc33-7be7-40d7-983a-11e69146da3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527646, "uuid": "997b211c-9749-49dc-ab53-01a4ba6646ae", "value": "ded3437747896bac56047868fa9c1171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a9f87e-9d83-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618447271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447271, "uuid": "444c072b-c8b2-4baf-923c-693b55ea2093", "comment": "Malware payload (Dridex)", "value": "fa2cf950fc183e9d1bb1c7844db13839", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447271, "uuid": "3bd9236d-a952-432d-8986-edd633667fcd", "comment": "Malware payload (Dridex)", "value": "08546d7b075c4cbfba10ec630d7470eb860f0135e2ea6d40aeb13ce25f4c78b0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447271, "uuid": "45c715d9-d1a9-4334-ba27-ea318e66b1bd", "comment": "Malware payload (Dridex)", "value": "bcb64e3477c57f01f8cb2d2fa0ba36f7caece689", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447271, "uuid": "274e6ff8-0a38-4ffd-8dce-5f66639daf93", "comment": "Malware payload (Dridex)", "value": "adc61b7c109dbe2b5e1c273e3ee6f889a496fa0574995648c86a45a0724ddb3254b5cfc350c35e5821af744c2713cbf3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447271, "uuid": "b12a2868-84f4-4748-bfa0-6e3916269384", "value": "33F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447271, "uuid": "37a67743-9aee-4e40-8695-33d9ef71ae81", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447271, "uuid": "59b9ffdf-be2a-42da-93ed-b4c44606af51", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618447271, "uuid": "abd1d656-1270-477f-8845-7b02931714b4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618447271, "uuid": "1b7ebd6f-5d1b-4b3d-9bdc-0325d6dd6ef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447271, "uuid": "ba7a83ec-1bf7-43ec-8c8d-00dbcdcaf588", "value": "08546d7b075c4cbfba10ec630d7470eb860f0135e2ea6d40aeb13ce25f4c78b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa133c9-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "f3aca27f-7ff7-49d4-988e-fc7bb77a44e0", "comment": "Malware payload (Dridex)", "value": "267741aea738325d98144bfc0efa7a6b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "4c0c03d9-ad63-4fe9-afa9-3655355f02c3", "comment": "Malware payload (Dridex)", "value": "085519b007ffbf43e2be92deea015f2c5b99799495c55b4be8af042d8237ba33", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "59714bc4-4922-467a-a04b-af4e21a18347", "comment": "Malware payload (Dridex)", "value": "58d353f1c4df8f308e8db491d0fbf75d40357017", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "6af79be2-6c84-497c-84f5-b55ead4f38c7", "comment": "Malware payload (Dridex)", "value": "db0822db3625ac6f2101b0e8b6285ee3df8c5fad5209baf7f202b06a6549d664fe996e05d744db746aa5db2a06a94940", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "4156eaf6-c711-411f-b935-41f9eef1ea0f", "value": "BEF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "8e47d861-9baf-4f52-8d60-cf302b05b463", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "d5c8fb88-ccda-4d32-aecd-a2dc1d0c2274", "value": "3072:vA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:v3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464270, "uuid": "7eee5c0a-1548-49a3-9cac-808f2611a166", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464270, "uuid": "98e83e67-8742-447d-a21f-e2f0f6c6629a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "6c4aea7e-4003-41c4-bdda-5f6b35c824ef", "value": "085519b007ffbf43e2be92deea015f2c5b99799495c55b4be8af042d8237ba33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9e3570-9dd0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480250, "uuid": "92a7abc0-10f6-4071-a273-6a22efcf7861", "comment": "Malware payload (Dridex)", "value": "ee38e85241835a87912cd58ddecd0ea7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480250, "uuid": "c49bc9bf-8880-41e4-83aa-58dfd37f6f79", "comment": "Malware payload (Dridex)", "value": "085a55357264cb798a68a1916bf1549e0d136632cfc3931d65ff6a041f6b862d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480250, "uuid": "9b0a88a8-b4a1-42d9-8642-5aaa6819a639", "comment": "Malware payload (Dridex)", "value": "3e9653f425ca1b1c826d8fc3b6a98c322fa96df2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480250, "uuid": "e1aa1a47-de41-4d91-b200-d46bb2f9028d", "comment": "Malware payload (Dridex)", "value": "9cd28175496dadcdac5e70e1e4eab93c4a8f2766f7594286d0881ab99e755e1a77dfced710186fadba89b7df9e561eb2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480250, "uuid": "db2b531f-c819-4721-97dc-e395b03c8f99", "value": "2EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480250, "uuid": "c6e3cd02-7d8e-40d7-b22b-aaedb937acb7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480250, "uuid": "6c547994-4a9a-42e2-b8c8-406bcbd5eef9", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480250, "uuid": "f971fff4-48d6-4917-9097-ef4157725d9a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480250, "uuid": "2e8602db-df9c-471d-8a8b-7a7c49e433f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480250, "uuid": "d439e4ca-65a1-49f8-b7b9-171103fc0c29", "value": "085a55357264cb798a68a1916bf1549e0d136632cfc3931d65ff6a041f6b862d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f353a7-9de7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618490512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490512, "uuid": "2be8e67e-d6e8-46a6-ac80-ba044d9b1dba", "comment": "Malware payload (Formbook)", "value": "e4f3fd2e517743504817b7c3e2032de3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490512, "uuid": "abf7e117-8f96-4acb-8951-89a1d2b63b97", "comment": "Malware payload (Formbook)", "value": "08673c97c9a0e20536ce90e162e7da11dde8d4bfc4c01cabe7d3baeafaf449e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490512, "uuid": "18662ce1-a2eb-4724-b892-87c4dae691eb", "comment": "Malware payload (Formbook)", "value": "b42b6607bef7562a38a55b1d74fbb6e5d91f8fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490512, "uuid": "108d52e8-7ec9-49c2-ace1-f3d389a3d88e", "comment": "Malware payload (Formbook)", "value": "1f6bb24b1c5f11f4df8a871ac02e93a351813488febc2ef902c10d1872f9c6b23194bf27092e7b68bdf5e4d1aa68bcf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490512, "uuid": "46ddbcb6-3cba-4b73-b5aa-3ddc5bb194bd", "value": "E3F3A5B77285FA23D02695B56A250178F1A7EC304DD58607C1CE262722B26FFB764F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490512, "uuid": "d2be042d-6dc4-4425-baa2-57da6e81648c", "value": "66c809d2e31d4e6411dd9b96c6b12187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490512, "uuid": "12e15d23-60bf-456b-90cd-070b2295a4cc", "value": "3072:E4C7pdXpYywG+8NjNo/NKaBZ2/TJdFweCs2Z1:E4uIy3+gNo/Qaz2/TJ7ZZ2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618490512, "uuid": "6886f39c-935d-4fc1-9214-a783ecd85c20", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618490512, "uuid": "9251a2cc-4ae4-4f1a-b8c5-cb3001406923", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490512, "uuid": "9b28ac31-2733-4fdb-8557-ea314bfd9a1b", "value": "payment advice_mt103645367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07214cef-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496986, "uuid": "3f198fbc-0855-463d-b77f-5d489c3be670", "comment": "Malware payload (Dridex)", "value": "6e792d0e6b5dd5497aea1a81e61bd6c6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496986, "uuid": "18c57268-02d7-4c97-8a16-16b62002ec45", "comment": "Malware payload (Dridex)", "value": "087efe7b591a56f79b189eb8034b1419e0c7634fdd7b4a332304646b8cc703ef", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496986, "uuid": "c445e548-2a18-41a3-a576-5729821a3ae7", "comment": "Malware payload (Dridex)", "value": "0c458b6b3600c4cb14c0b4b7d96f2cfd9efdd076", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496986, "uuid": "750093d7-b255-4dee-b28f-ef6846b07f89", "comment": "Malware payload (Dridex)", "value": "d58270c85b014ccc73f7a9f4cd6e6ab7c111cd633f6adda5a97004146955776aa39552a8c063e52ed7518c66e5a1754d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496986, "uuid": "823c34e3-25bf-44ec-bb1d-7cf573532296", "value": "33F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496986, "uuid": "1fe8e78e-250c-42dc-a272-8a1d1f945fee", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496986, "uuid": "da6370c5-dc92-4656-bd8b-cf44fe573174", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496986, "uuid": "42107ef4-dfee-4bd1-8b4e-8ef8a924d920", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496986, "uuid": "9969064c-e73d-4b47-9f19-f2a57db98996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496986, "uuid": "dd5452c1-4201-46dc-a6c6-12e2ed176f3a", "value": "087efe7b591a56f79b189eb8034b1419e0c7634fdd7b4a332304646b8cc703ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509fa151-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480789, "uuid": "4aa67505-2d3f-489e-a2c6-1f416248b027", "comment": "Malware payload (Dridex)", "value": "340e35b508f89f67a72a6c2d781f5ab8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480789, "uuid": "a9eb75e6-7e0a-4148-acf0-d76f33cc7bee", "comment": "Malware payload (Dridex)", "value": "089745c1300fab1041989afd183d802a980d9b352075216ab3ccbdb6d320ea68", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480789, "uuid": "10978bec-0fa1-4b4e-a109-c4fb88f4facf", "comment": "Malware payload (Dridex)", "value": "ce704e6b9cb0397ed9d2c9a7208302c95650da07", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480789, "uuid": "c24f4886-1f35-48c9-a7a2-81a151df01b7", "comment": "Malware payload (Dridex)", "value": "a8fb0362d09098163fd3a45a68aeea955324272614be0919bdf4414b742bd05f026e55c9644d45322b1c3c0d2b787e44", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480789, "uuid": "a8209056-1ff4-43b3-83c9-439c31f0212d", "value": "FFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480789, "uuid": "53bddeb2-1918-443a-8674-a1e4a58e2db8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480789, "uuid": "5e33c2bb-d6d5-4e12-8952-dc39438f5a5c", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480789, "uuid": "527e2fa6-531e-4a99-b84f-377e9f6a1522", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480789, "uuid": "aae632ff-a542-4c35-94ae-d7eabb94abfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480789, "uuid": "11916f06-bbee-4c06-b94f-6f65bdd67ff6", "value": "089745c1300fab1041989afd183d802a980d9b352075216ab3ccbdb6d320ea68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fd6522-9e0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618507661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507661, "uuid": "fb8b0566-731c-45bc-8316-7eb0954e4a33", "comment": "Malware payload (RaccoonStealer)", "value": "01a94f8da150273c7ed817888ab06afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507661, "uuid": "e96abc5d-ce19-4cb1-a358-67f4acf1e4a4", "comment": "Malware payload (RaccoonStealer)", "value": "08c430e1f712b8538ac261b7998af6c00f89bb75d273183dc563c54389a2fba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507661, "uuid": "bda3eab1-d95e-4569-b59b-cd9b87535952", "comment": "Malware payload (RaccoonStealer)", "value": "cb9948ba2193e06c764a41da7e8a8937b361a3f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507661, "uuid": "e10d4257-0cea-4ae1-a922-b0b997521460", "comment": "Malware payload (RaccoonStealer)", "value": "49d57bdc2f4dcb14e7f3195f00a8b55ecf52a847532c06f83f872481aa73cdd1dc36f7dfa6d701ecf52ed83feb6d7767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507661, "uuid": "abee587d-d989-4b4a-b961-34b8d7eb7311", "value": "E7B4F1023AC0C032C49235368939D7B15ABEB43455B66A8FBFD91BBC6F386D1672531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507661, "uuid": "55ab1b23-28e0-4e9e-94ba-559cad65d4be", "value": "e05089ebdc79f6153676cb08f724c74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507661, "uuid": "b2f78b58-5f0e-4516-a015-b92e99a08e84", "value": "12288:kw7e0KbF5v6/6j7cCq2IgK9qci1bNkVjVXCcA6TDzJfOZHK:kwjSF5S/6ECq2IgjX1hzcA6Hzwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507661, "uuid": "4160c696-8bd3-4ffa-8827-e5ffec20ec31", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507661, "uuid": "2f16056f-1b3e-4b8b-bee4-6d2431fc6c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507661, "uuid": "5d6d3bc5-284a-4d0d-9e77-67d99466a056", "value": "01a94f8da150273c7ed817888ab06afb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193135c2-9e0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618506036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506036, "uuid": "9e1a8770-d7ef-477e-9d9c-ded496a47f4e", "comment": "Malware payload (Dridex)", "value": "f01a1e464a4d25a68d0350c5a5642cfc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506036, "uuid": "af252e94-0734-491c-ac9b-3c93bd1594b6", "comment": "Malware payload (Dridex)", "value": "08ee0b9897a56e8bc117339147f6a0d89785be17f02641c7130804756a3032cb", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506036, "uuid": "e3443f69-ec4b-4d79-a374-9093e3d581e4", "comment": "Malware payload (Dridex)", "value": "37d9c4e88509446437f80c05b55ede009c1acfe3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506036, "uuid": "c274c781-1a0f-4633-acd3-864c9455a740", "comment": "Malware payload (Dridex)", "value": "133c5ff16936e1de49690ea047dd68f8c407fad806afa062d1999c29dc8201d8ee5c40a6d45086d506b2378d72938822", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506036, "uuid": "48fa5171-2fa5-4e44-abf4-6ead550e5bfe", "value": "5BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506036, "uuid": "37fa1996-e8f8-44f2-a8e9-b5298d10a10b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506036, "uuid": "3fb3d4cf-5bbf-420a-add1-340ac2fd4309", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618506036, "uuid": "de2289f3-3dc6-4203-b11e-b4720e0e2c6b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618506036, "uuid": "eb26e19c-ead0-480a-8a7e-b6aaa94c204d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506036, "uuid": "cf577ede-a52c-460d-a929-e14a54bb9b75", "value": "08ee0b9897a56e8bc117339147f6a0d89785be17f02641c7130804756a3032cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41297a08-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "abfcaed3-eb36-473c-88fe-4bb2b2ff4b23", "comment": "Malware payload (Dridex)", "value": "272b3ecb4ca7aab148fdd533208693dc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "e5312974-97ed-4a15-95b5-a3a0c57c9edc", "comment": "Malware payload (Dridex)", "value": "0931afbad7c730095100e3e76f164f599e9597d934fcb6e0733dffa631368203", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "9168e91e-b6fc-4dc5-954a-f62c38166e64", "comment": "Malware payload (Dridex)", "value": "99224f989f8cb0b2b39339d49a7f233fecfe918e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "e4fb1b09-7f2b-471c-a30c-192de42c09c3", "comment": "Malware payload (Dridex)", "value": "141f15d4f1cf3395dd75d2e50a6ce2fd4c77dbd48b29314d85dfdc8d6e99b60dd7099d8f8a97ceb68bfc656ed674b547", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "61d93a2c-7e5b-4ce4-90db-0bb418ce0823", "value": "9DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "a8d7de78-2abf-4587-ba29-516f05fe82a6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "f7116f95-990d-4535-b308-717d5a34c0ee", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515981, "uuid": "e3a15015-b929-4ab7-a600-6833d9ff9009", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515981, "uuid": "ec77eccb-9906-46ed-bb87-456f3188e12b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "0c5c9935-4b57-4e79-b559-ef07bd5f3495", "value": "0931afbad7c730095100e3e76f164f599e9597d934fcb6e0733dffa631368203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9fa8b3-9e32-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618522475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522475, "uuid": "650944d5-b7cc-48e1-a301-f60bed022e99", "comment": "Malware payload (Dridex)", "value": "439511d3542c756cf795e3f5f20d2f09", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522475, "uuid": "b4f14c7c-80da-42bd-9ce3-877856363edd", "comment": "Malware payload (Dridex)", "value": "095525a818bd5b16f008d6912b59bca39ce4ef5fac2a990097d99d57d7421af2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522475, "uuid": "1194cfaa-5335-4107-93aa-923ee3a74ca4", "comment": "Malware payload (Dridex)", "value": "27fdb2422b30957eab6692e272896be9c76b1f42", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522475, "uuid": "683f7df7-8b15-443e-b976-fa2ae3741b86", "comment": "Malware payload (Dridex)", "value": "d3bcfa81899e8145d9b7382998030910aece1b31b19c1c5af16cf7daa431f4988ed59e06ba6e3e71f91d1366b36fcb98", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522475, "uuid": "481d0f56-1ab8-4bb5-8ace-224b1ea01893", "value": "C5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522475, "uuid": "5737eb4c-5adf-4006-9c23-b53f39d8a609", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522475, "uuid": "cf9929cc-ae60-4ca8-8dba-68b3801b5d9d", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618522475, "uuid": "67d85cc0-dfea-4890-8b64-9942f24e3ad4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618522475, "uuid": "4afb0eb2-72aa-4055-b226-3d9d6bf2f6d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522475, "uuid": "c80b21bd-01eb-49b1-9a76-849f3800a771", "value": "095525a818bd5b16f008d6912b59bca39ce4ef5fac2a990097d99d57d7421af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ead403-9dc2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618474543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474543, "uuid": "3ff61f2c-9ae9-473a-a5a4-d5c730ea915f", "comment": "Malware payload (Dridex)", "value": "b75c757d7bf961c69eef5e0f7ece144c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474543, "uuid": "5eabcdfa-5050-4373-b9cc-25b9c0fe04c5", "comment": "Malware payload (Dridex)", "value": "095a2c9953f7ac0acb21b0278f7ae481ffa3a2ce361ab05bc48e0490147bf165", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474543, "uuid": "8446a674-cc8e-42ce-a68e-fa5499b82b25", "comment": "Malware payload (Dridex)", "value": "f472c1b7e87ee74f0243f78763fcd21fb7ca802d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474543, "uuid": "4c3e2c9c-f52f-44db-bd97-06880f6bc696", "comment": "Malware payload (Dridex)", "value": "f9ee29679debc437ac954ee8f80d7d296092b2d7db5d0a3b6b1b744c4aced20804f3ecdfbf82556fedf9b46ff44d32a9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474543, "uuid": "18cad2cb-29b4-4f96-8dee-7034df11638d", "value": "91249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474543, "uuid": "a26ab87f-ac91-4733-9aea-18d5dd14a229", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474543, "uuid": "cb70a531-a2fe-4b2e-91e7-54126b28fd29", "value": "3072:V0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:4pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474543, "uuid": "5b5f0fdc-7734-4123-89c1-645b40f4b4b3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474543, "uuid": "c65eb738-97f2-4a5c-bcf8-7cb804c7c7ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474543, "uuid": "7df15a70-0ea6-4a07-aa59-b07ac60d23f3", "value": "095a2c9953f7ac0acb21b0278f7ae481ffa3a2ce361ab05bc48e0490147bf165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb8a8e6-9d85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618448248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448248, "uuid": "b8d13c16-c63a-4889-aca8-1b9f6714f086", "comment": "Malware payload (Dridex)", "value": "68e2b83c613b1663248d15a0684d5755", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448248, "uuid": "c0b52c5c-5282-4662-b6ec-811b86a4e4ab", "comment": "Malware payload (Dridex)", "value": "09644a1c701cbcb095488cbcf6728927e7b937e33bae7960f0a2f2d8ab824f04", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448248, "uuid": "520c75c9-07ce-4fd6-9f2c-aa8e5d3472b7", "comment": "Malware payload (Dridex)", "value": "2939c9a3413683235b7ba7ce04ccbcdeb240121a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448248, "uuid": "e6c0bb0b-6128-4b38-ac5b-2763cfe51fe6", "comment": "Malware payload (Dridex)", "value": "807c1b99f2340cd08cf57f3b9e37e07b5116b012f203b6364fb1d5507e3847a618d99126f3b09101f626165d82686f64", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448248, "uuid": "c6343a3a-5f10-4d8e-96b0-fefd5bb33c64", "value": "ED249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448248, "uuid": "b9bc6a4c-96c8-4980-9e97-aee89a2c78f1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448248, "uuid": "232347ae-158f-4b6a-a714-2920284ba189", "value": "3072:F0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:IpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618448248, "uuid": "18fa8fa6-2fba-444a-9e36-8b8177dcc622", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618448248, "uuid": "268013ea-3aca-409e-97e5-bda5c3d6bc83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448248, "uuid": "129ae668-548d-4e6b-ac47-9e724e30e6a8", "value": "09644a1c701cbcb095488cbcf6728927e7b937e33bae7960f0a2f2d8ab824f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50878c02-9dca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618477782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477782, "uuid": "d3fd6546-7d29-4e17-8508-575358d68e5e", "comment": "Malware payload (Dridex)", "value": "93d6a6a9281dfce87389db64f8680c6a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477782, "uuid": "27b1b758-894c-42a6-9084-d68c600e7e9f", "comment": "Malware payload (Dridex)", "value": "097578c7f165966d1f36ff12be7a34b6f344da62da6d510fceaca8e838e7fabc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477782, "uuid": "689759fb-b159-4d71-9645-a0a2124e69ef", "comment": "Malware payload (Dridex)", "value": "f43aeb110854cabd97223b6f970f5d8f83cce245", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477782, "uuid": "330db967-1938-47f4-9d5c-21dfbdc7764a", "comment": "Malware payload (Dridex)", "value": "99264d05b8420c7d4a978dd1c68fb3bf07adbbdab6000a3576b798eef7ed4238b8f6a7c8ede2d80d41473f383220f75e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477782, "uuid": "9d738df1-fbeb-42a4-a7b9-1b6a1f6b8859", "value": "8AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477782, "uuid": "071f5427-8d7f-48b1-aa9a-734b43f59248", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477782, "uuid": "1c8767b5-f055-4146-8743-0ec992fe6c1e", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477782, "uuid": "925c55bf-15c1-4dd5-857e-f82b1a5920af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477782, "uuid": "a0379a7a-333e-4d3d-8d94-c092430eb4fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477782, "uuid": "06917c50-f8bf-4998-b104-7ae7d0ff8f75", "value": "097578c7f165966d1f36ff12be7a34b6f344da62da6d510fceaca8e838e7fabc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a60cd0-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "ee81262c-65d5-40a0-ac66-0eb2dbd899d3", "comment": "Malware payload (Dridex)", "value": "1e5dec53a4a2ac792dbfdf5d32e6cd8b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "250585eb-b077-4fae-bc34-c05e54ecd28b", "comment": "Malware payload (Dridex)", "value": "099db1c33644e505301993f7f398c9ccac15f0df63d82dfd433d67d44914de37", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "572a603d-20ed-4c53-b145-1b37ddb7def3", "comment": "Malware payload (Dridex)", "value": "4ab96b945cc062fb5a8844b214f1c5c78e3da918", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "1e72f7ae-379c-4091-9bcb-5db16ea0eb3b", "comment": "Malware payload (Dridex)", "value": "bfa09c61df32e730ef15824cf911d640970cb4f73fc811ff2a48b4b30b04f4d515d033e378f05bb941dd506ba8fe318c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "521c8f65-58e5-4879-bfbb-7d153810bd59", "value": "A0F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "406d9f97-03f1-47f9-b814-10c41ed55902", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "5d0a80c1-e8c1-48e3-83ee-604f92a7728d", "value": "3072:pA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:p3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495960, "uuid": "875d036a-4b8f-40a5-b0f3-238b6c10575b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495960, "uuid": "3c4a741e-aeb1-4405-a55a-ee98b1f946bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "3d1d40f1-2157-4ff4-b470-07c9a96afa21", "value": "099db1c33644e505301993f7f398c9ccac15f0df63d82dfd433d67d44914de37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93b4000-9e3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618526491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526491, "uuid": "dab026d6-cb45-4636-ab13-861fe6a45212", "comment": "Malware payload (Dridex)", "value": "524c74ba507b12ce9e65078a61be5bae", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526491, "uuid": "3a05d6a7-23cf-49d8-97f8-c3c2149c4933", "comment": "Malware payload (Dridex)", "value": "09e4984869ddbe224834fba2a033fecdb63061c49dbdcdbd5fb01ce537c6de56", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526491, "uuid": "9dd2d9c2-c832-42fa-bef5-f22eedadea6b", "comment": "Malware payload (Dridex)", "value": "d1d0afc747e0a15d147e7e7117b9a8c61ae99401", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526491, "uuid": "ed7c1e55-3ca6-4834-a0e7-171caf6223bf", "comment": "Malware payload (Dridex)", "value": "d3465b172ef6847f8d0b3a70bc08db36b925035d3ea70acdebeaa4cb3d0f1ffe8e52e502ceb068d254ee601005f6748b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526491, "uuid": "a1349c31-72ae-44d8-afbe-d80cd016fbaa", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526491, "uuid": "f2fe7209-3abe-469b-bd4d-67fb9e1773e3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526491, "uuid": "b099d39d-6bed-4cd8-b894-3cb46516decd", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618526491, "uuid": "5081c8db-1bd0-4fb0-8b01-f978ef5b0b3d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618526491, "uuid": "41a69da5-187e-45f9-9301-5159371f264b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526491, "uuid": "76e7d357-9000-4d67-a7ff-a97781903736", "value": "09e4984869ddbe224834fba2a033fecdb63061c49dbdcdbd5fb01ce537c6de56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10435182-9e2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520624, "uuid": "e59391d1-667a-43c8-bd47-33feaa2f5475", "comment": "Malware payload (Dridex)", "value": "dd78a314de93c3467e707b788fcc3521", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520624, "uuid": "81dbce6b-a842-4aae-b640-c2e70b36786c", "comment": "Malware payload (Dridex)", "value": "0a381403cb1436005139d2fd018478b14c40a913e357f1707d163fa6b86d4dfe", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520624, "uuid": "4df457f4-a78d-423c-baa5-b2b52e75d843", "comment": "Malware payload (Dridex)", "value": "d213f6eb53135a749d59c096a56fc180742ff014", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520624, "uuid": "8bd42b1a-cfbc-4b72-b636-7f140bdf7281", "comment": "Malware payload (Dridex)", "value": "93372069aa592a39a3b2c49ab9129090e461fb482d53b55f5467073e5f061f4ba2a360c264d73ca3f2547c03453465c5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520624, "uuid": "af7f6c64-d989-412e-8784-93669610c213", "value": "CCF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520624, "uuid": "f4dd4f59-3a1b-45cb-bb57-f04b7ca20e3a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520624, "uuid": "43b09212-05bd-40a1-b7ea-c9b037ae45d4", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520624, "uuid": "7d009829-a9a0-4f85-9c2d-7196dd95991c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520624, "uuid": "70663bec-851f-45a2-8f1d-508bad8ed4d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520624, "uuid": "93618151-0f5d-4287-a5a6-e675b66c73df", "value": "0a381403cb1436005139d2fd018478b14c40a913e357f1707d163fa6b86d4dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34df8b52-9dc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618474729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474729, "uuid": "69c34429-0805-46f6-b115-bbe34d7a23af", "comment": "Malware payload (Dridex)", "value": "873792debd85f5551719a15c5baf7734", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474729, "uuid": "551cab1a-cd5a-4fc6-a0ef-f8341b7bfeeb", "comment": "Malware payload (Dridex)", "value": "0a407cf2d0a3fdc724b22c5c05975ecccf16f9d6bc74bc26229700503982f435", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474729, "uuid": "66240b6b-4fa3-4682-9ec8-900f7cd9caaf", "comment": "Malware payload (Dridex)", "value": "781925e0702337fe97dbf3ee59d20bc1328f8415", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474729, "uuid": "17327f3c-df31-4154-ba4f-ac1a5075826c", "comment": "Malware payload (Dridex)", "value": "f1051d89a788b129d0c6e42a3a936d31cee755406d0ab3c032cb50f27b6e8e002b4be0629b7fd653915817f936414a51", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474729, "uuid": "9332f331-b6d8-444b-af14-c2c1bbc1c48b", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474729, "uuid": "613f1576-4516-4681-9ab0-6be06c435909", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474729, "uuid": "c547d551-5a34-49ab-83e2-cfed627dd69e", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474729, "uuid": "02ce8388-bfe1-4975-8e2d-b50047326d68", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474729, "uuid": "a08f01f2-c4f5-4b0c-b4ed-cf3a7929fd74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474729, "uuid": "f293c81e-77b5-4b90-9ba4-e5df09d7fc7a", "value": "0a407cf2d0a3fdc724b22c5c05975ecccf16f9d6bc74bc26229700503982f435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52d2065-9dc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618475481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475481, "uuid": "735b930b-31c2-4a40-8450-ed4f5ada8aa3", "comment": "Malware payload (Dridex)", "value": "4e9ef553226468610d2091f105b8bf81", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475481, "uuid": "e1dce70f-5f68-4d64-8af6-c9a76aa56522", "comment": "Malware payload (Dridex)", "value": "0a6982e458f890195946b0c18fa801c670d578537f9f9cd1670be0673117fe29", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475481, "uuid": "ac250641-0a39-4ab8-9c4d-5e27922db93a", "comment": "Malware payload (Dridex)", "value": "f8efc572d8068ad3238c3600d3171cf57940a221", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475481, "uuid": "89190c2c-ca1f-42a5-b9d6-066d116eaccf", "comment": "Malware payload (Dridex)", "value": "78fa54a325967b985693e08078109f50ae0267c8b627489c6864a262f212efbd0cccaf4ef79e5995b582869ed1cfcb1c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475481, "uuid": "cc3a9781-8285-4bcc-90f6-bd30ebb5a0ff", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475481, "uuid": "c0d18a6b-8d66-4923-8d08-b94be7214f97", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475481, "uuid": "1e7a3bd3-8794-43b1-9219-94883d111538", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475481, "uuid": "c1c9facd-3f0b-4079-81e1-780deff6b977", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475481, "uuid": "bd80393c-a98f-4fa3-9d33-593d647574c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475481, "uuid": "2e66d518-7554-45d0-a951-c6a16881826d", "value": "0a6982e458f890195946b0c18fa801c670d578537f9f9cd1670be0673117fe29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb91b906-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "02764e57-85f4-4b91-aafb-84388feecb75", "comment": "Malware payload (Dridex)", "value": "2d0653add3b8be48fe97938ccea222d5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "2c45f1b0-4dd9-4edc-8579-4276707159ed", "comment": "Malware payload (Dridex)", "value": "0a6bdacc065ba15d352915421900723e77622269b5b2c83db4814303be7039b7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "e4b085ae-bd24-4288-9bb6-a0f9635cfbae", "comment": "Malware payload (Dridex)", "value": "a2c0d3044845999a92bb3ab0e3aa33cc0999d2e0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "6d1ef8ac-9da5-4d68-8a09-983d7ec74729", "comment": "Malware payload (Dridex)", "value": "2a903646a287ff2585c2d04cb161ec6822683ba86b581d95040419349e00f1df631c081eca2fe10eb0fa0bbbd9a5a35e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "2abe69be-f235-4277-a5a8-90cdf1efbf3b", "value": "E0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "137fe1ec-332e-416b-b789-6c447a6fccdc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "7e8bbd84-ec18-4fa0-bee2-6714526f03c8", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496081, "uuid": "0c27db01-a372-4204-a003-fab6824fd3b4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496081, "uuid": "7141fb31-00d7-4373-bcbb-42138e375a53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "23d22e6b-047e-4117-bd3e-8f87d0710175", "value": "0a6bdacc065ba15d352915421900723e77622269b5b2c83db4814303be7039b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cae002a-9da4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618461535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461535, "uuid": "753aa541-59bd-4e65-8973-603e2577c753", "comment": "Malware payload (Dridex)", "value": "ba78a22b1c7d24d09a89c556eb54feaa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461535, "uuid": "ee18854e-e2b8-45a8-af57-3942e3518319", "comment": "Malware payload (Dridex)", "value": "0a83db8e51347fd329746c57dca0ae562c085c4e73687047cc1387dc46aebc62", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461535, "uuid": "f003d759-1671-4cba-bcbf-0a4f98c61d1c", "comment": "Malware payload (Dridex)", "value": "97e5dcbdb6c1d5efca8b16607f3806f5fa19646a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461535, "uuid": "1d178cbf-ce91-4895-bdd9-4aebc8e294a1", "comment": "Malware payload (Dridex)", "value": "9ccd5062500435a975ad4977410080efb2b8c9ca6dcf73499df8738fc19ca8c04f5b332751e086e6fca2bff774cd17f7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461535, "uuid": "3b397110-1dab-490d-9806-828809bfcb7e", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461535, "uuid": "e9536c52-45d9-46fd-acac-327c0ebdb109", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461535, "uuid": "42186eed-7a11-4204-a707-65bc4c193f53", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618461535, "uuid": "2cba8d3c-7d69-4807-aaf2-a6b801521d62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618461535, "uuid": "1435f36e-aa5b-4d82-9531-bb2fcdff84d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461535, "uuid": "70a2478e-eb00-4598-a459-d4f2d9632c2f", "value": "0a83db8e51347fd329746c57dca0ae562c085c4e73687047cc1387dc46aebc62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79a791b-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618514516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514516, "uuid": "663da56a-5553-45b8-afab-c562b5a45405", "comment": "Malware payload (AgentTesla)", "value": "8f4857e05345fe4a94ea07aedc97710f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514516, "uuid": "4acb184c-81b5-4143-8a4c-5f679d350fea", "comment": "Malware payload (AgentTesla)", "value": "0a849cea1649ae3183e58904f0cc302deede0ab6e67aa0a825f4820831e966a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514516, "uuid": "4a2e50eb-d577-4847-be80-0a9e34ae55f2", "comment": "Malware payload (AgentTesla)", "value": "767d791e82903f85e6432096df252de28e5f6bc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514516, "uuid": "ad3ec5b9-5296-4f4e-9be0-b7217cc25a5f", "comment": "Malware payload (AgentTesla)", "value": "d6ae696450b15b7d8ce75c11137887c47999c1a57536e0d0da0f65837815f66f8147444db8b8ff835806b91fb5150bbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514516, "uuid": "b68daeac-6c01-47af-8f47-cfb82e77cece", "value": "06B5335ABED1DE17E45F143429CDC42EC5ACCD111DA8EC1AB2AC7A393233466B7E825C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514516, "uuid": "9348533c-c25f-4e64-85a6-c06e670db6de", "value": "49152:oEpg9Qn5WSohMsA6mcZO4F3BA61jQIY+rvvL:JGQ5WrhMV6FZOHwQyvvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514516, "uuid": "a2444ad4-0985-4258-a378-43bb7199e413", "value": 2373632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514516, "uuid": "f07ce666-d546-4a7b-9ff4-55c606c59c46", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514516, "uuid": "d76e96e9-643b-4a75-a902-58f9e090e8f0", "value": "New Order Products.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babefd97-9dc6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618476242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476242, "uuid": "cbbad686-1f9b-42d5-b7e5-032f7f3096a4", "comment": "Malware payload (Dridex)", "value": "62bdf3affd4fa4980337cb11bbdf60f7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476242, "uuid": "801c71df-7b78-4476-8de4-58cc98db8b32", "comment": "Malware payload (Dridex)", "value": "0a9cca4fa8d574e464ea9c394a7151c1e7d17bd957e7a359402476b802ec2c5f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476242, "uuid": "065bee2f-8463-44d7-b38c-c6d8ad9c62e5", "comment": "Malware payload (Dridex)", "value": "e86ec0f07e3eee35c50e626e16bad8f904028d43", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476242, "uuid": "5711ddb6-ccbb-46e3-9cbc-e68cf2ec30ea", "comment": "Malware payload (Dridex)", "value": "31438ec4d539cbe74d1211f34d493dc76405566046dbc4d7f763abf6993905a4ac969050a66498c0229a4c8c76ee71af", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476242, "uuid": "8c0289a6-318a-4ec6-b82c-b35654c662e6", "value": "56249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476242, "uuid": "345d8716-4fca-41b3-ae37-48fbaab5f3f0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476242, "uuid": "0f24b558-a854-4d9a-97f4-ab21defce956", "value": "3072:w0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:LpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476242, "uuid": "92f71b7b-5eaa-40d4-b406-6cee0b393248", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476242, "uuid": "3cbf9dc1-ddfb-4631-a1db-9664e0742d26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476242, "uuid": "eee22762-18d5-4b12-b07f-e06b817f73f7", "value": "0a9cca4fa8d574e464ea9c394a7151c1e7d17bd957e7a359402476b802ec2c5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82fc7f7-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "1677a6c0-01df-4c4e-a1eb-682dc0048f07", "comment": "Malware payload (Dridex)", "value": "264ceb12210085557dfb2421eef61004", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "e69cf89b-6871-4df5-a338-cc3a097893fc", "comment": "Malware payload (Dridex)", "value": "0ba99476cafda35f5d42de1ef7c73d7fe60d47640d839301ea38aab956be494b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "6ea47127-6050-48fd-98d2-91a3963788e0", "comment": "Malware payload (Dridex)", "value": "a4f37a2acd289b8d7e539a2acff560e031b46c12", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "a9367957-ce5b-4504-ae60-5c9a355b2828", "comment": "Malware payload (Dridex)", "value": "c6b7fd4a332fda8b9ee1132cf1561ffa40b5e798948d23c789080dde351b6db863bff148dfa435f1a544712ccca70e18", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "72c166ae-6e92-43ba-9543-4364c4867154", "value": "EBF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "c7d5e475-348f-4754-810b-3e1c51204c80", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "5c3d6251-8457-4acc-98c6-fc12f7e8a54c", "value": "3072:cA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:c3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495995, "uuid": "5fc8ef68-586f-40e5-b56a-db91f7a74f6f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495995, "uuid": "abfb51b8-9e70-42d0-b2b1-903d32aabdae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "026d8f95-58e5-4f7f-930d-a4efc59476b7", "value": "0ba99476cafda35f5d42de1ef7c73d7fe60d47640d839301ea38aab956be494b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5672dda3-9e0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618505280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505280, "uuid": "7f993658-6af9-496d-9d34-dff9ea64a623", "comment": "Malware payload (Dridex)", "value": "fd5ec19b9eac27237632c40583fceb90", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505280, "uuid": "49388248-06af-4696-9e80-555627c4eec4", "comment": "Malware payload (Dridex)", "value": "0baf3c42cbf6805846d013dc666e5c31b760bab4044bf650ecbeafbccea1645e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505280, "uuid": "f6db457d-4791-4e7f-a34a-04564e6a3ecb", "comment": "Malware payload (Dridex)", "value": "7dae3edef1c030e50e47dfa975f380e6274a4446", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505280, "uuid": "ca4b5bbd-6c60-43f7-b655-d3aeaef655f2", "comment": "Malware payload (Dridex)", "value": "de53e44843bdf391ecccbd13a7b4eaea393229ccce6310f8b2da7c55b4e85bde5ad00e49fc096f6185827e65352f076d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505280, "uuid": "1b8d3448-658c-49f7-851e-d7ab9b9acf15", "value": "7BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505280, "uuid": "67a3ee4f-8f95-45de-929a-044724bf11d0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505280, "uuid": "3e7da5c3-70dc-4fc5-aa5b-f3281dd22c52", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618505280, "uuid": "108e4fe4-e9db-48ff-b9af-a50bd1abc9f5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618505280, "uuid": "7d92ac49-54f3-440c-b2fd-ca3126495495", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505280, "uuid": "ab785cbc-b15d-4c31-b31b-afd6367b5aa3", "value": "0baf3c42cbf6805846d013dc666e5c31b760bab4044bf650ecbeafbccea1645e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379a3fb7-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "7f34c42b-6f26-44dd-992e-4ae6b4991f9d", "comment": "Malware payload (Dridex)", "value": "349e45e64781b58542c9a0732c48d52e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "c22218b3-ee8c-4663-b628-f525b572c83f", "comment": "Malware payload (Dridex)", "value": "0c311895e472b666f31376e55e0f350110dd540b8ee490445e75f24abc4e927f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "395d54b0-21f4-44d6-b15e-4f36a9036a04", "comment": "Malware payload (Dridex)", "value": "dd97a95f32c08aa9919a77d33336560b8fac68e9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "a253e15c-b30f-4678-9691-9075e41ba18d", "comment": "Malware payload (Dridex)", "value": "39168d663c9477c09ca79e094347eeb9f87ba0bb2e7363b0d4a6db99380e581b6ce8abe2edd7c9f92e3285392882e63a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "e978596e-a6ff-4a4e-91a8-5ebde660e7aa", "value": "5DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "8153f57a-c3e7-4a1a-a4a9-368fa3ea6dea", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "adeef59b-e460-4bb8-a1ec-3d35aaf237aa", "value": "3072:AiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:reAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496638, "uuid": "13056d75-26a9-491b-b707-8006c9f5572e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496638, "uuid": "66e94ac3-a80b-4a63-aeca-418c02011c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "84b7ccf7-20df-4a55-91b9-34f44222f09c", "value": "0c311895e472b666f31376e55e0f350110dd540b8ee490445e75f24abc4e927f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c84914-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "96c20043-8253-4c7f-bda7-1628d450b70c", "comment": "Malware payload (Dridex)", "value": "43550fd48a77599f3f5dd7ba1f93e0a7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "bfa354b7-59b2-490d-988c-2c416675817d", "comment": "Malware payload (Dridex)", "value": "0c45739d5de399a01f02865d005899a7439d4e466608b8811420b76c9faa1138", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "354f6283-6281-43a0-b495-e8205898e009", "comment": "Malware payload (Dridex)", "value": "21b40756e742e7437487d37c078bac76b4de6493", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "dd31c45f-2417-4d9d-baf7-7a160f95420f", "comment": "Malware payload (Dridex)", "value": "ad994897317ec4f18320d4f2282570cc0c7cd8697e2f7b67047195abb6ba4fb97dac7ad3d4bb4e50063c305d061332ae", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "77b0005d-d243-4a97-86ce-598b325f472f", "value": "A9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "0bf85045-bb71-4d1d-88bc-aff783f7453c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "1828b946-375c-4990-8b0f-48d7c50fa738", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515929, "uuid": "03182d1a-00d2-4fe2-bac1-7dcdf522b28e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515929, "uuid": "4ad16aee-d74e-47b2-8481-b0f7e248073d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "adacf699-7ff6-4b15-86a3-ba7f01d7254a", "value": "0c45739d5de399a01f02865d005899a7439d4e466608b8811420b76c9faa1138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54019bb1-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496686, "uuid": "51cae745-e528-47c2-b92d-c7be91982853", "comment": "Malware payload (Dridex)", "value": "525630bf9905559ddc41db7cfe075820", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496686, "uuid": "298bf0f6-bd1e-4699-9254-24b89507410f", "comment": "Malware payload (Dridex)", "value": "0c662dacd985f05cec5ceff4a0c52fe34248e28ebf851104ebf6b89153294680", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496686, "uuid": "35ab49d4-521d-40c3-b683-c2e5d0a8040c", "comment": "Malware payload (Dridex)", "value": "bed02bce501461db7d61dd1540c8c3e37ea0d64f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496686, "uuid": "357ec237-1d0a-4f9a-a24a-00cc225d3f8a", "comment": "Malware payload (Dridex)", "value": "a8bff459005d8e0e581580dd1efac2c4c4bcb2a1aca15eea013290c1e92726ae7beda7df7b94760db4f0b7d2c0e4667c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496686, "uuid": "650949c6-3a6f-43cc-a1b7-9eace83391ea", "value": "78F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496686, "uuid": "f5b96556-a6e8-463c-bf5f-9c23acc253eb", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496686, "uuid": "3cd31631-d5ff-4ceb-947f-d6047eb8efcd", "value": "3072:VA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:V3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496686, "uuid": "7dd834d2-0440-4f52-be47-30f527e2548e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496686, "uuid": "5f7a5769-505e-452f-b43f-a0f335a30832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496686, "uuid": "66680b78-7740-4803-ab0e-7d8848c965f2", "value": "0c662dacd985f05cec5ceff4a0c52fe34248e28ebf851104ebf6b89153294680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cfcd06-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "8deacf62-0380-43ca-82c7-6eda184bb732", "comment": "Malware payload (Dridex)", "value": "b6c9cf65e2c31e85c5a33f16a030649a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "70e67d71-fb1c-4a7a-93bb-9943ca902990", "comment": "Malware payload (Dridex)", "value": "0c814e2f12376ab3c4defff8bd0f73878ba4a1d3e96fc0e5350d48f05d48f3f4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "c91e5cc4-2404-4a2f-8e72-a3dacdf6ba1f", "comment": "Malware payload (Dridex)", "value": "65469af962b9b0efa83dfa92a48a5895f9e6c0a7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "56ee410e-fafd-4662-b207-281975601a5e", "comment": "Malware payload (Dridex)", "value": "307b286f7ef114dba1fc5c56a940c497e1e17d21b11bab4d75effdf80a0ce4bdd757f24ce923703a659a625b9ceabab8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "85f06d53-33f1-4b42-9b4f-b16525212ac3", "value": "23F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "b6d0c664-c283-466d-bd34-2c22071de5a9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "5933b9cc-e81e-4d19-ab78-93a6fce62309", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496575, "uuid": "4d565403-0954-42c0-ae44-d0d258d2e84c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496575, "uuid": "91846375-05b6-4834-ab6e-309d6f2ef07f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "20c2700d-7b4f-4b6c-b68e-889f9b02d3cc", "value": "0c814e2f12376ab3c4defff8bd0f73878ba4a1d3e96fc0e5350d48f05d48f3f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddf636e-9e13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618509077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509077, "uuid": "4cc1c23a-d343-44ef-a318-864c888b2060", "comment": "Malware payload (Loki)", "value": "77a5af29a64eaa853a2048bcf95bca8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509077, "uuid": "b26a4239-5cf8-40e7-966e-0a052710ea22", "comment": "Malware payload (Loki)", "value": "0cdeeaf0ea93c811614d80bf44645cf38b77074a8628a733f8daa9feec4d2f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509077, "uuid": "6bd201f6-a452-4f14-b8ca-6e1879f80a6c", "comment": "Malware payload (Loki)", "value": "5a8f39fcf049901879ba73b5f00e055ddd0d0a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509077, "uuid": "d683a3b5-cc2e-46b8-80e0-ffe1122e7e92", "comment": "Malware payload (Loki)", "value": "60673196acd8cd3998f8386c379d9ec124b2606e508b4445b944b90f16807132601959a9c503a1b4081eb5b6c1f4975b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509077, "uuid": "f6a331df-c668-41ac-bce9-89785b9abfa9", "value": "35F47C987584B1DEC81BCA72CD643C70AA616567D30BCA07A81F119CDE0D697EE381FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509077, "uuid": "2e36c6c3-3907-427c-bf05-26bcdc3e58c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509077, "uuid": "50757a27-95b6-4cb2-aaee-bd2f43da5664", "value": "12288:rTyEJmilCFbeur366hVkgUgZlNmtxM7hIBjOPybWVHQ8QH3hJSbMX/zzeJKMz/g7:rTNoTFzp/OgZlAIKhOabcZErz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618509077, "uuid": "1f36ed3c-3b92-4cfa-ae54-e116f0be4d0f", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618509077, "uuid": "a5f8bf30-b11b-4ef3-9742-ca84236af8c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509077, "uuid": "c3f3733e-5e16-4ed4-84ac-50836ea09b46", "value": "DHL ReceiptAWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c4a451-9de8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618490835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490835, "uuid": "5867ba48-5f06-41c7-8707-03a2e1fcb7c1", "comment": "Malware payload (Dridex)", "value": "825b96cce50a39b49a6a99e8db5ee26e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490835, "uuid": "6cf124b0-4303-4514-96ee-764887f28e16", "comment": "Malware payload (Dridex)", "value": "0d0db6d5d682fae7b94e7d9205389e1b81c744ec5ed674d749103b7d64a3a811", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490835, "uuid": "9799edd9-e95b-4c37-880c-d2ed65ff4507", "comment": "Malware payload (Dridex)", "value": "d58b59d0351513f64e68702060575f85a08246ce", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490835, "uuid": "e30f6bf7-25ca-47c6-a54c-63e063ca2541", "comment": "Malware payload (Dridex)", "value": "2b22ec3b2d97c63b40acb17c0fc2816e478ee5b5a42cb166bbeee358cf5d51d398d1cd923525563b9be48cad8cf0a64a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490835, "uuid": "e5c0b422-2c34-4ce7-8a2f-d5b49923dab3", "value": "DFF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490835, "uuid": "0ca1e136-cc04-41d4-8081-2db2f57dd3de", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490835, "uuid": "7c9c5685-da1f-4a60-b303-5e0bda38acf7", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618490835, "uuid": "17170b04-d562-4f40-8703-37bc1d863bc2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618490835, "uuid": "a85bd79f-a68d-4f82-9809-3da1ecf36835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490835, "uuid": "0b53ed76-d1a6-483d-8905-4ebcb7f7c84c", "value": "0d0db6d5d682fae7b94e7d9205389e1b81c744ec5ed674d749103b7d64a3a811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6c52b6-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480787, "uuid": "47e25b1e-156a-47a0-96b7-dff53ac14774", "comment": "Malware payload (Dridex)", "value": "37b08151c533aff935bbaf2b82ba1492", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480787, "uuid": "df797c0b-7364-48e2-bedb-8bbae31b9fa3", "comment": "Malware payload (Dridex)", "value": "0d69cab19b2c19419cfa87ed540a6d6f6a3263c075f56f76214b2d7e81a09418", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480787, "uuid": "26c4574d-1d58-41b7-b156-ac2c67b518a2", "comment": "Malware payload (Dridex)", "value": "9d5501559f2edda46b2674f5bf88b915cc8e6cbc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480787, "uuid": "8a4f87a6-f755-4040-aaf2-275b875a7511", "comment": "Malware payload (Dridex)", "value": "f6957a1620ac6ecddb13be9585dea9ff5e8f4395eac820d75f8f91b8c7e721ee64572d624bd0b1d11657881c6029f2ba", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480787, "uuid": "98044dca-9703-44e8-af8c-3eafee748ea5", "value": "B1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480787, "uuid": "6b8fd1b2-7e63-469b-a1a0-08e77780eb5a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480787, "uuid": "17894c27-a3ab-4380-a319-bf35c794d8fc", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480787, "uuid": "9b375dbe-fe73-4faa-9ff7-eac6ceb61693", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480787, "uuid": "fcd34e01-0efe-4945-a842-22214128dea7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480787, "uuid": "7e9467de-c495-408e-a5c0-412122096393", "value": "0d69cab19b2c19419cfa87ed540a6d6f6a3263c075f56f76214b2d7e81a09418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8779749-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618523537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523537, "uuid": "7cef5fb8-b05e-4882-b206-1ffa92007685", "comment": "Malware payload", "value": "4bb694523bed3645a1671fa7c6ff0dfb", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinachopper", "colour": "#BC4044", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523537, "uuid": "2c3858d7-d96d-4b8e-bb19-a94cddf2fdec", "comment": "Malware payload", "value": "0d770e0d6ee77ed9d53500688831040b83b53b9de82afa586f20bb1894ee7116", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinachopper", "colour": "#BC4044", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523537, "uuid": "43be7213-6700-4fc9-b933-588de599e6a0", "comment": "Malware payload", "value": "ad1e0abbb592edf7102c2dbcc9bf99e6fe742d29", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinachopper", "colour": "#BC4044", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523537, "uuid": "c4d235d0-eac2-4375-842b-a1ea7dfcfeb4", "comment": "Malware payload", "value": "c3b98cecd715ab65c92ddc89a2019e680bae444b3d767fb086ee87e35776ab5bc6bc5b77218c9765f6e5f3761057e5e3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Chinachopper", "colour": "#BC4044", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523537, "uuid": "4c7058c5-cddb-48f8-9109-f5933d2e4a9a", "value": "2EE0D868F26D3ED4B87D2458959E04E165BD0E6362F0C0A0B054F5AD181DA2DC69D4E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523537, "uuid": "5f55c76b-957b-4419-b67c-a95f7014689d", "value": "6:aEm70Vqp9skhXxFTrI8LwgHluPkcuG6LNSkbnKRWRt7GTS+3fGlEc39BDz:u70V4XDTrIwwgHlubyNSkhzQ3vGm6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523537, "uuid": "e4fddcf2-ac24-425a-acd9-dde297d7cfba", "value": 377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523537, "uuid": "8debe81c-3be2-4af3-a72a-466c43713ba7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523537, "uuid": "54cfb801-db7f-41e9-ada1-baea34fdade0", "value": "0d770e0d6ee77ed9d53500688831040b83b53b9de82afa586f20bb1894ee7116.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5afdeb5-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "41fdb147-979e-4354-9ff2-a860b71b4e16", "comment": "Malware payload (Dridex)", "value": "9cd6f16da2798c5064659a9076660e82", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "3cab8845-0b4b-4217-86b3-11122d38d8d8", "comment": "Malware payload (Dridex)", "value": "0db470d134093ccde945349b563436a78eb9060a167552a2257dfabb270b9e71", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "41037118-23a5-43a1-ada6-3a6f18fd9970", "comment": "Malware payload (Dridex)", "value": "d13cdccca8da65f06b8d74c93f25e1a37515d924", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "373726c4-9881-46d7-9462-73915cc85cfb", "comment": "Malware payload (Dridex)", "value": "8c6f481ebeb253e9b4ec1adb6ac5669aee40b0029385ac89829009a8fed3e10f8417e66b511d26e797b975457db0e505", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "fcfceacd-d881-4823-bbe3-2d1e21264637", "value": "33F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "fdb33f48-130e-4ef1-8ba9-a4bce248779d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "a885fe67-9163-467e-82e9-08b64cee5f3e", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495964, "uuid": "00c92bea-1a38-446f-8aef-8caf4f90f9ee", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495964, "uuid": "f6ae4d9f-05c6-4087-90f3-2165dde04054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "aa5ba962-d83d-48bf-bc00-12eeb3629089", "value": "0db470d134093ccde945349b563436a78eb9060a167552a2257dfabb270b9e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f971ec69-9dee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618493527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493527, "uuid": "b98680ff-bc01-4efb-973a-827a4e024f9b", "comment": "Malware payload (Dridex)", "value": "c6de4f437e6d2906da8c4efe6fa9eff2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493527, "uuid": "ad173dfa-e49e-4f67-bde2-e26580be420c", "comment": "Malware payload (Dridex)", "value": "0dbb36934339be89390aabf6a87f6e4d4d53c4c0a26be31fb5336244971f87f9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493527, "uuid": "960f46e7-067c-4ccc-9db1-b686781c9cd8", "comment": "Malware payload (Dridex)", "value": "eb7504eb17aeda146acf86ef1329d879dd2ff841", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493527, "uuid": "52848d13-79a7-4f21-8966-aceb419340cc", "comment": "Malware payload (Dridex)", "value": "8f4864e9f5bd0a5a9e3bc9547f1a55eea64bac938d3cae7f69905c8c12c15216ca6b943d5936923e4cd0106b26ef0eda", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493527, "uuid": "497adf0e-2815-43ef-bdaf-5a6bb1137c6e", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493527, "uuid": "7098719f-16bd-4f62-b650-f63f76f104ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493527, "uuid": "01ab40bb-454d-4880-ac4f-a7f38204b247", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618493527, "uuid": "1cfe3fdd-23df-4b9e-b246-52bab94bd3c9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618493527, "uuid": "77d873fd-2341-4a25-b565-9f1a76dc1546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493527, "uuid": "ec8bc59d-9803-402c-99cc-7999a5a45d22", "value": "0dbb36934339be89390aabf6a87f6e4d4d53c4c0a26be31fb5336244971f87f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d31c7f-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515983, "uuid": "9109a57c-c913-4608-9728-1fca5b627ecc", "comment": "Malware payload (Dridex)", "value": "c8dd70cad1539bbbc010a36ef5fbbed6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515983, "uuid": "9346ea2d-cd33-4c29-bee6-5b51c2683520", "comment": "Malware payload (Dridex)", "value": "0dfd0ccd6101e7569c0d793f6b34a5b87f7427070aa987cd0af4899699e399fe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515983, "uuid": "080d4b1d-82cb-4e5f-aae6-530e40168b08", "comment": "Malware payload (Dridex)", "value": "66fb0ec8be1b865865b41af4e8f9fd7a10e81ea6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515983, "uuid": "42812f10-5d33-4a5d-87c8-178a7c410030", "comment": "Malware payload (Dridex)", "value": "004766e3b53cb088bab56aafdb5ff64ff2b3827b54fb2c492db035bb08e1139e3c8aa72e4e65f9d882fd5efd392dc5f7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515983, "uuid": "c9b1087e-1059-4515-b844-6f456b0f4ab5", "value": "17F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515983, "uuid": "c9ed2c99-ff0b-4cbe-9d4f-bd9ee895299a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515983, "uuid": "6802b9d2-9bcd-4075-a549-bf540d7eb765", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515983, "uuid": "4f017bf8-a67b-4eb4-83bf-8e0a98d442b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515983, "uuid": "db7e9586-891e-43b3-9005-13f26f0d44f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515983, "uuid": "ae6d6e99-988e-4b29-94a4-3a2538044579", "value": "0dfd0ccd6101e7569c0d793f6b34a5b87f7427070aa987cd0af4899699e399fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c251b50-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480701, "uuid": "e3479914-4c7e-42cb-89de-46f6d14e6346", "comment": "Malware payload (Dridex)", "value": "5d644673c5eb1f18e13939410ca9f88b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480701, "uuid": "ce296a57-26c3-4b43-abb9-acb7673794fe", "comment": "Malware payload (Dridex)", "value": "0e4afd688c0c8545be9301a92a999ebd83873d4d1f6c8bac6b2a2f6cbbf4bcc6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480701, "uuid": "bca88811-df46-4520-8f18-ed075032df4c", "comment": "Malware payload (Dridex)", "value": "85efb5b80d3575449a6d791319b22dbdd5ae90bc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480701, "uuid": "24789b0c-9e36-4696-b071-e62c300e6ef1", "comment": "Malware payload (Dridex)", "value": "3924d71d5eece2fefebaf2ff7dbb1dbcb188bb83d259686dff7eecf0b9c44e48091a875759bb11231b0e732cb7bc5a4b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480701, "uuid": "9ee0c03f-caad-46ca-9db8-2ae92e8ef8ea", "value": "63F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480701, "uuid": "498480e1-abb3-442b-8f02-8c1d59b8308d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480701, "uuid": "53d83898-70da-4088-9a08-f2d0dd90a11f", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480701, "uuid": "1e39b2e6-baf1-465d-b7d6-daca4a938016", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480701, "uuid": "cfd51392-b2b3-404d-ac80-d3ff6a970714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480701, "uuid": "76d16af8-d164-401e-848d-15a1af117ea0", "value": "0e4afd688c0c8545be9301a92a999ebd83873d4d1f6c8bac6b2a2f6cbbf4bcc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be38f218-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "84551391-7301-41f9-8734-4e71f1dda0c8", "comment": "Malware payload (Dridex)", "value": "dc970abf7e578eb6b46a827a3a387fa3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "5b278b76-345c-4a16-b4d5-2696d8e76f44", "comment": "Malware payload (Dridex)", "value": "0e5a43db190d460c701c5f7ad233d54d0eaf1586241480da1f699351ad2179d3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "0dda81f3-73f1-4027-9000-fc358ae7eee4", "comment": "Malware payload (Dridex)", "value": "8fcc21cc2b564713ba3afc625b24c512ea84e0c0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "7cafd5b8-7c39-4916-9ba9-b3ca57e35c65", "comment": "Malware payload (Dridex)", "value": "e909106c77de301719f4ca429598e655812732a52631477c33239f07653735f9aec7d016fe833dc2ed6dc4d0eded4175", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "11c46fed-5768-4514-bf57-7a1e65ad8835", "value": "36F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "f0585bbd-3d18-4788-b8f1-0368114ab447", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "d60d225a-25b4-46c3-9e19-eb14f5ebdd06", "value": "3072:rA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:r3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464222, "uuid": "42cd7426-1ef1-48d9-98d8-efd6a85124a6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464222, "uuid": "59ce7e8e-a198-4236-a273-be4a75959949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "5b595a87-4998-4f22-8309-bc73ff5e087e", "value": "0e5a43db190d460c701c5f7ad233d54d0eaf1586241480da1f699351ad2179d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3e926d-9d86-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618448707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448707, "uuid": "3856e9c9-f966-4aef-83b4-31776130967f", "comment": "Malware payload (Dridex)", "value": "4ab7f46b9d5f6c0f42d1af1340b2a1c3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448707, "uuid": "794899b9-10f0-4a10-b3a2-0b8adb1f1704", "comment": "Malware payload (Dridex)", "value": "0e7fd0ee20f01c6cdf5a93e5f54b3f12839c40d594e8ba97dc75e37e9196b8f0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448707, "uuid": "041f6256-960e-45a9-9b31-43b010df72db", "comment": "Malware payload (Dridex)", "value": "d0b28ecaace45dfb1d4bc9183f07bafedb3c0d68", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448707, "uuid": "db371d22-eb42-455d-92cb-83990a4c318e", "comment": "Malware payload (Dridex)", "value": "1b117993384e323fa618879c01615ce568a25c413496eca63d5fdf6f844ba6e6b8be82f956f4c75c36d201b179987a1b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448707, "uuid": "c5104766-3a85-45d3-ba89-e974e7bc5ec6", "value": "4C249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448707, "uuid": "cb4f32ce-ce22-43f2-b415-7383e0507cce", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448707, "uuid": "e87de665-4b4f-4cd1-b998-b67d277951fb", "value": "3072:c0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:npepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618448707, "uuid": "72f05eff-ca6c-41fd-93fe-806b12f07acd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618448707, "uuid": "8be8cfa4-e667-4f4d-b61c-db416c27ee7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448707, "uuid": "841595bd-e935-46be-9bab-ac23a92bafa8", "value": "0e7fd0ee20f01c6cdf5a93e5f54b3f12839c40d594e8ba97dc75e37e9196b8f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a86b829-9dc0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618473531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473531, "uuid": "000de550-d428-4115-ace9-77930970e3c7", "comment": "Malware payload (Dridex)", "value": "427db2f3d5da16f398197e08bf474ef4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473531, "uuid": "1fb280d1-dbff-441b-8b4b-338468720a38", "comment": "Malware payload (Dridex)", "value": "0ead363bb590f44841987229d0d3e6e509345bb64cc74e2d1efc90e1dc0bd43b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473531, "uuid": "72827659-a1aa-4093-9551-d25c2fd9759f", "comment": "Malware payload (Dridex)", "value": "f720afd4726673fa423a414b66fb048f97bcf689", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473531, "uuid": "3fce0fa4-2e35-4b57-ac50-3ab967c17046", "comment": "Malware payload (Dridex)", "value": "6b87bd4027c01cabe18036f19f215820e475d89fb21bb65b753781500f2d299e7a3321e054431822585834af0427ab8b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473531, "uuid": "74da417c-3b50-4225-99c9-0469ac641ca4", "value": "88249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473531, "uuid": "1ce97e7d-3116-4177-986b-7dffc7e48cfe", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473531, "uuid": "682c21f2-b2a0-4abc-9037-477a8a5beefe", "value": "3072:K0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:JpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618473531, "uuid": "397d3a78-82e8-44f3-bef8-f65ad7c55d5d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618473531, "uuid": "0c279195-3dcf-4681-8982-e582508a004b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473531, "uuid": "b45ed6d9-ce3f-40cb-af05-7c721b553fa7", "value": "0ead363bb590f44841987229d0d3e6e509345bb64cc74e2d1efc90e1dc0bd43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf29fc4-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "ea3a4317-8bae-4d55-831d-bd55ef8fc6e8", "comment": "Malware payload (Dridex)", "value": "1cd5e6c1b0bf61f1bc04aa0e78410949", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "d7190653-2b3f-40c1-aba1-b1f715959017", "comment": "Malware payload (Dridex)", "value": "0ebf363e922150d3d1ec889ac20d3e2ac2c2a8fe0bd680a850037a26359eb5d0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "b978427e-1775-4c26-b423-4c33e519e3ef", "comment": "Malware payload (Dridex)", "value": "c06fe68bbb7fb696342ad431aa51b3a859fa01a8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "4a949d30-900c-4260-9943-f3762f3d8eb2", "comment": "Malware payload (Dridex)", "value": "801a8119acf0c6ec9d7ca5a00e43ded98e509e39ab5526334d7bbd58dbb0370836b298295015b9faede3319e12b463c0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "6a49854e-7fd6-45cc-b027-78143890b347", "value": "90F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "ca3e6526-8a97-4fd8-aea4-c4db97c839ee", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "6546db64-55e2-4c7c-ad7f-24f054337d58", "value": "3072:PA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:P3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464245, "uuid": "f15febb5-b95a-4d8c-895c-35a7f77790b1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464245, "uuid": "d4dc173f-fa48-4d32-817e-47cb1e1296a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "faf1d16c-f5d3-4554-b79f-a6d5b5680adf", "value": "0ebf363e922150d3d1ec889ac20d3e2ac2c2a8fe0bd680a850037a26359eb5d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c474e1d9-9e0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1618507612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507612, "uuid": "cb8d5673-3744-4b13-acdc-833c46e15f05", "comment": "Malware payload (DanaBot)", "value": "70f39b918aa79601c5b9d17935559538", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507612, "uuid": "67985679-6f2d-4c06-abd1-bbd11d24b27a", "comment": "Malware payload (DanaBot)", "value": "0f237d9138bc4c7ed7b15f75a9690c25b6dbe90fd2f2a5f9b238d2b978d0e1f8", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507612, "uuid": "36c55879-290c-4ef0-9397-a64a3f5cce7d", "comment": "Malware payload (DanaBot)", "value": "6f705010574cfbfe78c93b0710f41d0587697ce5", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507612, "uuid": "4b93757c-fe39-4bf4-857d-8aeeead23440", "comment": "Malware payload (DanaBot)", "value": "7e84cdd2f9d3b6bd07be96288fdd66ff305c01476fb5466a29242f382fc34ac9a69d218aec72cf5a3751456aa2590cc8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507612, "uuid": "924740a0-d9e7-4269-8906-4bd41d92c0ab", "value": "EE5633143691D037CCC12B7AE42AE57028BAB83749F52BFF6FF5196D5B34A81952230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507612, "uuid": "aa761779-c453-40bb-a79c-10c15c3f934d", "value": "68e4347cc1371d22842165de9377b5fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507612, "uuid": "7ad8d480-59ce-4969-8d1f-7a9005ef8b78", "value": "98304:VMqKVdGPWIapFTDA1Suf9fJ0XYjFQD6/W6o0jNOeKAkNdoxpz/QeyZ++Kbcn4ex5:1KjGPWT/TDAtRbjFQD6OBqNPKAAdox5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507612, "uuid": "0438c606-d1cc-499d-bb44-803e772f8563", "value": 6238720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507612, "uuid": "bd614bf5-9ebe-4a02-8906-ee13198b408e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507612, "uuid": "1e9d9a06-418a-4257-bb17-49283641ec29", "value": "70f39b918aa79601c5b9d17935559538.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20536e72-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "501e8f2a-9def-47a4-8e7e-44372246592c", "comment": "Malware payload (Dridex)", "value": "95687ca7afe91d2771536f5a6f0b7669", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "653a0e11-5edd-4c8d-b7b6-dd8f0a537474", "comment": "Malware payload (Dridex)", "value": "0f466fb088a610c8c3664164b7a8c7f1c7f6e4c098bd150492beda4d8a09221c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "ed504fcc-d062-4f55-827d-02aa0e26cef4", "comment": "Malware payload (Dridex)", "value": "a4c7998cce55e751e92157d9e300ce180f54d66d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "5adcf810-8ca5-45be-9712-79dcca8dd781", "comment": "Malware payload (Dridex)", "value": "31abeddeda845ef3011c921ed682b1b78cf07cdfa662fba464fa004955a80e47c774bd12d38b62cacf738bbddc7570a8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "2cb74a1e-fd30-4194-a874-9b96ae199afe", "value": "FAF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "62cb059c-dd0d-4a98-8676-29bdd87007a2", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "abf96c3e-7895-405d-bb10-8ff42821569d", "value": "3072:cA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:c3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498746, "uuid": "9cb4c9a1-5b7c-4c5e-8520-8810ff29083b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498746, "uuid": "ad164a0a-8598-43ca-8063-2791942c5a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "2a374e3a-ebed-46a1-a1da-c887d8a08ada", "value": "0f466fb088a610c8c3664164b7a8c7f1c7f6e4c098bd150492beda4d8a09221c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba249fc-9dd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618484485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484485, "uuid": "24ddb339-893e-47e0-a4f5-abdcc4748157", "comment": "Malware payload (Dridex)", "value": "ba7895b77e399a92a84d346965c920c8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484485, "uuid": "c207f322-818d-4a65-83f3-1cd5638ce279", "comment": "Malware payload (Dridex)", "value": "0f610e9342ff0cc355f11c6441f29e2c96890e6f2957bb50cb089089a12e01b2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484485, "uuid": "2a75972d-212b-48bd-971e-6d803c57e15b", "comment": "Malware payload (Dridex)", "value": "df306735daa67fcf60db989304b0ca983d5d466b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484485, "uuid": "deb8788e-1ce8-449f-8317-802750be1e73", "comment": "Malware payload (Dridex)", "value": "1de48865ad7402536a72f09af1bb8dc21618a812181e448e30a009e6291500bdb3df5f27890028d0a941bb3fa58ad1ad", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484485, "uuid": "849e95af-121e-455b-bd37-80f53814c874", "value": "ECF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484485, "uuid": "f3b6edbb-a96f-486c-bd07-4279db7d0bb9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484485, "uuid": "68438bfe-9e30-4886-a01f-4856077ff74e", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618484485, "uuid": "62058e53-71e5-4c1c-89d4-119c9f02fb37", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618484485, "uuid": "8b39d939-e604-4fdc-9d51-211982ac7e87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484485, "uuid": "8dec5ae8-8a9a-4d10-9349-73b611e2e718", "value": "0f610e9342ff0cc355f11c6441f29e2c96890e6f2957bb50cb089089a12e01b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d626cc-9d91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618453209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453209, "uuid": "aae0e42a-69a7-436f-bd1d-8d6f1407f8eb", "comment": "Malware payload (Dridex)", "value": "791a7c19f0141bcc979020baa854c05a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453209, "uuid": "38d392d6-ce51-4adf-9141-7e898eaf7eaa", "comment": "Malware payload (Dridex)", "value": "0f9fbd065cc1b3b2f1af438000019fa95dfbe0bb310ab27b2186501cabc637da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453209, "uuid": "72d44cb4-ca2d-47b7-bb10-d64616679b4b", "comment": "Malware payload (Dridex)", "value": "7377eb2dbb8d2aaecf6a263c8112c192d3acbb88", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453209, "uuid": "0eb3f066-f752-424e-ad3a-b51f9629d265", "comment": "Malware payload (Dridex)", "value": "2ee106e82cfc5acc5169ad68cbbeadc89bb6f1c487f14592de5c47414ed2a9c314bbfe5d01a56dfc4555f5fd3f05b0a6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453209, "uuid": "e32102ff-8052-421a-8036-dae18f62aa00", "value": "C2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453209, "uuid": "7df238ef-d3f8-49ba-b999-e3ffd2f5874d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453209, "uuid": "e634a787-c12f-48cd-b838-39c4a607a663", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618453209, "uuid": "edc3855d-9471-47dc-bab6-397f83610139", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618453209, "uuid": "cd9010a8-d456-4353-8c14-8ec6292e4a23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453209, "uuid": "85232d00-c85a-4258-97d5-f16925f89b0f", "value": "0f9fbd065cc1b3b2f1af438000019fa95dfbe0bb310ab27b2186501cabc637da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3107f17f-9dc0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618473434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473434, "uuid": "97a89626-f921-4a22-9225-41f162f14a18", "comment": "Malware payload (Dridex)", "value": "ccd401d34e6671a5d7b9d72d0c81ce6b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473434, "uuid": "6b1902a6-d527-4d8f-9fe2-85c019484aca", "comment": "Malware payload (Dridex)", "value": "0fa53ad4594cf061d8486bffea6f4a90c362ca99650b4fceef78027ac8121d75", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473434, "uuid": "60ba5df6-db25-4f92-99d7-b014ce41695b", "comment": "Malware payload (Dridex)", "value": "9106368bf0de84e4ca373ff2eb8e8c0d5653f671", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473434, "uuid": "f55fb694-0893-43e1-aa27-ce02678cbff7", "comment": "Malware payload (Dridex)", "value": "085a195fa9f8aeec3893ab4e38cc226656b021504cc5223421f8ea060d29519561762f13f05f3588d365e30c06e6fe88", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473434, "uuid": "c4eed83b-b31e-4057-a883-c4e790584348", "value": "91249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473434, "uuid": "66bb40f8-34fe-4b98-985a-026c98e5cda6", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473434, "uuid": "e6881524-322c-489b-8512-d0130c4fa148", "value": "3072:t0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:wpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618473434, "uuid": "eb2107e1-92ab-4ef8-afcd-4e306c354845", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618473434, "uuid": "db8966c9-e3c8-44be-bd6f-86e92f15f392", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473434, "uuid": "524c51cc-90e5-4821-ac68-9fc463612c6c", "value": "0fa53ad4594cf061d8486bffea6f4a90c362ca99650b4fceef78027ac8121d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b0ba16-9dd0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480232, "uuid": "bd911a7b-677e-49a4-ae0a-e582310cf911", "comment": "Malware payload (Dridex)", "value": "97fa04d184cd8b17f29ccc68a6054737", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480232, "uuid": "518f31f7-037e-4fa9-b5b0-3d7b5a20cb1c", "comment": "Malware payload (Dridex)", "value": "0fa71bed4a03dc3eaa14d60c660f91dc3b244ae77a1df13b344ccc0c838f5516", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480232, "uuid": "c09ce442-5ca9-4386-891c-102d05b171b8", "comment": "Malware payload (Dridex)", "value": "326146a2a8b42a88f9a3f73663274174d2bc5843", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480232, "uuid": "fd539307-a08c-4f0d-afa4-8a5c88126cba", "comment": "Malware payload (Dridex)", "value": "fcbef6b9a345a207d2ac90fd1427f3649440bcef31973be65255bcdd045e60efaeaf73709989c88e632e2ace414b42e8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480232, "uuid": "5f81dc11-ec76-4a82-b5fe-cb1e6f1a6f73", "value": "78249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480232, "uuid": "3b3d90be-0fa0-459e-b1bd-7ffa566592c6", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480232, "uuid": "1088fbd2-1968-4829-9007-2f06b68dada1", "value": "3072:gT0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:gSpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480232, "uuid": "6ae72d55-482c-42ad-9c9f-753d28ff49b6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480232, "uuid": "5a2d838e-2428-4a95-ba92-e1c0f14b9910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480232, "uuid": "6dd0ee81-9b85-4fc7-ab62-d714b0039065", "value": "0fa71bed4a03dc3eaa14d60c660f91dc3b244ae77a1df13b344ccc0c838f5516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4b3e55-9db0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618466712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466712, "uuid": "8acd8e3c-da09-42d2-a57e-c587e4ab5bf0", "comment": "Malware payload (Dridex)", "value": "b7335680260c1dcef96a6b8441bd61f1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466712, "uuid": "e12979c7-4a78-4585-9247-1893c58f8557", "comment": "Malware payload (Dridex)", "value": "0fb0948e72f91b2279e7c7647239cef91b3dbf0a598bd8d9f4592f295db17317", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466712, "uuid": "7b2fa2fc-3845-496b-a08d-54c777950226", "comment": "Malware payload (Dridex)", "value": "04e109e15a3de713ba41150400cd577175733c8b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466712, "uuid": "828a0a8e-08c8-4b65-a5a8-601124eef06b", "comment": "Malware payload (Dridex)", "value": "16e0d2480552d7b409c3a71c2331f595a66ba30f479f593cd2d19ff67bc47d985bbc32351b0d5a2312feee733c092d21", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466712, "uuid": "dcdc55aa-374b-49b1-9a5e-b4954094ca75", "value": "3C249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466712, "uuid": "39517957-c6d3-496a-a159-4e74b226b573", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466712, "uuid": "34e4e572-0e28-4b80-8bc9-bd9c18840ba7", "value": "3072:d0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ApepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466712, "uuid": "cd7207d7-0e08-4775-b4f6-5a7ea76bd7e0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466712, "uuid": "5e9b7206-f0f4-44b6-a82f-c9b35bf51818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466712, "uuid": "3d34fac2-e6b9-4bde-933b-308b20ef3d30", "value": "0fb0948e72f91b2279e7c7647239cef91b3dbf0a598bd8d9f4592f295db17317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3b2f9b-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516109, "uuid": "fa00d033-7e5e-4df5-bb38-c4110b2eb8c6", "comment": "Malware payload (Dridex)", "value": "9bd19894e5b24b790401b1c217c0b4bc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516109, "uuid": "b8396d3d-08cb-4ed2-a678-2c52a2cb21cd", "comment": "Malware payload (Dridex)", "value": "0fc0b87262b6b5157b03888733ac3e99826944e1d483315ceb52f88f1ac02f2d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516109, "uuid": "e5741820-e6b2-480b-9a6f-209132a60231", "comment": "Malware payload (Dridex)", "value": "5f282b271fda1444db554300f76eff4a7008354a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516109, "uuid": "fe297099-29a2-4ff3-bce4-47cafda0ff95", "comment": "Malware payload (Dridex)", "value": "006cd7b3f9c2d1122a99f6dd0bf3c1a85c8848d3ca5e558cf2d0f1d1505c51b74bd13e855d11bcae17fed2cebaca7beb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516109, "uuid": "58bdc611-8d4a-4f7c-b600-ebf4d26dd7bf", "value": "25F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516109, "uuid": "84b0195b-df40-46a6-9420-03a9f757267b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516109, "uuid": "6fed124e-2729-422c-b3d6-dd857eeff71e", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516109, "uuid": "64aa608a-1ad0-4163-b34c-7770105e19e6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516109, "uuid": "4c806328-bbb2-4b55-b47d-e980eef89942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516109, "uuid": "bf785c56-1a0e-4784-8ce1-b99445fd066e", "value": "0fc0b87262b6b5157b03888733ac3e99826944e1d483315ceb52f88f1ac02f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a07f87-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498747, "uuid": "19dfbf02-2297-451c-b49b-5862952d870f", "comment": "Malware payload (Dridex)", "value": "f7ef68e532c89f8dd5b4a35041be0210", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498747, "uuid": "363feca0-3d90-47b1-a567-f2b76cef1041", "comment": "Malware payload (Dridex)", "value": "0fcde069d8273d4ef57b4504c3c87a6ad83cd6b2872d85c3145ecadec8aeb181", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498747, "uuid": "c841b2d9-bd82-463a-ba1d-21ecc052b5cd", "comment": "Malware payload (Dridex)", "value": "2794083ed73b8dceab57fd5227eb9ce8d1e396ff", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498747, "uuid": "bcae9444-38ed-426b-8b1b-062eb898cec4", "comment": "Malware payload (Dridex)", "value": "0fcb0e35a45d673b57c58564db6ec8a7be869148eec41b78b61b43086d622d24d374744b065ba09228c2b03ddca79484", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498747, "uuid": "0808c600-9f14-4f1b-9b1d-772930b41579", "value": "8AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498747, "uuid": "ed92d028-389c-4b73-abf5-53ed745d3104", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498747, "uuid": "06b2e60f-698c-477b-b1e0-c66959eee448", "value": "3072:EA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:E3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498747, "uuid": "862f23dd-0738-4f3e-9319-b0f349727558", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498747, "uuid": "199b8c16-4319-4914-b823-bbb146c8b300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498747, "uuid": "322279c4-cbb2-4533-816f-81176071bbf4", "value": "0fcde069d8273d4ef57b4504c3c87a6ad83cd6b2872d85c3145ecadec8aeb181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168508b9-9dc2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618474249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474249, "uuid": "528b2935-fccd-443b-8f4c-f8ccb214d4cf", "comment": "Malware payload (AgentTesla)", "value": "e8b0f40eb2760c38d239803fa9eaebcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474249, "uuid": "cb45bd10-e747-4580-aad6-66f7c59e6f29", "comment": "Malware payload (AgentTesla)", "value": "0fff7d39a59578d74bdcb2f53b853d6afa69be468b377e2287f4b34d9f11e652", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474249, "uuid": "366e3ab2-dd2c-4663-bcef-4237a58552de", "comment": "Malware payload (AgentTesla)", "value": "dbfd16c67659a5e6c05e1c0a748742fc8a3cdf6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474249, "uuid": "c96bb2ba-147f-489c-bca0-5075675d939c", "comment": "Malware payload (AgentTesla)", "value": "6c926e85de3d41b07c9c5813504672b5c8f843356d6be9f839e27789f2e7e065d44e8d14d7162fc184a720ab0f3c60e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474249, "uuid": "e24d494d-1b9e-46bf-83d4-8896c8e0ec8f", "value": "DAE42332E6ED6448F55FBC650FD1ED6AF2461E8AEC8746C001360B1DCA12C4BE5F989A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474249, "uuid": "842b8d7e-8ea0-42f5-b8d2-6ccea9d56a75", "value": "12288:7nIgIkPVkUlfTCnzLX8hG2o3tSDwk1iX+sVsVj38hsecbLFEtRqJMC4I3ti6ps:zg2VkU6zLX8atSDgO1ecbREkFw6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474249, "uuid": "7bacb31d-2a86-4db6-ac47-0d5be32dd6f5", "value": 703472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474249, "uuid": "ddea640d-3838-4874-a1f8-808ce55b1da6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474249, "uuid": "5f898316-819a-4a1b-adb2-34b44103f1db", "value": "Payment Assistance'.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf057924-9e0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618507173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507173, "uuid": "1516dfed-e96b-4c80-921a-759490b0218a", "comment": "Malware payload (SnakeKeylogger)", "value": "71d33e18eea4bfce8938bd92d41ca3e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507173, "uuid": "65ce00e6-ebf5-48a4-86cf-47f129c3fe19", "comment": "Malware payload (SnakeKeylogger)", "value": "1009b066765a2116d1055108721901b28a80739501513209e31ae57a9907a5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507173, "uuid": "07f9f8b4-0839-4b30-a8bc-54a336fdbbd6", "comment": "Malware payload (SnakeKeylogger)", "value": "36a1d639255fc9c22e9e20692220760dcabe2d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507173, "uuid": "525817b4-6869-4512-bcc6-9bdc9f32c357", "comment": "Malware payload (SnakeKeylogger)", "value": "3b159571ff8e7437ae7d3d0cedad9070d35e8c41ad8f420abae3967d17e918aea298bdd6c615ab87fa22ed1cd1d786a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507173, "uuid": "97ed3961-b0a4-49b1-b0b8-6e72580165aa", "value": "FD05696232B79604D6E95F38509C0D040EB5AD166923E70D1AB671EF4BB27C38F1EF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507173, "uuid": "61ec937f-c93a-48e8-af7e-373e2361d27a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507173, "uuid": "73c3e167-f395-4fa6-8891-30f59b0f6d8a", "value": "12288:2MixuxAz9muB42II/9AqXgbL6cuvGFjsmJ/9JSGrWv6zIK:23x9BB42XKLPzI2/TSGavA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507173, "uuid": "429cc42e-2422-4204-ac64-4b9ffa6b011e", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507173, "uuid": "430d5e6b-3c70-4fbb-9035-f2d737e3cb79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507173, "uuid": "9c0610c8-e906-47e0-9b31-875c690fe6ca", "value": "71d33e18eea4bfce8938bd92d41ca3e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7f16dd-9daf-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618466471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466471, "uuid": "ede89a97-1e70-4feb-a41f-8cb40ce32cab", "comment": "Malware payload (RemcosRAT)", "value": "82720319030a519bddb77537babc8393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466471, "uuid": "602efc69-b0eb-4aff-b715-8045b4f5b0d9", "comment": "Malware payload (RemcosRAT)", "value": "1048c4ebb7be3641037e402bfcc4e8aa667fc49dc82b9690b96b5ea69dd11e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466471, "uuid": "74f144d8-bcf5-44c0-825a-f77b18bcd4a6", "comment": "Malware payload (RemcosRAT)", "value": "e42d6c950690189fb24235336f31d7cbcfc65408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466471, "uuid": "c3bee17b-0453-46ed-98a7-76ead15f8fcf", "comment": "Malware payload (RemcosRAT)", "value": "0251c84b4664718651f6f678056b5065a3a3fab1715926ec1b68c22dac1f5f3e48dee1bc0cc73e359a50583a32553586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466471, "uuid": "5c1ad7c6-1e93-4a1f-9c1c-2124e8bc5ba7", "value": "DD1418D1C248BCF5F82A03B158369D16254BFF6D65B4551E651FB42EAAB328330BBC0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466471, "uuid": "fbbdbe15-8021-4d8c-b437-d80c11c09227", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466471, "uuid": "546f252b-fcad-4849-9d24-1b538dc9a23b", "value": "3072:e1TxN62RDxPA1cHDG3/JX2tb//bfZY0GIxaFI+I91kkKDuIOwlE:e11Qu8m7Jhxi+r9dwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466471, "uuid": "7d457f77-df3d-44cb-a6aa-0d225a600db1", "value": 193974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466471, "uuid": "bc5116f2-d84d-4013-9dd3-23f68be100ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466471, "uuid": "25fae4c1-36c0-4754-945e-4b5a184d6823", "value": "0900900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8deb742d-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "b6dffa6c-397d-4847-8d72-157f989dc737", "comment": "Malware payload (Dridex)", "value": "7103b1fcf11e3eb03b14bea1ddddb956", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "9d654c84-ff5d-40aa-9682-390b17ab9af4", "comment": "Malware payload (Dridex)", "value": "10989582d4285468a72b1e4be5cb38a6e5fea15cbc3a8ac3359d94e3e37d83c5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "38e87da8-718b-4844-adc8-00989cecb788", "comment": "Malware payload (Dridex)", "value": "22e0d382e275f3ee4d39d53f2fc579c74aeb257f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "2bdf32f8-ee93-401b-9d54-34271b9f5dc8", "comment": "Malware payload (Dridex)", "value": "d02cdb7ec7f43ccef9a980444f346282fd1c2fafe9b29d8c02bf4bcac701b6c3049bed57f19557ad7ef77d6cfab8573e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "2c38ad79-49b4-4799-86ed-5b621e64eb99", "value": "82F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "2fe2eded-6f95-47ac-8582-2d265eb0e8af", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "ad03a671-2c00-4177-b325-69071e706420", "value": "3072:nA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:n3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498930, "uuid": "506a9808-c182-41a0-9584-ae981c5d5559", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498930, "uuid": "7a965a92-2117-4a1e-94b3-d6f1d0a3567a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "80ab5921-5e80-4117-b67c-8b01866690fb", "value": "10989582d4285468a72b1e4be5cb38a6e5fea15cbc3a8ac3359d94e3e37d83c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da3af67-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "73d949aa-0e19-40cc-9228-a9d427758451", "comment": "Malware payload (Dridex)", "value": "b8c53928cc557c999296b108bbfa15d1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "16cd5581-e1fd-4c3f-bba1-88db3a6c6f26", "comment": "Malware payload (Dridex)", "value": "10bbf63d1d4ba898f83362600758d7b516ccdbe4e1a747fbed085ade15a94fc6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "d843dd67-dd17-4e9c-89b2-6debab9bfcfc", "comment": "Malware payload (Dridex)", "value": "b2e2c20a199058d2b607b88633e4a46e03caba51", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498930, "uuid": "7e00a672-69dc-4804-917b-52ac456704c4", "comment": "Malware payload (Dridex)", "value": "887cd05beb2aea2280f4391fa3b602e3ba3b27599d5567b6325b3b4cd550e7f693139c0caa4efd0dba6279bb9af13f2b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "bfce9a73-7758-4742-b5d5-b167428265fc", "value": "3AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "0a94becd-abba-4ec9-86f0-6d60d6431eef", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "93b08a58-2e8d-4e49-a8fc-d3667660daa5", "value": "3072:oA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:o3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498930, "uuid": "ed1e3113-6dcb-4cda-8dc8-0c7c028b32e3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498930, "uuid": "2b335c61-bc8b-4e36-beb6-ccb62e117928", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498930, "uuid": "ff6ab77a-84b2-475d-9dfe-81c3205e8ae5", "value": "10bbf63d1d4ba898f83362600758d7b516ccdbe4e1a747fbed085ade15a94fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815108c3-9dcc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618478723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478723, "uuid": "e0425e35-55cb-4b5f-81ec-30339f62c518", "comment": "Malware payload (Dridex)", "value": "3a1f6a436c4b8458de8937c138ba1cea", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478723, "uuid": "6fa29884-4e89-43e0-9a46-6814a4efe13d", "comment": "Malware payload (Dridex)", "value": "10c309fdc6efcd8cc2be50916786c99e4760be74e47710188443ea9b10a2e42b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478723, "uuid": "0e2dffd9-29de-4125-83e4-6c98a4aff9ee", "comment": "Malware payload (Dridex)", "value": "2b0921c85c876558e2a21e0aa226bddfb5958707", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478723, "uuid": "4daa904b-aa4c-48fa-bb42-21a8437d0ff4", "comment": "Malware payload (Dridex)", "value": "18f55d99e748ac266cb36592b51bedb1b0ae6f252e1b834314b1f049dab170671f11bf9dbf23d34752f5d95503c1cdee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478723, "uuid": "ae14b04c-af34-4c8c-ab7a-b9564be06e07", "value": "86249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478723, "uuid": "1760f3de-7b0d-4512-a8c6-4bdb4807fd89", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478723, "uuid": "4b0fb326-13e6-4cea-9b7c-3171cf8c5a8a", "value": "3072:00DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:/pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618478723, "uuid": "257357dd-30c1-45cf-91d8-9bbd6e4a5c0a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618478723, "uuid": "91bf939f-410a-4cdf-9667-3eb3861120df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478723, "uuid": "5d4c3b3e-c3c8-4459-9057-cf3959c69032", "value": "10c309fdc6efcd8cc2be50916786c99e4760be74e47710188443ea9b10a2e42b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986213a9-9de7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618490358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490358, "uuid": "6145e574-0512-464d-a4c5-9251bedc952b", "comment": "Malware payload (AgentTesla)", "value": "502f5017ef981d1dc119d584d6512b35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490358, "uuid": "0d4ab9b6-21ba-49e0-ac9d-c3eee7ac6bb9", "comment": "Malware payload (AgentTesla)", "value": "10d918945c8e40d54b370d251c45e8b57132323a8c24516575c3168075fbbcd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490358, "uuid": "99a4d622-34ca-431b-b173-8021dffc57c1", "comment": "Malware payload (AgentTesla)", "value": "3fdca29e485c567d9572e4d7108780c7cb67e71a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490358, "uuid": "5c668466-a127-466c-9c21-9b683e3f4b4d", "comment": "Malware payload (AgentTesla)", "value": "3f7eb7ed4a8dac969c788300ea352c9637ac2b528da548af223dee7c497e19542483572e2da2e6165d8eda02e4c6693c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490358, "uuid": "b3bb8a43-ad1e-46cb-9675-8218e78a6834", "value": "F1255B9B62F46E16F0BE5773806330C453FEAC47DB16C2BD3DD150A92D62A81A62DF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490358, "uuid": "a12dcca4-fa5b-4b39-ab6f-46a429060eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490358, "uuid": "a660a4fc-b2a9-4bbf-af87-cb550abcde06", "value": "12288:ZQ1rKJdwz4TbkKhzGgRS/VbsmdN6/MfAwBaJceJG1RQQV0pZwYf4Eq6IBp+:iN2TbrNGp9bsOwMfAF6wGUpZUEq6sp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618490358, "uuid": "2f63b738-93db-42d2-a182-3fab7e18a98f", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618490358, "uuid": "e8ea8496-1926-4b6b-93e5-a62492511bdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490358, "uuid": "7282e305-1ff0-4b87-a339-8eaaee03c63e", "value": "DE09333552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe15948-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464440, "uuid": "997d4343-0c59-4238-bbc0-fa8db65b4d9b", "comment": "Malware payload (Dridex)", "value": "f36e0521e777a05754739e1f1f97e6e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464440, "uuid": "6e8ce708-8f34-435b-a71f-9fcd100e3d0e", "comment": "Malware payload (Dridex)", "value": "10ec7b01979702bd67d54ce24540ff8b294980bb41f7205f9979e66f3097aa88", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464440, "uuid": "52919096-be59-4ce9-886e-f3964e4b10e2", "comment": "Malware payload (Dridex)", "value": "b01ca16df26b9c04d4209148179e68fdcde423a0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464440, "uuid": "885f082b-3d43-4104-8150-76111f36fc99", "comment": "Malware payload (Dridex)", "value": "6d319e5cfee8ad5818b338b25d46b3736b2840c87fef9b1ab54d29f2eda69125e195878768b81805e11f053a0e97fb3c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464440, "uuid": "81e934ba-40b3-4ab4-bb9f-c83d6f54fc9d", "value": "F8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464440, "uuid": "c0842aca-9d7f-4266-b9f0-a16c22f50a21", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464440, "uuid": "324db943-1fcc-4c81-b041-fbccd8155364", "value": "3072:kA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:k3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464440, "uuid": "773748d4-d9e2-4932-b270-837f77bf3870", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464440, "uuid": "b3d2e3b6-ac9a-427f-80a7-d3d5e0c35832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464440, "uuid": "1eaada7a-b610-47dc-817a-741c46591a41", "value": "10ec7b01979702bd67d54ce24540ff8b294980bb41f7205f9979e66f3097aa88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e24f568-9df1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494609, "uuid": "8df77cce-2b84-47e8-802b-bf41066aa6e0", "comment": "Malware payload (AgentTesla)", "value": "cfe77a7bc15c773db376ea01ca3db0c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494609, "uuid": "1367bdc0-a526-4972-b6cf-c929ea09eea1", "comment": "Malware payload (AgentTesla)", "value": "11248ff82e8de09cc03765780c41698d37944a869caf93bc2d8d72af4eae4599", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494609, "uuid": "054a104c-3269-4612-8fbd-55e2df00c12a", "comment": "Malware payload (AgentTesla)", "value": "e70ee47b6a26b99d0d5b9a2f18a827a0e753aadd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494609, "uuid": "c244447b-a4f2-4773-96de-e6d9da767d18", "comment": "Malware payload (AgentTesla)", "value": "207bd57edf4f1571e83a91bf8d92ff2f3be5d796e51eec75fd387ed0430f60001f110c66cb6bbb566c265dc6346eb5e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494609, "uuid": "220d5446-a1bb-4399-88e2-b6838076dad9", "value": "D235CF5A23A85FA4F17EB77A51351100ABF5F812C721EB0D3FD641DE0AB6F408616BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494609, "uuid": "78ebc874-59f9-44e5-85ac-fd9dec31439d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494609, "uuid": "c3fd69eb-d63a-464c-8dec-4293ee46be30", "value": "24576:xXnHN/pJciA/SXpQCY2VFy00sgAGcQ6KpSYPNz:D/pJc3YlY2nd0sVGcQ6KpRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494609, "uuid": "f98a912a-95a1-410b-b73f-821f0c0259b0", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494609, "uuid": "f398a2e0-6ce1-4989-9b88-f2004d959308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494609, "uuid": "40aafcbd-45ed-41db-ad05-9fc09e5c1f2c", "value": "SWIFT_MT103_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8c45be-9dfd-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618499629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499629, "uuid": "c91677d0-4260-4587-adb0-93011092d8ac", "comment": "Malware payload (SnakeKeylogger)", "value": "08b606efe1d6502d1e1fc637c1ca76fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499629, "uuid": "d972c831-e571-49db-900f-d890d68dd5a4", "comment": "Malware payload (SnakeKeylogger)", "value": "11809886c2830f7b8e7e4c66331d31879442c5767413fed6b274b9549d3420e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499629, "uuid": "c8b1c5ab-51b2-4914-b47f-b2370ffc0d90", "comment": "Malware payload (SnakeKeylogger)", "value": "4b1444753c981feb390f0109dc058417ca056564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499629, "uuid": "039b59a2-63fb-4be9-9ec7-1dbc17e23374", "comment": "Malware payload (SnakeKeylogger)", "value": "b96024a66eb8238129b68a312335799baec0c18ea82f98652b3d6a12370fbe7710f505f919c75adfd077941e05084d60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499629, "uuid": "019b7f14-92dc-47ff-b1a0-94d3edf9cadc", "value": "FF258F4C5B99C18AD5760A64C1D983F942A95EF2FB22CC6BA5C43FCFF5317C0A606623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499629, "uuid": "f952410a-9ea5-4930-9b6f-8bfa5ab4b01d", "value": "12288:eFgMSEZQGZvMvX3p1C6nsh2hm/ukvvvp8HzjZV7pj/eKti:eFRZv8TCf2m2kajZ/SB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499629, "uuid": "bbd10c0e-9e19-466c-af7c-c53961b035bf", "value": 1040563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499629, "uuid": "34107b3d-22ec-4621-afcf-7e5b75dd81d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499629, "uuid": "0b44d9c0-f18e-4ce8-8191-3c57a69b2023", "value": "08b606efe1d6502d1e1fc637c1ca76fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2212c373-9ddb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618485005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485005, "uuid": "5732115b-02bd-487b-9ca4-289f0a06dead", "comment": "Malware payload (Dridex)", "value": "10ae9141c0f1b9a17abd91a30e3914dc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485005, "uuid": "60fe374f-98f7-466c-8343-caea99abe0b5", "comment": "Malware payload (Dridex)", "value": "1190161a0aa2dce142ab3656290bdb061a963b92cdf302e91587fe4bb30b1a98", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485005, "uuid": "329c63ca-243d-4f54-9286-6c312d7177dc", "comment": "Malware payload (Dridex)", "value": "9ade8609a5d37b53f23acba201489da6ab87851f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485005, "uuid": "ded05d44-32fe-4081-b215-266b675ee178", "comment": "Malware payload (Dridex)", "value": "cc650bdaadfb879600838b9eb371d687cda2ea2cc600af624fbc2912de3e213c8fc848c8a4d7360729b7f82f8f89723c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485005, "uuid": "1f555e4b-592e-46c3-9b02-0c6bf14c8c40", "value": "3AF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485005, "uuid": "062c666e-f1ba-4907-9813-8c20ca7b713f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485005, "uuid": "21dd5577-454f-42c8-9a17-317a83a8506c", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618485005, "uuid": "9b63cd64-eeae-4777-ab40-b44fa1c5d3b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618485005, "uuid": "5a288648-5db1-40e6-bb87-728118e3634b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485005, "uuid": "4dd50601-b96c-4ca7-b556-afed88a29443", "value": "1190161a0aa2dce142ab3656290bdb061a963b92cdf302e91587fe4bb30b1a98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8d22e6-9da1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618460379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460379, "uuid": "b5dd30ef-54e3-48ba-a6fd-712e6492471e", "comment": "Malware payload (Dridex)", "value": "146bbfecc7af425a9c807391b3cc9b6c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460379, "uuid": "cad0786d-20cf-4fee-9929-769fad876646", "comment": "Malware payload (Dridex)", "value": "119424d767e9e5d5ed34100b2f63034f0191d9cfcf68a26662e458459e1b93d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460379, "uuid": "082272a3-1cd5-462f-9692-f2f33e64db59", "comment": "Malware payload (Dridex)", "value": "0a532a7a9df8970a421a7d0e39a282f2bc2c9026", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460379, "uuid": "0a821ebb-f8b8-4e43-a41e-e26697d08046", "comment": "Malware payload (Dridex)", "value": "d27c4e09577f92cc9ccbf1e7c42c8d4ff52d548120a42680429d7a4653f791e943c104968a94276ec28e69e44556df49", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460379, "uuid": "c63add92-8c8c-4741-b1b6-b03ae7720596", "value": "94F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460379, "uuid": "1ef8d926-e689-4ca7-80e4-81e461b189b1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460379, "uuid": "e6658fd0-8ee4-4b99-9ec4-2e055caf96be", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618460379, "uuid": "537fbd5c-409c-406f-b609-2e13be3161e0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618460379, "uuid": "eb9523a0-a71f-4b4e-853e-6177e3e4876e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460379, "uuid": "1e9ac478-77ab-4c42-a33f-5305dbc38a5a", "value": "119424d767e9e5d5ed34100b2f63034f0191d9cfcf68a26662e458459e1b93d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e3c4f8-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "2263113d-bbe7-4073-afa9-1a94884b3bef", "comment": "Malware payload (Dridex)", "value": "ae13e854601b0b9ce25e745b1a9e7c22", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "dad3de92-d6dc-473e-89d4-c09b7a443bb8", "comment": "Malware payload (Dridex)", "value": "11b1b13fd454d62aa5bd567aa43b686d03a30d521ad98ee52d1b7dc8dc4777c6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "4ad4084a-6658-4880-829b-6afbcafd0060", "comment": "Malware payload (Dridex)", "value": "5ad1e2caf73300eb0f6730d6fb148e44ea3d1b28", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "c4edf0af-c4f5-4f47-884c-e00ad88eb0f1", "comment": "Malware payload (Dridex)", "value": "611dd498ad0f9d1ccf3cc5f1510513f8c47a11732668782a657556436079d5615b1422364b17af8d7c95e020413db842", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "967008aa-b046-44db-a423-50a69a6136b4", "value": "EBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "e7f03a33-0730-49ef-a717-f068861412ed", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "d5d2308c-9347-4b49-9000-72a224237b2a", "value": "3072:CiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:BeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480772, "uuid": "f9b95daa-455b-4820-8d98-33356835d997", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480772, "uuid": "79e86eb7-31a8-4ae9-bf95-b1064c39af31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "fe124789-9502-4eb3-82ef-bb33ab1765a9", "value": "11b1b13fd454d62aa5bd567aa43b686d03a30d521ad98ee52d1b7dc8dc4777c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7a118d-9dd4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618482122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482122, "uuid": "efce3bae-1e14-459f-9893-25b9293537cb", "comment": "Malware payload", "value": "5e2dcb5263a87ef91ff3a2420dbae57d", "object_relation": "md5", "Tag": [ { "name": "pw37842964", "colour": "#FD3601", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482122, "uuid": "10813198-af62-42d5-8fac-79bc112c93e3", "comment": "Malware payload", "value": "11c42172e6a48ce46808102598a14a290852c55d3a5eeb4550eb053e9c44cf40", "object_relation": "sha256", "Tag": [ { "name": "pw37842964", "colour": "#FD3601", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482122, "uuid": "537f9f29-0c05-44a1-8ad3-48a1ea5a418c", "comment": "Malware payload", "value": "d7b414aa43705b027226d28dccb542522a086494", "object_relation": "sha1", "Tag": [ { "name": "pw37842964", "colour": "#FD3601", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482122, "uuid": "32dd2697-b99f-47ca-bfb0-a6152e354072", "comment": "Malware payload", "value": "2d7700916cfb3ea82cbb782b965832fcf9153604d0a0edeee1468c8df6d16b5c5d80694f78515b9d97329d45ac0b5b20", "object_relation": "sha3-384", "Tag": [ { "name": "pw37842964", "colour": "#FD3601", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482122, "uuid": "a6805b98-8524-4745-8db5-fcb8a3b9d616", "value": "C624133962846F409594D3EA5CEB1FDD7862881A2D57F10D2AF1C501EF6CEB809F32A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482122, "uuid": "5465b6da-d92e-4d8d-8e6a-31580e7f0219", "value": "6144:43vBWqFmxkZBDPcN7GM0IRyD9GkuoREnp/:4fBpRVjIRyzREnp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482122, "uuid": "4bb99ac9-ffc6-4436-a1e3-a13b1fa86c2b", "value": 226983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482122, "uuid": "2d99c74a-c535-4743-a2e5-df8094c1da7a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482122, "uuid": "61d6180d-2e00-441d-b5ec-55b56a377860", "value": "20210415_id79aa497ece.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18597984-9d8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618451488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451488, "uuid": "3a101bdc-ce25-4ee7-aa7d-8ae02ac64667", "comment": "Malware payload (Dridex)", "value": "d756cd689367782972381e5684cc5989", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451488, "uuid": "ff96f4cd-1d5c-48c3-b05e-e68c4698fde1", "comment": "Malware payload (Dridex)", "value": "12148d954220e1e3defc04901c82e480407a6c9b85bbcb8924a332f3f26ddc3f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451488, "uuid": "c9505ca7-9751-46ca-9a72-7f11c6ab5a8b", "comment": "Malware payload (Dridex)", "value": "6f6b2bc3f0ac63a3bcec6c3ef3c80f45050af89e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451488, "uuid": "04ac334d-f46f-456f-8f94-983ff3a996a7", "comment": "Malware payload (Dridex)", "value": "8515a9291ec2de5b64c6e9a77a1bcc4bb39e0b91128053613119563d8929e0e0709a951076df70226a94d051bd4f7df7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451488, "uuid": "f25bcc42-880e-46c6-a202-e18f082923ea", "value": "3F249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451488, "uuid": "7becc3cd-6a53-4097-9399-fec4ab7991d6", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451488, "uuid": "a0f42d66-d6d8-45b2-9e68-4138a376b827", "value": "3072:A0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:7pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618451488, "uuid": "02ca6bdb-63c1-4452-bb8e-d71c7f83dcf1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618451488, "uuid": "a8a4ee15-89e2-4fbb-9417-cfbeb3bfbeec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451488, "uuid": "ccf0760f-c59d-4bf9-9ba1-c275dc02dd84", "value": "12148d954220e1e3defc04901c82e480407a6c9b85bbcb8924a332f3f26ddc3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb993c7-9e02-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1618502072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502072, "uuid": "6aad823d-031b-4b79-a8e9-45d8f019763c", "comment": "Malware payload (ZLoader)", "value": "558e1e60477ea6393b0b5b2127d36f5d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502072, "uuid": "ad7a49a6-4d71-460d-a0b6-37dfc1085e29", "comment": "Malware payload (ZLoader)", "value": "124a878916ba3b682e7d79be3e1ddf5046cd885dfb4fd46fb6a090e697655e51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502072, "uuid": "6fe1833e-4067-448f-83b3-24ee3f823113", "comment": "Malware payload (ZLoader)", "value": "89719707659237b177e4d689af9fbabb83f5e959", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502072, "uuid": "3a1d112a-26e2-4059-92b5-7295a4dc9aae", "comment": "Malware payload (ZLoader)", "value": "d6d62aa7cd008b4310946d0bd3796c527d1fdcc90a221db5cc8bb8ec155a0a3038bfe5fe64b6d368d90c824ef8735b5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502072, "uuid": "eb454219-618d-48b1-9a8e-a8c7ed699fce", "value": "73E4AD247580C072C5A224358E65E5F9496DBC209F2156CB73DC3F7F6B306E1AA32A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502072, "uuid": "2bbca011-8b2a-4739-a739-3cd1adf777f5", "value": "1871ee680e7135cabc1e519d428eefe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502072, "uuid": "8a8d0976-67bb-4068-8511-425191fee191", "value": "12288:m9D8Diks/1k4R17DVu+PQYgzCNouGhKvuZkpSUxEMPEQIRAkwOBYSk8x3JVBKKZM:mG+kY9IYNouGkTxEnVdB7ku5VZrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618502072, "uuid": "55fe85a5-01f0-411a-b38b-8ea0dbfa1d1a", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618502072, "uuid": "d0dc7815-7c42-40da-8558-2b59fb5e65a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502072, "uuid": "d9157398-a72c-4034-bf78-b1999d415369", "value": "558e1e60477ea6393b0b5b2127d36f5d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac46804-9dc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618475356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475356, "uuid": "aafe7abe-bf11-4c90-af6b-42b7ff100db8", "comment": "Malware payload (Dridex)", "value": "3992e314d3bb9389aa29bc36289b7887", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475356, "uuid": "4de705a8-30a8-4767-a499-a52cf82e53ae", "comment": "Malware payload (Dridex)", "value": "125c03f4fdeea04aa3845e53d650403e86950027d37555a4c7db215523104e23", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475356, "uuid": "d03fd9c9-1788-4c99-bd3e-b42857ffa312", "comment": "Malware payload (Dridex)", "value": "5e50e167323d26b13c4bb9241d0d103c6c7567d3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475356, "uuid": "62d5e6b1-0222-4174-9482-10200d9f5f2d", "comment": "Malware payload (Dridex)", "value": "9d2a59a7f154f8534b04039f115d62d433b2760312090b1864d1a972e0db86537c84573645c9079591f1570d211f7b3d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475356, "uuid": "625af7c8-1664-4669-bb44-be6c2688e90b", "value": "FA249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475356, "uuid": "31335fc9-9d98-48dc-9d20-954bd52de394", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475356, "uuid": "6a7424b8-025d-495f-8916-84fd2fdf93fb", "value": "3072:L0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:KpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475356, "uuid": "a72ecb09-9ff6-4bff-bea0-49dbfe295b6a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475356, "uuid": "672f047a-fcbf-4055-986e-31a23a2591c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475356, "uuid": "789fdbbc-55b1-4ef9-b122-c043265bb000", "value": "125c03f4fdeea04aa3845e53d650403e86950027d37555a4c7db215523104e23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b09050-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "d5660c53-7561-4866-b71c-02a9bcb5a08d", "comment": "Malware payload (Dridex)", "value": "de25803256a896badc937152d561c418", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "8380812b-f1ac-4a4f-bb7a-8f7f61f8d7a4", "comment": "Malware payload (Dridex)", "value": "127a2d7cef543fbd8e40d9a9c00ca70c94db5ec561edf5852b1eb34520666c46", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "4a0d5845-9a25-41a0-b6a5-38f569f1c006", "comment": "Malware payload (Dridex)", "value": "b1aecad5b405745a3b35a187b01475be23d1454a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "85a9d126-99d4-410b-a3d9-18c2f9979c00", "comment": "Malware payload (Dridex)", "value": "15843f289a0cc4961a789d9e579401750100d9e3119aca4402687aaaa95830cc26cf07ddd891812022fba4d4a87c1dd4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "de4054c9-248a-47a2-9711-0a148b3d514a", "value": "A2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "028b1fb5-34a3-4ab2-9d81-cc52aa36771d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "97a0d3b7-bc99-47f8-9770-e7441925591b", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515955, "uuid": "ef7cf07d-79b7-4b84-85e5-bc4874d0acce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515955, "uuid": "31f813bf-3abe-4609-a0df-d4aa20e106ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "ec9b6b28-73e4-431d-8a7b-32308a533f89", "value": "127a2d7cef543fbd8e40d9a9c00ca70c94db5ec561edf5852b1eb34520666c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa016b1f-9dc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618476644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476644, "uuid": "f21c05b1-9757-4544-93ed-c82438b7acb2", "comment": "Malware payload (Dridex)", "value": "619956e11884f8e6fbf24e265db0482d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476644, "uuid": "f99bae70-6f81-463e-91d9-430b1a051360", "comment": "Malware payload (Dridex)", "value": "127caff14607b5ae5e2756901d253d22f8ad907e38de9a15557717f777389cef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476644, "uuid": "fa7af22c-d0c6-4373-b2b1-2dccaba2f345", "comment": "Malware payload (Dridex)", "value": "9317723837a20686a7768f5ad25ba8e391cb9b97", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476644, "uuid": "c6b730bd-f025-444e-972a-a6e14e2bc9b2", "comment": "Malware payload (Dridex)", "value": "0d5eb14ae12cba4c422643287f47ecf76315b04cdbfda3a6d026a8b18c17e9118e70905be1d4bb1623fb03909332f26f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476644, "uuid": "e1e9b6c7-edb8-4009-91c5-f1f5c147d92c", "value": "D3249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476644, "uuid": "5aeedd67-5eb9-4cd0-ae4a-b3080f3ebbd9", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476644, "uuid": "0055c812-468a-4571-a494-89ac824653e4", "value": "3072:e0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:9pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476644, "uuid": "62a711e3-3172-48fc-b664-891bddd09305", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476644, "uuid": "45194c4c-6138-4a9f-924b-8859f971f536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476644, "uuid": "a36fdcd2-838d-4866-8a5b-4713b8767cb6", "value": "127caff14607b5ae5e2756901d253d22f8ad907e38de9a15557717f777389cef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b54e0f-9e1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618512499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512499, "uuid": "7631cc3a-d3c0-4656-99ad-e6dd870e97dc", "comment": "Malware payload (Dridex)", "value": "a8b580fe4d8fdcdafb753a7ae6b844c0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512499, "uuid": "f48c43a3-e8c6-4f78-be0a-95807f802c7f", "comment": "Malware payload (Dridex)", "value": "127fdad90b3904d89751ce25af295097bc8bcccabbad529ea524502bbac74f42", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512499, "uuid": "25f58cc9-8376-4686-8326-2d3a67ab0a61", "comment": "Malware payload (Dridex)", "value": "18257922f24ab2244fd05f846bf635405314f28b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512499, "uuid": "861c4987-3a99-41f5-bd5f-5d759515daea", "comment": "Malware payload (Dridex)", "value": "1df0368dd584064266b3c021f8b61b8606715eb44bcf96690ef884d95687254624639b1471a813dfea75180c7d846f74", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512499, "uuid": "5b0c411e-8dcd-49be-bcab-e6387e939489", "value": "D9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512499, "uuid": "6bdd0a0a-0783-4ae0-b67c-2a18bd3f24d7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512499, "uuid": "6b65f046-10a6-4873-bb7f-b668f5d4f906", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618512499, "uuid": "85d54ea5-84c2-47a3-9637-2f2ce596f1a0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618512499, "uuid": "d1955e47-8566-4ce8-9db5-da6fe12b3293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512499, "uuid": "4a58f7e9-5f40-4e29-a508-2610aa1767fc", "value": "127fdad90b3904d89751ce25af295097bc8bcccabbad529ea524502bbac74f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67f24c6-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494274, "uuid": "e3a5ac9c-08da-4667-af0b-af14f879c978", "comment": "Malware payload (AgentTesla)", "value": "88aa64fcc39c9f45d43dfdc49f2c5dea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494274, "uuid": "8e78064a-d38f-45d2-80cf-6c277ac6979b", "comment": "Malware payload (AgentTesla)", "value": "12ad7c941fe8e2dbee7225a393fae7862cde4d8fea063dc2e891dab1279cf31f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494274, "uuid": "174907b9-b8ce-4d6e-8f2a-9e352a232529", "comment": "Malware payload (AgentTesla)", "value": "af5b13a25c2f11fe39b03258890c9668ce201d2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494274, "uuid": "e8aacbb8-27c4-4054-b198-844c03daf77f", "comment": "Malware payload (AgentTesla)", "value": "e056c7d2a48765ee3209463eacd525ea60ca29c344ec8c21e44ad450fa8530b20d86872394c6555f1b3ff1e4ddbae35c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494274, "uuid": "12e61952-9978-4e94-a698-2ce32524a3a4", "value": "8DB423E21AA0FD1A75D686EA04B8B1F921F47681D367F23DC1B7C53A807A445D3B83E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494274, "uuid": "8d4c6eac-7911-441c-83f8-6dbffdb8196c", "value": "12288:bZKCzqvpDfT3yk1c1h4UWTi5dihWdA1LNo3X+iyCrMi4:XzMpDfTiUcf4pTidKkiho+arL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494274, "uuid": "d871883a-eacc-4355-a8a1-3bd0d2a08e42", "value": 523147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494274, "uuid": "8518b82e-b4b0-4006-bac5-51209af47793", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494274, "uuid": "7f6e7527-0e9b-444b-8c35-2cdef6a0df32", "value": "HL-80996288 DOCAU BC ORIGINAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ff60ca-9e0d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618506614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506614, "uuid": "94e6f6a2-7722-4ec1-9048-5dd9fe9b156f", "comment": "Malware payload (RaccoonStealer)", "value": "c6c55d4ec62be18675a039e710ab6ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506614, "uuid": "6d0ce707-bfd1-443c-ae2a-8048154d32a0", "comment": "Malware payload (RaccoonStealer)", "value": "12f0a80b6374b38a3997a7ef4528f26ccbca664b26e48533e7d1f36c78da76f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506614, "uuid": "f59fe271-9d7e-4778-b689-ded52fb29325", "comment": "Malware payload (RaccoonStealer)", "value": "9eed727a54747559df98c24a3f926cf950999587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506614, "uuid": "6f437826-8fa1-467b-934d-8618d8df02a9", "comment": "Malware payload (RaccoonStealer)", "value": "44eadc902f32c8a0ab1b5748ee8c2fb9acacb5da6a72852809a577db8fd60c13a3930a59e1d687b10580f5e0bd898bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506614, "uuid": "22a6b829-8ed6-45af-8980-696720e0ec76", "value": "4D64CF1033D0C036C19335B58525CBF59EFA743167669ACFABD40AB94F286D29B3A30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506614, "uuid": "4756ea91-bdf5-404c-9326-a771aad5ce67", "value": "b913f9cb3cbe9cf97fefd6e5bf6bd28c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506614, "uuid": "3ca4fd92-7591-44b9-9513-25fed2b858d0", "value": "6144:UzG5LQG5jiQMOv2QkLNO9Ct8xdLx12qOjKVKnN4LYByim:UzsRiQMQ3SACuxJx1pOedYoim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618506614, "uuid": "664d6a26-2d97-4933-9a99-1158b681640f", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618506614, "uuid": "9bb16903-7153-47a3-8567-5446444eb4a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506614, "uuid": "70070cdd-bf1b-460c-a4a8-d0d2c2453cb9", "value": "c6c55d4ec62be18675a039e710ab6ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a7f22f-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "33ab89a5-6294-46a9-a080-8e87257ad513", "comment": "Malware payload (Dridex)", "value": "915997674d3074bf7bd7f64804069da6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "327d5a7a-ec3b-422d-931d-44dcbc711c28", "comment": "Malware payload (Dridex)", "value": "12fed06bf3c439f1fc9fa9378649a72ce6cdb0ee990fd8611eeebf1dc2f44d35", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "4ec06cb9-fded-45cf-b4cd-7efa566a2447", "comment": "Malware payload (Dridex)", "value": "f3b6df6946e8e506b4eb3a09305e7e981e58f617", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "8e5336b0-97ac-463f-bd7a-18de20493652", "comment": "Malware payload (Dridex)", "value": "49e2c103b40cbae105a3c9b1a20cc4b3f765955abff1997c596e545a8f53075299efe453c7a38ad1b7843305af69c325", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "98a53f0d-4f3e-4368-b67f-cbedaad87499", "value": "6DF3E10AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "8f45673d-c760-4e4a-9ea3-a9edf1ba3c17", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "64149eea-329e-40a2-b29e-ebebafb2f035", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495932, "uuid": "8d9e4d46-8e07-4ec9-9b47-6ee6c250a566", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495932, "uuid": "969a85e2-029b-4e03-9435-4d64dfaddb7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "c2862461-c3d9-44cf-800e-595bb4430e69", "value": "12fed06bf3c439f1fc9fa9378649a72ce6cdb0ee990fd8611eeebf1dc2f44d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a201a3e-9dfc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618499166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "2c8bfa11-d840-4906-b923-46894bb50fb5", "comment": "Malware payload (Dridex)", "value": "d60242df5e6f0e67fdda0dd97fd59d6f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "3d2b9aa7-d563-4214-8997-2ad995fcdf46", "comment": "Malware payload (Dridex)", "value": "1337ab7bbbc468365cea7006574ab1703c860a6cd2a6e9a2bab7dd42394e9114", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "b598207c-2869-49fe-b0b9-7937f3d4aad4", "comment": "Malware payload (Dridex)", "value": "c9544a8145800c6dbcaeb289832e53f5bc063d9e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "2abee361-5d4e-4cec-a30d-b580062bd377", "comment": "Malware payload (Dridex)", "value": "0f66f161fd6ea5eb24e6f690c82201db5076fe8e469e7ec25eb01e498f3299a5a3ce7df80f1dc5c6614be1f0bc12f7d1", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "ed8ee003-f50a-4b60-963d-8561c575b4be", "value": "E7F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "0e74ac81-8bf3-4a25-9245-92f3e99c61c7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "f9f9f28f-e0dc-48de-9061-6c2e8e12a0f7", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499166, "uuid": "9ce55dc1-3bd1-442f-b1c1-e40fa439edc2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499166, "uuid": "6d4cfec0-0d6c-4519-9f54-599337e45bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "f5d02ace-8c3e-4ce3-a801-e0a6747861ab", "value": "1337ab7bbbc468365cea7006574ab1703c860a6cd2a6e9a2bab7dd42394e9114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f82090-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497192, "uuid": "458a885a-4caa-4ec8-a819-26da8ace3c9b", "comment": "Malware payload (Dridex)", "value": "9d1786a3b41ff6851a649d37f4471a23", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497192, "uuid": "da2e86ca-06d0-4e65-9ed0-17c83788d3bb", "comment": "Malware payload (Dridex)", "value": "137e07d73f3def4a50fd4e0e04a1d6eaf33d4277d71c587cdc7bd1544929e09a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497192, "uuid": "e2d6edb4-bcda-4b07-ac67-2ecad401696e", "comment": "Malware payload (Dridex)", "value": "c1b157725294303a49920bd8c1ec5df4be5f06d5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497192, "uuid": "8a774969-0d47-42f5-8060-86a1ae45c7c1", "comment": "Malware payload (Dridex)", "value": "bc115401e8cf4336e092196a065c33e448908397b1b4ff2e23fdf042aceec5dfb1bba9f618b5ea4ec99c858dc10d7064", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497192, "uuid": "3e16aaa4-7e2c-40e1-9a5d-8d5e9ec03f18", "value": "F1F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497192, "uuid": "17e076a6-5752-4308-b11c-84edacad2a82", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497192, "uuid": "463a284a-0b4a-4074-b3f1-c77dd9f3edce", "value": "3072:TA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:T3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497192, "uuid": "fa85958c-fbc0-4209-9609-a63c0111bddc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497192, "uuid": "3ec1030c-d5bf-4f15-8fb0-424218bf8017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497192, "uuid": "9c32f7f2-e053-4a5f-8865-79f6e1295f55", "value": "137e07d73f3def4a50fd4e0e04a1d6eaf33d4277d71c587cdc7bd1544929e09a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6330da16-9e00-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618501006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501006, "uuid": "ce21620d-4d59-43c1-bcee-54814fbdef18", "comment": "Malware payload (Quakbot)", "value": "f36bca0b138a03c2f289e6977cb6701e", "object_relation": "md5", "Tag": [ { "name": "biden29", "colour": "#95DE72", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501006, "uuid": "526ad071-9c24-430e-b995-335e7c73b4f1", "comment": "Malware payload (Quakbot)", "value": "1387164d5353f32d77912b968065d5ce8b1a4e2c208838925f32556745301fb8", "object_relation": "sha256", "Tag": [ { "name": "biden29", "colour": "#95DE72", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501006, "uuid": "2c9d2802-e299-45ba-af01-dc1259d74eda", "comment": "Malware payload (Quakbot)", "value": "58344e2cd668ba4f9d96ebaf3eb671c6509ec8f4", "object_relation": "sha1", "Tag": [ { "name": "biden29", "colour": "#95DE72", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501006, "uuid": "952cf1da-ec98-4043-bc73-98bc718f179c", "comment": "Malware payload (Quakbot)", "value": "a587bf2f28682f49e39369a20d23d9025bd33645e6098d2af7148fda28945d7212198838d44e141e81226c309b5be6e8", "object_relation": "sha3-384", "Tag": [ { "name": "biden29", "colour": "#95DE72", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501006, "uuid": "512ec74e-4d71-4ef7-9fbf-6bf7fe2bbcdc", "value": "EF65CF22B690847BC1B3267D9C7B92A45829BE513F24AD4B2BE41D4CCF343617E352B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501006, "uuid": "66839943-8ffb-4fe8-82f5-3f0e8baf7c6c", "value": "63821b071682d834155a6bc1421d5241", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501006, "uuid": "6432202a-0289-42bd-850d-8519792c45f8", "value": "24576:j4I/q17LhNlaGeUZWUZWUZWUZWUZWUZ/gMaHFuI5my:0IcRBecWcWcWcWcWc/ao9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618501006, "uuid": "d851c550-767c-4414-b0e6-d72254cfc249", "value": 1424896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618501006, "uuid": "0c36ffa5-7ad3-405f-a456-dbe61d1e7a28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501006, "uuid": "a96406c7-1b6b-4f9b-ae3d-4a02bdee193f", "value": "Hodas.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0449af1-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495981, "uuid": "ebbad05e-e419-4bb5-86ce-3115c91189fd", "comment": "Malware payload (Dridex)", "value": "92c2cdf77e0c88ac999ef1fc77728ccb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495981, "uuid": "336736dc-757c-40ae-ba5a-d4924dadae6c", "comment": "Malware payload (Dridex)", "value": "139e6386fd2de07f15f579f9389b6b8221961feb1ceb1c2a9c14db4022d23078", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495981, "uuid": "992100fd-79dc-4de2-8450-77caeac1fb7c", "comment": "Malware payload (Dridex)", "value": "09828243d13bd6b9abd86302aedbba58cd967f63", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495981, "uuid": "1324ffd3-8979-4ab9-953a-1a9026642161", "comment": "Malware payload (Dridex)", "value": "a30597123872bb72230080538c64b5618696b9a68ab8dedd581274e7b74e0dc80c60be7a00b132de1e8bb7270ce8a9bd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495981, "uuid": "ec1fc284-ddd1-43b5-81ec-c94c32a65d58", "value": "CBF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495981, "uuid": "85483294-8499-4bfa-9893-45ebde1eaec2", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495981, "uuid": "55751e06-be3d-44d3-ad38-c541eb8e1009", "value": "3072:VA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:V3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495981, "uuid": "87b1456d-fce4-4664-8aa7-168b47b91928", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495981, "uuid": "6ceca6c9-0654-479c-a05f-42b2265d60fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495981, "uuid": "e8369969-0c24-46bf-9daf-a7c1738fb90f", "value": "139e6386fd2de07f15f579f9389b6b8221961feb1ceb1c2a9c14db4022d23078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675a6543-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618514757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514757, "uuid": "0b9d3aa2-7516-47e6-9026-1d69612ef42c", "comment": "Malware payload (Vjw0rm)", "value": "e4996c01d4929a975193269740f28881", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514757, "uuid": "5d9102cf-d044-4924-9df6-897279317075", "comment": "Malware payload (Vjw0rm)", "value": "13af60f89ceb752fa548c1160fb3ac115bb072d8582e714cbd097e686d94760a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514757, "uuid": "e4b3fb33-6ab2-4fb5-9152-1d86c89cb483", "comment": "Malware payload (Vjw0rm)", "value": "6778a0b0914630d713356f95f6e06cc591b57ea5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514757, "uuid": "dab01b07-cd86-421e-8738-45755179eacc", "comment": "Malware payload (Vjw0rm)", "value": "50a4bb8b25eeba7b5a636745f334cd0b39117688909a013378af59018787a939f7145c7553ed660578cad48a7efb55f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514757, "uuid": "341fbc48-f1b8-4204-ac26-f532d830b861", "value": "A4811F9D284BC62C53D27B8A802DD148CDF548B47F28D2B5148CDAC5360E97987B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514757, "uuid": "dc4f4219-e9d6-428d-935f-c71119da5951", "value": "96:SABNo5DVk2c24ZRMHXE6/BI/+Ys+fJsDdQqR7bJyKUdOS4UK:zSO2c24ZRMlBImYs+fJCfRfVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514757, "uuid": "896c4b89-11fe-47dd-9623-2f09cc302a30", "value": 3881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514757, "uuid": "30588575-7775-48e4-9dd5-e03376c3bef3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514757, "uuid": "fa17fe42-b579-4590-9d4e-b51b65b71bdc", "value": "Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1574b9-9db1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618467089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467089, "uuid": "e1009c98-c766-490d-9c1d-1984a0615984", "comment": "Malware payload (AgentTesla)", "value": "317b0e7572b57e40c0fdc1ba04a77d99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467089, "uuid": "1e9f7ee1-0dfe-40ac-943d-35f6ec937652", "comment": "Malware payload (AgentTesla)", "value": "13ff472515c393678075f24544aa4cc93ca66f90846fa25acb3cf70d254b52c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467089, "uuid": "a03776a4-042b-478b-8452-33ce29cafca2", "comment": "Malware payload (AgentTesla)", "value": "4b56cac7c4407022f4c1f50d9b24a5afee51af82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467089, "uuid": "25b71525-e398-4cfa-9ec9-dd2c6a5f99dd", "comment": "Malware payload (AgentTesla)", "value": "3e5daec25aa98de150142d52a32d7a5e334282786c968dfaaa368980ed0b6b03f8ea631f1ba2a21f23196be0f2acd985", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467089, "uuid": "dd8be7a3-72ae-4364-9bc2-943fa76e39f6", "value": "75256C88B544B59EC81ACB318974CC3056227DABD726C10F60CF3DAB7F7E697E9141A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467089, "uuid": "c7182bac-4a8c-4833-a893-cf38e7b5c52e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467089, "uuid": "dc528752-0977-4115-a825-2dad3535d551", "value": "24576:arC1px6u0JIhz18OdoiEmEKBBUPNm0uMgO0//26Hy1q:a2pxkJq1VLxYbuLT/O6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618467089, "uuid": "b05cb3cc-027f-489a-8de9-201df870f375", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618467089, "uuid": "0ca1f490-3260-41cc-a767-432f680e9cf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467089, "uuid": "b2081030-0c6a-4ff4-91ce-ea8195bce821", "value": "LIST OF PRODUCTS NEEDED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e12903f-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496783, "uuid": "18d525cb-a5c8-40db-8a79-cd21bb9edfbc", "comment": "Malware payload (Dridex)", "value": "8e2214959b68888c61036cb675c01984", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496783, "uuid": "49558657-9ccc-48ef-88e5-16dc755d3108", "comment": "Malware payload (Dridex)", "value": "145e88e23dac3829bcc8593bb16587f059538568314fecfacbab0e141f1098c2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496783, "uuid": "7a0a722c-ca63-4418-8a27-1f03c1f42b4b", "comment": "Malware payload (Dridex)", "value": "6cdacd4bdbe8534e4f28a184603ae5eef066223c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496783, "uuid": "a30c08b9-a2e4-469b-8f8a-98450276e9af", "comment": "Malware payload (Dridex)", "value": "2f72b689b030c233bc34363b69ade9d7310e993b137fe9cd1883943e7b82ef2e64f440a6187eedd8ae190bd696ea2c89", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496783, "uuid": "f099c05c-7261-4c75-8fd6-8d46baefce3d", "value": "80F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496783, "uuid": "3b091e39-8aba-46c4-abe9-24f9c744590e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496783, "uuid": "2ba3215e-256d-45ff-9178-458483108b0d", "value": "3072:bA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:b3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496783, "uuid": "398e7046-0e95-419d-915e-29225c0a0a59", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496783, "uuid": "7945e053-1853-4b9a-9ae3-f271e0074fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496783, "uuid": "3a587391-5ede-4880-a808-852c2c831ffc", "value": "145e88e23dac3829bcc8593bb16587f059538568314fecfacbab0e141f1098c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f48fac-9e44-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618530111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530111, "uuid": "afed51cd-9751-401e-af6d-24a2d614f539", "comment": "Malware payload (Dridex)", "value": "2063f33b3a9127fc5665c8671733ee87", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530111, "uuid": "b82bf025-4c47-4080-a177-f55ad61a765c", "comment": "Malware payload (Dridex)", "value": "145fc880ea39738f3fb18ad7accaebef2466aadbc8213671cab9f97fd8cc1932", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530111, "uuid": "3f4dd068-53df-4822-b7b9-4604025f954b", "comment": "Malware payload (Dridex)", "value": "216b06e105420fe26a9273d771ede58c78fb139a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530111, "uuid": "10984c61-c458-4cff-b885-c1a53395c381", "comment": "Malware payload (Dridex)", "value": "bd5cb7095e14285cf45a6f8c2c203f84a6998b78fc1c83140013e0b2c70b5ef76831550bb5ccb2b3c8f5a0b974418dba", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530111, "uuid": "aeaa9a1e-8c66-4ea6-95f1-78177cd29298", "value": "93F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530111, "uuid": "60bb8954-0451-47a5-95ec-ac2fba39dc96", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530111, "uuid": "00fae164-edc8-4600-8ea0-44a5cc454b87", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618530111, "uuid": "72786337-25ca-4c8f-8014-8787559b78e3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618530111, "uuid": "b2cbaf7f-fde8-4ba3-8ab0-9529a298afd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530111, "uuid": "0ac30d9c-06be-49c9-874f-f5884a6cec09", "value": "145fc880ea39738f3fb18ad7accaebef2466aadbc8213671cab9f97fd8cc1932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90292d8f-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "6629b1d9-0de1-451e-8087-bcb20434314e", "comment": "Malware payload (Dridex)", "value": "ee2663cc9084bf4cbcc73599c66bf0d5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "5e9cffc9-cd15-4d02-9de0-6a13aae38a56", "comment": "Malware payload (Dridex)", "value": "14bf7f2597682515d22e9baf117e625f4db40af01de4b71f766caaa404e42c32", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "e6458c4a-52d0-41d4-8b29-a3e6ff53037b", "comment": "Malware payload (Dridex)", "value": "d2e73c3c74b3cedc5dacb526ca7c976c5620ecaa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "a30ba7c4-75f0-44ea-b438-f6b619aa1eef", "comment": "Malware payload (Dridex)", "value": "ac0979cae963d782f750824ee5f5eee8966986f646ec7d6b3dd10bd59bd1fec1b92e6c2e915100ddcb104e5370eb8e23", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "9dc7fc7a-d2b2-4c51-9b68-0798369d98e2", "value": "A6F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "d8a44f70-4de3-4c9c-8533-83eabc0a8ee1", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "a459dc16-ab1e-4f6b-b78f-e2fd0968c6dc", "value": "3072:sA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:s3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496787, "uuid": "1e739b3b-7897-4705-bac6-31b0dd281d36", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496787, "uuid": "5dff74bc-ea14-4e71-b46a-6bf3ae2cbf12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "bad59b36-658f-4f60-9f73-f87d3ce31b0c", "value": "14bf7f2597682515d22e9baf117e625f4db40af01de4b71f766caaa404e42c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16a53fa-9e37-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524733, "uuid": "80e04aad-064a-4e97-89f0-d1a7899629b6", "comment": "Malware payload (Dridex)", "value": "a8d0ae06a2322f81e5636ad1baa2ff3e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524733, "uuid": "a172d677-73b6-4be8-a7e9-4501067c3d25", "comment": "Malware payload (Dridex)", "value": "14c71b9ec9b17e351bb3eec06a7fdf943177af14cea84de80b15ca86bb5aec59", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524733, "uuid": "5971aa55-ef30-4bc1-9112-3fd7a3ce77f3", "comment": "Malware payload (Dridex)", "value": "787890adc571b8abee1bef052bbb84b9dcf7acf8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524733, "uuid": "e0142002-0c77-465c-a2b2-2c9ddb2f82d9", "comment": "Malware payload (Dridex)", "value": "6c47ff62abed1070a2001c25dd260035550e09b3082dc673dc185416c5b562cbec4d1faf8d90c72315f7567ab87a5bf6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524733, "uuid": "0d0ce861-8777-49f1-8027-547999168df0", "value": "08F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524733, "uuid": "070c353b-ed8f-4a3e-b0ca-d437d528e2c0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524733, "uuid": "506d579d-020f-4335-be37-4f97cf1b1ebd", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524733, "uuid": "2620d33e-28eb-4295-acf0-efc69867ca22", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524733, "uuid": "afe39444-1143-4040-9b08-b703e5abdf57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524733, "uuid": "7868c734-520b-4e51-b13f-e5f2e775043a", "value": "14c71b9ec9b17e351bb3eec06a7fdf943177af14cea84de80b15ca86bb5aec59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01acc941-9de4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618488817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488817, "uuid": "146330e7-e7d4-4c27-9bd4-3b7108174731", "comment": "Malware payload (Dridex)", "value": "8fcef36e213787b3f19a978faf53f725", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488817, "uuid": "6a1eaadc-c8e8-4ee4-9dc3-abf00e8713b3", "comment": "Malware payload (Dridex)", "value": "14e1ba044b2c1e5c5b823e441c9befa138d283f02550856670e0b2602cb44b1f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488817, "uuid": "6c3c149b-4b45-4f1a-8406-e66925fcb4ae", "comment": "Malware payload (Dridex)", "value": "913bae4273130b59477788fe30e1d9f40c44ee84", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488817, "uuid": "a04221e1-c19b-4c42-882c-5ff01f289b9d", "comment": "Malware payload (Dridex)", "value": "ed52c390baa474ca1b0deaeda90534adbedc80007e565769a7706043eabd648967e7eaaffbffea168e70077651be1bda", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488817, "uuid": "7a621422-dbe5-4b8f-9dd3-88e07082d9f8", "value": "65F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488817, "uuid": "30db3381-2a6c-423d-b5a0-3dc4c3d021b4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488817, "uuid": "80444e04-dbd6-4984-a709-48fb35c5b931", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618488817, "uuid": "f7f4981f-3597-48f1-868a-61e7e458da57", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618488817, "uuid": "3efc5b30-f0ab-4f84-acb8-06ddbd01d7bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488817, "uuid": "d98eb13e-42d0-4065-92a4-5863f1330b24", "value": "14e1ba044b2c1e5c5b823e441c9befa138d283f02550856670e0b2602cb44b1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdf8b20-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464247, "uuid": "c09227bd-4019-4c61-97d5-6eeb9ea39a41", "comment": "Malware payload (Dridex)", "value": "61f6e538d4d01708b37e8107b13e16b5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464247, "uuid": "cb165fc4-a183-4457-9da6-4603915db492", "comment": "Malware payload (Dridex)", "value": "156104d29ac3044c177492a8fb9d1569f9d6f9c6faf276bdfaaf7990f5256803", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464247, "uuid": "01ba3b06-2fb8-4174-a8d5-072a3da39166", "comment": "Malware payload (Dridex)", "value": "6149a816563ce4cba08f09448eb448dc8a5f7f66", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464247, "uuid": "4bcf3813-0402-4816-a3d0-2e73fe6cd6f2", "comment": "Malware payload (Dridex)", "value": "71e3d94b9e1fb35ba029bff8eb539dbed80195c9fe600be851510e35fde1d6b18570f9e0611d7c82c3b01ed2582ca785", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464247, "uuid": "eb2b6460-cc30-426a-bf33-4d0c0c2c7014", "value": "4DF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464247, "uuid": "fd80098d-c600-4deb-a19e-f61ac544a5f4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464247, "uuid": "fbebc29e-160f-46ae-a7cd-4c565e685874", "value": "3072:VA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:V3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464247, "uuid": "2186b7f1-f26a-4644-a3b7-faaa36178d87", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464247, "uuid": "1bf408bf-e136-4805-a7b6-c12328d0325c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464247, "uuid": "56a8336f-c887-4e73-8436-f97986740eae", "value": "156104d29ac3044c177492a8fb9d1569f9d6f9c6faf276bdfaaf7990f5256803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba41101-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498980, "uuid": "b735fda1-7a6f-4215-84e9-7e9178060e2c", "comment": "Malware payload (Dridex)", "value": "865bc59f3bbc19f7320a051e05c8f2d0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498980, "uuid": "51260ac9-162f-4659-b0a1-52fa2efab686", "comment": "Malware payload (Dridex)", "value": "15925019de5bd6bc4cd76aea509ff509304dba3d3a35840dea187ce7fff67325", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498980, "uuid": "fd4e950c-c4b7-4e22-a217-29efa37ef753", "comment": "Malware payload (Dridex)", "value": "50170db07a12d4b570ba1e35481cd7040171cb29", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498980, "uuid": "5581b1c7-f2be-4cc8-a3fd-dd9dbc61e906", "comment": "Malware payload (Dridex)", "value": "790d1b1048086d0fb0fa2223948365dd9f23ad401134217e4b5c4cca78ccdb65b9245a6f78ebeb2669dd40f726fcdd2f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498980, "uuid": "8841b944-4d49-41aa-8068-4d8796cb17eb", "value": "EBF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498980, "uuid": "22fe3b78-920a-4a35-a203-2be9d6d98acc", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498980, "uuid": "f79b08b4-cf74-42ab-aa33-0c300a7d0e8e", "value": "3072:XA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:X3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498980, "uuid": "d79fb1b8-ef04-4797-bb25-cd55c9c2363e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498980, "uuid": "1334c714-a776-43b1-bc48-5c7c00ef0382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498980, "uuid": "c97e07b2-cab7-47d9-9360-486476e05f69", "value": "15925019de5bd6bc4cd76aea509ff509304dba3d3a35840dea187ce7fff67325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2830991-9e0e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618507260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507260, "uuid": "32425d19-fc6d-4732-ae0b-865c9beb973f", "comment": "Malware payload (Formbook)", "value": "36df7b55afe102a9359a270f8a38083d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507260, "uuid": "7eea9d4f-a220-4bde-8b99-74f03385d717", "comment": "Malware payload (Formbook)", "value": "15944a88ca237bb17dde16f5ef5a0dc4122576d8dc80f2d28f2b9555464c05bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507260, "uuid": "e3918f74-62f5-4f91-9ad2-0295999866be", "comment": "Malware payload (Formbook)", "value": "138796880d96f7c3acf488f535f5a229fabe9522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507260, "uuid": "ea0a7d4c-7d52-4c11-8380-83ca7ca07d47", "comment": "Malware payload (Formbook)", "value": "2b81e14108dbb82e67d710f0a066f13299bfc17b5094b2fa67991c4caac66f11c2f9d63f6256ca23f299d40c135ac5fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507260, "uuid": "465fef6c-1179-4d15-96fa-546fc88f8296", "value": "7C35CF2A23A46F64F17EB7BD51351000A7F4F813D321EB1E7ED581DE1AAAF408616B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507260, "uuid": "40f2e43e-eebe-41e7-aced-e47c9a249267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507260, "uuid": "700fc988-eb8d-427f-943b-283006d7d88d", "value": "24576:AD2ovIrora/QEWX5eqIJW67PPqzxOt2qmelty5ayV5n2Iy:bovTra/QEWX3r60x+meltoaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507260, "uuid": "2ca2095c-ea65-4dd5-9204-4e36afac0682", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507260, "uuid": "50c82cce-8b39-4e80-8977-8938fb7e5af9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507260, "uuid": "27fd4d36-afe4-4f4a-9f7d-cadc167e6e3a", "value": "36df7b55afe102a9359a270f8a38083d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495b94c5-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497097, "uuid": "ed648ec8-8610-438b-90be-919e84f4feb6", "comment": "Malware payload (Dridex)", "value": "745961326ba2e0228523c9189c889631", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497097, "uuid": "ceca49eb-5b98-4221-a3c4-9a50ae62ac73", "comment": "Malware payload (Dridex)", "value": "15eb80e4b171da906edd26e319aaad3abc7748d46c4f2739f659754a7238f07d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497097, "uuid": "c276e375-ac97-4acb-a839-e452e628875e", "comment": "Malware payload (Dridex)", "value": "a7629a3a531d38742eaa34184c1d8cdde3960601", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497097, "uuid": "0e6c320f-d298-4ae5-ae0d-16a0a763b296", "comment": "Malware payload (Dridex)", "value": "7588b44d8d091493d88095f7df125f73e7c84633b56a38fa05cf5e3694f168cd35e17e825157a399b1e2f0c99bae74bb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497097, "uuid": "b7ed487d-75b3-4450-b776-b3b35c9a17c9", "value": "CCF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497097, "uuid": "ced2dc8b-f5ab-47a8-a495-59c94e1429f2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497097, "uuid": "266bd661-0fa4-4535-94ce-c78d46e51c7f", "value": "3072:siFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:PeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497097, "uuid": "c3fa51d1-68ae-473a-b658-f4de15e12bba", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497097, "uuid": "0d5ab166-b23e-41f7-a154-fab3131be95c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497097, "uuid": "93c993cd-533f-4356-94e1-05417bbd854d", "value": "15eb80e4b171da906edd26e319aaad3abc7748d46c4f2739f659754a7238f07d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3d4870-9dba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618470985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470985, "uuid": "56826fc4-f4e5-48c5-8d51-563f922f511b", "comment": "Malware payload (Formbook)", "value": "6067f06ddaa280fadc57ae18c9de766d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470985, "uuid": "85a74854-2ac3-4bee-b97a-d45fa93ee9fc", "comment": "Malware payload (Formbook)", "value": "1621fca6a68cd980333bd159e508595b0d5a6397f6eae002f7f4183927133f76", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470985, "uuid": "d1361e60-f3d8-4286-8653-73a239115f41", "comment": "Malware payload (Formbook)", "value": "9c2994ecf07e7d7c1925207aaa207d011b157843", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470985, "uuid": "f0e84173-350a-4915-962d-499876e9f7e4", "comment": "Malware payload (Formbook)", "value": "6ba42630d6db8342baaa6d19810f5059b8d13e84151674d5d71c5adc76e55fc7d6e2e308ca96a8af7ef99491ab72382e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470985, "uuid": "f1e53afa-e453-49be-9043-63e1291604e1", "value": "C6258D5233A45FA9F1BE8B764062308443F6BC43E716C65E7DE230D91A72E81D76AF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470985, "uuid": "3d15c61b-5355-4ca4-ae71-0c1ea8a3424d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470985, "uuid": "b599dcd4-d18e-4a0f-ab33-fff5d0af183f", "value": "12288:AhsIqkwdOBGnbHH3wDYqmlgaJO3yOWXC2aiiQQhfxBPUfbHQrOgKvq6u+:AhsIunb3w3yOWuii93PGHQrCvq6u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618470985, "uuid": "7834c1ad-4fe1-4d51-9eb0-4ae653e1281a", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618470985, "uuid": "f3f4f580-806e-43f0-83b0-78bc4c18d914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470985, "uuid": "e1f8e615-4509-4e77-bdff-2a9a85c3f357", "value": "PO#293701 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c32add-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618523338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523338, "uuid": "35c455be-5d29-46af-993f-3ca29d9cd068", "comment": "Malware payload (Dridex)", "value": "64986c8c7ab3f93edc0936e20579f495", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523338, "uuid": "cac5ca08-618f-42bc-8143-064f7818ba72", "comment": "Malware payload (Dridex)", "value": "166c5bf60c69e6de55afecbbdd41ffbe72b5c5f778d64d479d74207e76438da0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523338, "uuid": "ade5d5dc-2ed6-4cdb-a284-b889f6dc6daf", "comment": "Malware payload (Dridex)", "value": "4d2d0f856fc9d094829beb7847c3b86faf680546", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523338, "uuid": "a66c11c7-cacd-4c46-aeb3-20800aaa5835", "comment": "Malware payload (Dridex)", "value": "3be26c2081e05830c8802e4bd2681c54aa04548552536df88ffb930296c66e2e7337666694317fddf9960e23695f6344", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523338, "uuid": "23359ca1-fb6b-4437-8fba-caf605a354ce", "value": "D0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523338, "uuid": "0be307fc-c7c6-404f-8c4b-43ff0d54c9d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523338, "uuid": "14544cf5-5f94-461c-a313-804f3ee532ab", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523338, "uuid": "5d724afd-ec7c-4807-8b74-2bc592b2e1ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523338, "uuid": "e87289a3-3e88-460b-8008-67218fa19908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523338, "uuid": "1dd20803-11a8-4c60-bb3a-b11c7eb021cb", "value": "166c5bf60c69e6de55afecbbdd41ffbe72b5c5f778d64d479d74207e76438da0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47209d4f-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496664, "uuid": "86e63128-3552-41fc-99e7-70859929286a", "comment": "Malware payload (Dridex)", "value": "6fdd767ee913797e20ec3ac02eb8e3dc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496664, "uuid": "0412a938-b85c-4c3e-96e8-8562db3d2721", "comment": "Malware payload (Dridex)", "value": "166dde165b1233e47b1a81de0d301c8889e4787b0f241c6a016ccb317303b60f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496664, "uuid": "c67e09a3-f9de-430e-8b98-3cb6c0ff10b4", "comment": "Malware payload (Dridex)", "value": "dcb79fc572af3674a9ac1e0bf23dd6829b4dd4e4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496664, "uuid": "b9f92a2c-6562-4408-8c1c-207210231d03", "comment": "Malware payload (Dridex)", "value": "7d1273d60bfb06f2b640889b16b72acc4f8f40fe80da3a66b43571e6c4bec5af4a0092e609ad66326818549f38817c9e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496664, "uuid": "15d58b76-3010-4883-af26-7884cc8d5970", "value": "A1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496664, "uuid": "541c1436-d20a-46c5-bdfb-482c35de2544", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496664, "uuid": "0ca6506c-f3c6-4ed4-8d1d-c775406ee4fc", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496664, "uuid": "793c35f0-8477-49b9-b47a-c5024f907014", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496664, "uuid": "541827a8-f9da-4d38-a371-8fa09d0165e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496664, "uuid": "d6b91ea6-2ebb-46d8-bef9-6d5e54889b1e", "value": "166dde165b1233e47b1a81de0d301c8889e4787b0f241c6a016ccb317303b60f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a752ba-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515984, "uuid": "b463109d-ae6a-4628-98d4-0b0e0d894c36", "comment": "Malware payload (Dridex)", "value": "f07cbfa02bc380fbb6e1065253fbbf20", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515984, "uuid": "0a7ea0e1-796a-4299-bdc4-2247c73f9255", "comment": "Malware payload (Dridex)", "value": "1689f58f67b423fc4266ab556f54a992c3e47670aff90b0837aac1cbccbe8694", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515984, "uuid": "812e9a04-6cf6-4a41-9f62-3882fffe9a7b", "comment": "Malware payload (Dridex)", "value": "e19d7b48df3f81fc25e2d87f80c2c540990927a1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515984, "uuid": "3907a46f-3f1c-42e9-b301-783d8ca60ce2", "comment": "Malware payload (Dridex)", "value": "6d773efca04ba7b3c7498002f99cd4915332cceb5c82f3a65d64d802a7a1837f8c50644dfa284692f23d88d327827114", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515984, "uuid": "176ca25a-74a8-43e2-8ddb-ba33fb40d5fa", "value": "B9F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515984, "uuid": "b8b11326-e6f1-4092-9c3b-832807a30512", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515984, "uuid": "81199100-be27-49c8-8ddd-c438a32310c2", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515984, "uuid": "d3a5c1f5-932e-48e9-8eca-9dd111917244", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515984, "uuid": "6c47e54a-a712-453e-8ed6-87db8731153c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515984, "uuid": "c3aaf4dc-20b7-4d7b-8c43-4ff048dfeaab", "value": "1689f58f67b423fc4266ab556f54a992c3e47670aff90b0837aac1cbccbe8694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e910920e-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464294, "uuid": "f5a398a9-8e39-4ac9-ae9d-3f27fab47533", "comment": "Malware payload (Dridex)", "value": "fe4fcb43bf377215b6207ff88a9caaf2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464294, "uuid": "d3071525-9efd-444f-af1a-05ae854feea8", "comment": "Malware payload (Dridex)", "value": "16a4c2fe0c3c0f8af1c1a7da371a815007ad04154214120f4d48ede1a0a336e7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464294, "uuid": "2c4c6767-e260-4e0c-a11e-8f9f513594c8", "comment": "Malware payload (Dridex)", "value": "d337f5bbd8ef57d5ef34ebba739f1aa7311cd55c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464294, "uuid": "4574ac3d-207a-43bf-a74c-06344ce8c7ec", "comment": "Malware payload (Dridex)", "value": "7444a32661a4cf141164ce5195c838b0c3f80e78475045d835b40c4ff3494b00d554a57b9a87771ea4a9e7117834c938", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464294, "uuid": "853c44d2-3908-4716-8c0e-69bab2fe260e", "value": "39F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464294, "uuid": "a9cb5c66-08dc-4b71-b9cf-ab1199d5dfb4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464294, "uuid": "44ccc997-189b-4366-bf46-4d31819f1a81", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464294, "uuid": "f9e8436e-7d79-48af-9fe7-bc58578fbbe4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464294, "uuid": "0e2a7cd8-b273-44f6-8163-384cdd270106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464294, "uuid": "81a1c0e8-6e3c-4e60-ae22-430cdf641508", "value": "16a4c2fe0c3c0f8af1c1a7da371a815007ad04154214120f4d48ede1a0a336e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c6f958-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618498762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498762, "uuid": "1d917841-9fc0-43eb-8799-70b7a267a0bb", "comment": "Malware payload (Quakbot)", "value": "9106f6e91fc66ca35dc62a259112f7a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498762, "uuid": "f4114d38-5cf2-4a40-bd3e-ac295261b5d4", "comment": "Malware payload (Quakbot)", "value": "16a7669fb295872d866b35e8d534b50ff537ec8fa2831cef5eba034e711fc080", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498762, "uuid": "8676d9a4-2311-428e-82dc-5fbb84e1aacb", "comment": "Malware payload (Quakbot)", "value": "8f85885853b5f488437834025872af9a778af038", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498762, "uuid": "9baf8343-2bce-4b6c-964b-41aa96fac90e", "comment": "Malware payload (Quakbot)", "value": "abef5b7ece4dca74e80052136cf8be93ef135e879cb8a96e4fe5c711758a1c216f0713e3bd74c8fd0075b50bab9badcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498762, "uuid": "7ea6dadb-6441-4b53-8f56-0fd4b5e6f6cf", "value": "D2556B31B1D2C437D473367C8D6BE2D8946A7D111D29D91A3AD50E4CCFBAA80393E29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498762, "uuid": "9b80e27b-ac80-4e4d-a464-4c5741d08d89", "value": "413398ffac649594b2b53c025e6614ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498762, "uuid": "d07e53aa-6ba7-414f-bafb-fed57a97e455", "value": "24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGeQ:sbeeGRuPPulQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498762, "uuid": "0b1f5a97-5981-4b0b-93ff-adb78b308665", "value": 1350795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498762, "uuid": "fea25a63-0c50-479e-a52e-fea507513d9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498762, "uuid": "305c8a86-12bf-43b1-a69e-c048fcbd406f", "value": "9106f6e91fc66ca35dc62a259112f7a0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b5eb00-9e05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618503272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503272, "uuid": "efb9dd44-ac67-4ad5-8acd-063427c21165", "comment": "Malware payload (Dridex)", "value": "b5a97301aa51b86b7ce5e4719e649d5d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503272, "uuid": "2316c572-443b-4aa3-a31d-ea4eae40d543", "comment": "Malware payload (Dridex)", "value": "16b5f5cac5a41e8d4b92416d1289285da269e2d53cffe0ccef43a4c72a89bbff", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503272, "uuid": "bff76708-95f0-4ca0-b6cc-8f4007d57eb9", "comment": "Malware payload (Dridex)", "value": "f100b6c26de028ff173c0d64455762ba59337a18", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503272, "uuid": "961884a9-1aa1-40af-8be1-948df1774e1c", "comment": "Malware payload (Dridex)", "value": "e8436a0c2046b19fb072e17e49c82aeb61583b4f70cfb890e8ecf5c28c53e6a3ef7f31565d4d3fd959f9efd36b777c6c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503272, "uuid": "8faa7784-ea4d-47a7-89a4-56ce58636f1b", "value": "B0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503272, "uuid": "f5581865-e869-4e59-81cb-a9a973ee048f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503272, "uuid": "e9a7e497-fac7-45e5-9e69-5226b1ef9000", "value": "3072:yiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:xeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618503272, "uuid": "82c1bed5-55ff-4646-a30c-c7fab7472028", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618503272, "uuid": "3affa543-2809-4a0a-9d8e-5bd4a3746952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503272, "uuid": "37e206b9-c17e-4fb2-a638-db06dbc4a540", "value": "16b5f5cac5a41e8d4b92416d1289285da269e2d53cffe0ccef43a4c72a89bbff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27c4556-9de2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618488281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488281, "uuid": "8f26701d-4a33-4a80-852f-c27bc96d687d", "comment": "Malware payload (AsyncRAT)", "value": "223b29fb167554d58ab909c30b6d3093", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488281, "uuid": "d64eef4b-e4d1-4823-9d58-fdde0ad62c13", "comment": "Malware payload (AsyncRAT)", "value": "16eb09eff9142c10c36cc4af113f26e0bcb86ba030039e78edc84d96693fa7ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488281, "uuid": "114ea54f-3644-4b91-9b40-b19ffb10f8a8", "comment": "Malware payload (AsyncRAT)", "value": "b7c057bcfea8b0e4efe9408f2521928192d4b1b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488281, "uuid": "89c96180-8536-4709-88d7-7658b6e4ce8c", "comment": "Malware payload (AsyncRAT)", "value": "1fb707f07ed543734f3d3a47bf6ceae5f7989fdf9f9ed281f9a08f6f23b82c879f54783541e56767503a7dcd56889962", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488281, "uuid": "60362fa4-42dc-470b-a184-6146104d4497", "value": "2AC423A50E01AE102DF70DA7CB3E5A674677A4C1DBB5272D10ED92A612B4D8FF23B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488281, "uuid": "e112cbe6-e14f-430e-93ab-ec68d372d4e0", "value": "12288:QibJXNiB79X13RAAvvVP2eTHqi4qOjbCd4b7D/uKLSHAcUeL3J:IBzvNP2eTHv4rb5HD/hSHAPet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618488281, "uuid": "8bdd2253-7733-4b63-b598-036eafab0188", "value": 556031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618488281, "uuid": "56ab5852-8329-477d-8bfc-a1dc7a5ccca3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488281, "uuid": "b7934a3d-77f7-4177-9644-eb276b7ea2cf", "value": "SCAN_COPY-369326739.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb527f23-9e2b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618519649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519649, "uuid": "87321080-4c3c-4bbb-8247-4fb74c233ee8", "comment": "Malware payload", "value": "06c084f935db953772aa4bf0b767b65e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519649, "uuid": "05c39bc8-331a-4132-958c-52b2391fba9b", "comment": "Malware payload", "value": "170c22c1faf6b7935d9796126eed50b04bccdda54845d5bcdc93100b6c0e1c68", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519649, "uuid": "adf847f3-3917-4e75-bac8-cbe863c24455", "comment": "Malware payload", "value": "fcc039bf5eb3df04856dd3f924277e73b477755c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519649, "uuid": "c255c868-3918-47af-b92f-afb9e4a09ca4", "comment": "Malware payload", "value": "b2eff482f64d7fa709e5185d1e61af6e16e9f331f750ea93e77b283e69e21688867b00c2c660ef982c369deb799cb580", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519649, "uuid": "ab653553-c8ed-4422-935d-11e5ad3f3bc5", "value": "FDF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519649, "uuid": "29d1139a-cae3-4a22-bd08-8edb265a7e05", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519649, "uuid": "be56c3f3-9a30-4209-a56e-7990711951a4", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618519649, "uuid": "f7c1a493-472f-4b52-8a64-cd26ab1a1300", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618519649, "uuid": "99c757b2-7bf7-465d-b231-25fd0a716989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519649, "uuid": "9a34f3c5-17d1-457d-b599-3dc60af2389b", "value": "170c22c1faf6b7935d9796126eed50b04bccdda54845d5bcdc93100b6c0e1c68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7795b155-9d9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618458950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458950, "uuid": "e8a6be1f-1e26-4886-a02a-394cdc96854f", "comment": "Malware payload (Dridex)", "value": "cd449f7860d35b09a4c58a4c9585de78", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458950, "uuid": "bbd37b1f-275b-40b7-b8bb-6faa167467aa", "comment": "Malware payload (Dridex)", "value": "172577e26d11166a9fb669eed00f3299a6becbc703ce1ce46969de6201905b6d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458950, "uuid": "88b78419-697e-4482-b33a-78c8b817d7ba", "comment": "Malware payload (Dridex)", "value": "1a6aaca998f9786ba3722c97314186e70561e348", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458950, "uuid": "3b05caff-4ec1-4546-abd9-2d660ddd485d", "comment": "Malware payload (Dridex)", "value": "5f5c8c24af7a7681d2812ab9b607f4a315711369cb06b4d66864f2c0cf1bb0941f64f6354c5f6316669b709c65a98fdd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458950, "uuid": "6b3079be-5d1e-404b-b743-7356ceb22a87", "value": "FB249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458950, "uuid": "478a20ea-c9e6-484f-9469-3681b9fad3e3", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458950, "uuid": "289143a9-8a09-4f92-abc9-84c640d691b3", "value": "3072:20DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:VpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618458950, "uuid": "5cf6c4a7-24b6-4e36-ad9a-4cc60af1c00e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618458950, "uuid": "b01dc7bf-c576-4b97-8995-fc7e439897b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458950, "uuid": "29c50117-b2ae-4ced-8505-e0e6453ea943", "value": "172577e26d11166a9fb669eed00f3299a6becbc703ce1ce46969de6201905b6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4da543-9e2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520944, "uuid": "8aa5065d-3e37-4856-bcba-7f1652298ece", "comment": "Malware payload (Dridex)", "value": "65e780f8d5c70d85fed85d5813ad27ca", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520944, "uuid": "f797a869-c6e0-4253-879b-dbfd492c547b", "comment": "Malware payload (Dridex)", "value": "175e48afe1eb94eaf85bf35cd2182fce6822c736a0c873f785c1745b7ae2ab44", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520944, "uuid": "d7d97925-b9c0-411a-ae19-c4682b5dd299", "comment": "Malware payload (Dridex)", "value": "b3ee74114e83942fe5700b34651b448ec51664d7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520944, "uuid": "cd62e352-abdf-4a2f-a345-3b6be37e1638", "comment": "Malware payload (Dridex)", "value": "b4cab5f62bd6865b75611336ec8edb356ba797538e033188ba93b29d65fb8a4221e6d671e4940d1d283013afcfef477e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520944, "uuid": "dbc86a99-0b10-42a1-9650-3ee0f2161319", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520944, "uuid": "a3e6fdc7-3634-4838-b646-4762b1b2fdec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520944, "uuid": "369305d3-e4b6-41ff-8037-cea606524d74", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520944, "uuid": "7a7806f6-39fb-456d-b92c-43502cac3e74", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520944, "uuid": "d59c99c2-8340-4ef2-b7f1-023717dbb32e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520944, "uuid": "6b709bf8-c234-4528-a8b3-5111a7e41da0", "value": "175e48afe1eb94eaf85bf35cd2182fce6822c736a0c873f785c1745b7ae2ab44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7453e1ef-9e19-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618511772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511772, "uuid": "568046fd-42f6-4c0d-8359-0f51f688ed28", "comment": "Malware payload (Dridex)", "value": "f438aede9af8d9f9020f9cb535ec7957", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511772, "uuid": "f1ada67a-2b28-44ce-b4c1-03501b57b763", "comment": "Malware payload (Dridex)", "value": "176df0f10a2e427eba34517a80c40a28a787e11b87274a94a86f6b4b90f52d82", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511772, "uuid": "f4bc3c8b-4c23-4bb9-85db-f2cdd80e9947", "comment": "Malware payload (Dridex)", "value": "ce1ea6884173c93c483c66a9b27ec87d4d9a1f25", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511772, "uuid": "5db0ed23-315c-46ed-887a-184a7d19232b", "comment": "Malware payload (Dridex)", "value": "e022d8be626febdc3ed9d1e12ad81adbd66204d5f6a57a95ff7c1d336f3448ada117d82f670eb2e53d6960bd49ca6db9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511772, "uuid": "8f36effb-0379-45d9-923e-471ae75ed817", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511772, "uuid": "317899a2-0741-48fb-88f4-045d3100d5a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511772, "uuid": "752d5d74-e869-45c6-984f-58c3502e3ef3", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618511772, "uuid": "9386401d-61bb-41cb-b621-d7996a694ead", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618511772, "uuid": "994e7435-b278-4131-b67a-ba77d6d32ca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511772, "uuid": "6866fb71-446f-41a4-9e77-d3ddd52aadff", "value": "176df0f10a2e427eba34517a80c40a28a787e11b87274a94a86f6b4b90f52d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127807ac-9e28-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618518051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518051, "uuid": "7e13a465-de22-485e-99e5-79931871f901", "comment": "Malware payload (Dridex)", "value": "05fb9e39046eafd1fbb8840f30c43808", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518051, "uuid": "d01cb2fd-dd7f-4d08-84b1-b5529d9ed412", "comment": "Malware payload (Dridex)", "value": "17972659f2bc540c8ba93635b2632e760365f57a9a34a63d5db60f155378c1cd", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518051, "uuid": "1c01e800-2fa8-416e-b53f-10e27330e8fd", "comment": "Malware payload (Dridex)", "value": "063c9fb33d3b0421e8f7c22facf3c17b3cdab567", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518051, "uuid": "88aa922c-e059-4fb7-aed5-f0df71f68104", "comment": "Malware payload (Dridex)", "value": "0adba03b059ea15eb6e2ee92538e6350b17e19741446c8c9bf1934d51662e9632d6fd289563fface17939463dbcfe411", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518051, "uuid": "0cb09e6b-751e-4b4f-b420-b4a67062d738", "value": "C6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518051, "uuid": "3cef5841-8039-4c8a-a570-b67f638f1e28", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518051, "uuid": "99414b0b-404c-4b21-8e20-a377a3ecea5a", "value": "3072:/iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:0eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618518051, "uuid": "2134786f-87d1-4a83-914a-36186ea46375", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618518051, "uuid": "265cae3e-3685-492f-bf80-949747462b3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518051, "uuid": "0bbe603e-2145-473e-84d7-0bb14b865767", "value": "17972659f2bc540c8ba93635b2632e760365f57a9a34a63d5db60f155378c1cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0ac76a-9dcd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618479140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479140, "uuid": "890942eb-ba56-45be-a16f-e6d34986c6d2", "comment": "Malware payload (Dridex)", "value": "cffe4594e9d02059525e80ddeb584b9f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479140, "uuid": "fc2562d3-e428-4fb4-9aa9-0092f3215542", "comment": "Malware payload (Dridex)", "value": "185549c8f85adcb53742898db5e1f6a50eebc33399717eecf20e1d5e0e6e69ef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479140, "uuid": "91e56e4f-c58b-4afc-b182-b7e33757e798", "comment": "Malware payload (Dridex)", "value": "c386bec47610de5961dfd7b0515b2b8e15cb4340", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479140, "uuid": "55694bf5-3d52-43d1-8c02-f7319acd3109", "comment": "Malware payload (Dridex)", "value": "999dea056d002db294c75814e699ed342d3b8eab8944d5ca68996e9ce4087ab32c326cbea02e663c728f3857212b3a2b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479140, "uuid": "84db8a96-2137-4827-bbb3-fc927627132a", "value": "7D249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479140, "uuid": "639d1ca0-1024-4f1f-b8a9-bde70bf353c4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479140, "uuid": "9011c8df-01ca-4ca2-92f9-408fc8a42184", "value": "3072:S0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:RpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618479140, "uuid": "c359be49-be40-4d6f-bf15-3536fc768555", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618479140, "uuid": "be69b370-7b6d-4944-a770-98a0ab739327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479140, "uuid": "6277c5ea-32a9-477b-93b2-ac9e705f6b6e", "value": "185549c8f85adcb53742898db5e1f6a50eebc33399717eecf20e1d5e0e6e69ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10ff69e-9e3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618528249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528249, "uuid": "a4cd6f37-798e-4325-b851-1bff00c27cf2", "comment": "Malware payload (Dridex)", "value": "7c006a8e8e2db682e28c089bef311faf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528249, "uuid": "3fddf8fa-48d4-412c-9a66-ee082a69b282", "comment": "Malware payload (Dridex)", "value": "189c3fcee2b3fb0bff1ec69081daeb1dc7b0d5bdba0147dc37b8c2b6c40c34a7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528249, "uuid": "44bd8aab-c89b-4631-8971-f6b5cc1aaa36", "comment": "Malware payload (Dridex)", "value": "d6c6a0e9fef0b2b11f66939c8258947a7011e0ef", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528249, "uuid": "d746b68b-18e7-4788-8a28-05f94dd8e9de", "comment": "Malware payload (Dridex)", "value": "e79adf8122d45e66666d7aa86d75fe4bbb83441569745e81c0e5b712d4f490320a4f45fccfd31447d6b58fb2f3b98306", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528249, "uuid": "5ecb40bf-fbf5-4ac7-b47c-b96133a3a890", "value": "F2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528249, "uuid": "53e35c7c-ef86-4dc5-8937-05b7780b0811", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528249, "uuid": "5e0935c9-8834-4db2-8aeb-20e5cb37d19a", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618528249, "uuid": "e5865ff6-ee24-4030-84c9-55d6f37e3d83", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618528249, "uuid": "aaca7d50-8c3f-428c-b238-993af310a316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528249, "uuid": "66c9d8c5-2d9a-42fb-b326-eef1aa53e1c1", "value": "189c3fcee2b3fb0bff1ec69081daeb1dc7b0d5bdba0147dc37b8c2b6c40c34a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63c7648-9e2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520500, "uuid": "4b11e2f4-639b-4f40-b33a-90e32ca3767e", "comment": "Malware payload (Dridex)", "value": "a552d22ef950905a2b79e2747afd8da8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520500, "uuid": "2400d3c8-fabc-495f-96ac-300697dbf634", "comment": "Malware payload (Dridex)", "value": "19011d5e018fe197f02f16f3c5b7eff2a25c682d49717a2919426866e713eaab", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520500, "uuid": "af68e59c-1f69-45a8-bf81-86a8d34d747d", "comment": "Malware payload (Dridex)", "value": "be24025422bb3d44ed9a6cbb8cb06b8e2e6acf59", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520500, "uuid": "367a5e57-41f9-49f7-8048-8fe6340d7b2e", "comment": "Malware payload (Dridex)", "value": "50f3369ab00bd9dde29cea6a05b8fe0a7ec705cc4bbff232bd663b473004457113b9a83637891780e2d364fefd53ca8e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520500, "uuid": "3b114dd2-5449-4baa-bd5e-3431b439d390", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520500, "uuid": "ad348fe5-0f4d-41fe-b45d-4b2c3e97f99a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520500, "uuid": "0cd6ece1-e897-4f3c-accb-fcab8e2f321d", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520500, "uuid": "f2447b0f-2c4e-490a-9003-693148385bc4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520500, "uuid": "d8eaf025-f955-4068-958b-e67f44c00d32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520500, "uuid": "05a6d0cf-8844-4008-85d4-1d181293cd49", "value": "19011d5e018fe197f02f16f3c5b7eff2a25c682d49717a2919426866e713eaab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69568e44-9de4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618488991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488991, "uuid": "2bc8b183-f9d4-4905-b44f-b423f613350f", "comment": "Malware payload (AgentTesla)", "value": "52027406612d657248150c1b09c06ce9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488991, "uuid": "7a5b52f2-34fd-4621-9306-cedb720aec15", "comment": "Malware payload (AgentTesla)", "value": "191c151882f27343472323d62ec2baa97a08edf6c044be4670f77eef76a27d9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488991, "uuid": "74c99979-eefb-49ec-bfb9-9d4701e45ea7", "comment": "Malware payload (AgentTesla)", "value": "5ed9fbebb7c8c030f41f06faf68c748c701f0689", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488991, "uuid": "f2905601-9fd9-44cc-88a3-48f7676ffafa", "comment": "Malware payload (AgentTesla)", "value": "fdf25c4d9aeb36b65f56c3a0a3921c4184e33e54304c5c29d8f187a673ea8eda6dbe52380e28973f255a7f60543c8268", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488991, "uuid": "f8fff5cd-c669-4151-9cae-e35fee9ab562", "value": "E7C423909B46D52B6C45C7612E2F38C8ADF18186D0C397984DD49BBA60FD33F2C67CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488991, "uuid": "22d08ad8-a74d-4242-a6cc-ddcaea75aa95", "value": "12288:fyYm5LIvahULWaRGBDH/Y/XWLVFwM9bvRnV8hzbiUX:KYUL1q3RWH/6WjwMxRV8hzOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618488991, "uuid": "2f681fdb-3832-4963-970e-124dfa757b49", "value": 571390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618488991, "uuid": "19ab6b1a-1e4d-4bdc-a752-fa696c8d4993", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488991, "uuid": "e6da7c3e-ccdf-4f8f-90cd-46936c61fc5d", "value": "PO #4500290652.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7709ffd-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496047, "uuid": "78886695-7274-4166-8065-48f7e3fab437", "comment": "Malware payload (Dridex)", "value": "a542e5e625d7114ec47b59dc294a0ab1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496047, "uuid": "9d1257b5-d42d-44cd-bae0-3864212f5d3b", "comment": "Malware payload (Dridex)", "value": "1956a662a27527bcab54db82b3d688c1b7720515d144b9989e02a968e3be9f09", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496047, "uuid": "a75eea83-529a-4a36-90f1-1afd72e4bbb0", "comment": "Malware payload (Dridex)", "value": "bfb22cf6e6cbd76221b0f791c6965818bba4b3d3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496047, "uuid": "ebb96417-1432-4cf9-a076-34400a6e9d93", "comment": "Malware payload (Dridex)", "value": "6452ad17c44832552b527f49abc9293c421be34146b3651d0b7d3181e8508e162a1a02e2054fea13fe323f0d7cf500e5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496047, "uuid": "e2175a95-a65a-4c15-8454-393595ba9e75", "value": "D7F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496047, "uuid": "39f132f6-8bf4-4e8d-9638-5b6f8067e411", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496047, "uuid": "8c71f433-3581-4c01-8dc3-eab17e84dae5", "value": "3072:1A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:13J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496047, "uuid": "ad17becc-1d2f-4235-b18c-7487af092b62", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496047, "uuid": "0ed2b0a7-e79c-4a5b-a2b2-98acb0781f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496047, "uuid": "ab64e80e-64e1-4b5c-a752-dd9e23131cb7", "value": "1956a662a27527bcab54db82b3d688c1b7720515d144b9989e02a968e3be9f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ffda08-9da9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618463745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463745, "uuid": "eb274370-fd6e-4519-bbfb-f029ce58c2a5", "comment": "Malware payload (Dridex)", "value": "437df9cfbe07be08ba45b5cabd8eb688", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463745, "uuid": "6aa30b7b-6d43-4242-b866-67a7ae041faf", "comment": "Malware payload (Dridex)", "value": "195aedcc463dd1b33f70185d2c231e557642be16af9ef4efc3b22a11e9966a04", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463745, "uuid": "af20ad98-fd4a-44e4-9366-990f1ac2494e", "comment": "Malware payload (Dridex)", "value": "e03b72c6c248fc385916848f1cd9e6316c353aca", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463745, "uuid": "51f9c22d-9292-44e2-b5e2-29b8b962761b", "comment": "Malware payload (Dridex)", "value": "a06b8f22753216ffa5ed4394c4682eac8f061beeb9be78df702f715fb54d8261b00f4ffa572a654581fb609d43e5e87e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463745, "uuid": "8940fa55-07e3-497e-be67-3b03deaa1270", "value": "49249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463745, "uuid": "f68dd866-0409-4bcb-8234-15fa956d9481", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463745, "uuid": "2e497576-68c5-4647-ba8a-b6444bc8cd2c", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618463745, "uuid": "5347b7c4-b7d1-4dfd-873f-ee9d93f8b145", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618463745, "uuid": "0bb7a79c-6170-4152-8a75-e416c3baf110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463745, "uuid": "43ae6b06-9129-4709-a65e-1f19a60291ce", "value": "195aedcc463dd1b33f70185d2c231e557642be16af9ef4efc3b22a11e9966a04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebba9342-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "065b6394-2606-4345-830a-53bd57170fc9", "comment": "Malware payload (Dridex)", "value": "e7e8a5a4d1633071b6eb742d477874bf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "19a14ac5-6ba4-475a-80d7-1a3ff27e363c", "comment": "Malware payload (Dridex)", "value": "199f37d4b200659bcf088146f629306260338c9b791cfc9bd21b148226624c36", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "8b464d17-5d14-4380-98e0-b026ef7c30f7", "comment": "Malware payload (Dridex)", "value": "0418fac61f7c09db0f3dc0dfdbdc904a69f8da58", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496081, "uuid": "277b9d4d-3ae6-451a-90ea-7b8d30c87783", "comment": "Malware payload (Dridex)", "value": "40d69716df43cb47e675ea5cd926ad129e694e723e83d5f2a19938baf010ca7e3f7c93aeebf31c7c881c649e1488f469", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "7b485464-d3ff-457f-abad-5d99d15b618f", "value": "EEF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "18be5585-29cf-4a3d-9a8a-c5b2a5f2bc01", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "dacdbfd6-9810-4905-b09c-9b569a9bd077", "value": "3072:lA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:l3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496081, "uuid": "7735bd83-571d-4377-a271-80dd7260237f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496081, "uuid": "82c12f25-a135-4eb1-a313-ce279fe3884e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496081, "uuid": "f15201fa-cef6-4bfa-bd57-e44ad474e07d", "value": "199f37d4b200659bcf088146f629306260338c9b791cfc9bd21b148226624c36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92305508-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "e02901b9-186e-40fa-ad29-f70c78a8f641", "comment": "Malware payload (Dridex)", "value": "e26b1f3d489e3e7137cdfa4125113869", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "a928bab1-f7b2-4666-9a7d-858ea33c7def", "comment": "Malware payload (Dridex)", "value": "19c667adeaa173e430253b6e27079b914af2933167bb1a28a2699e010408fcf2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "829a14ee-fb78-49a2-ad79-fbd5a74050fc", "comment": "Malware payload (Dridex)", "value": "36f2047dd794f23a762811c492eba370c3fdc365", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "00e1e74c-7511-455d-bc21-2196475e266a", "comment": "Malware payload (Dridex)", "value": "d690ecbc74dcfe1995f5cb23847f4048f1f3cc90b7b233e8afa14418d7f95b72bbcf99bae288b8072d560c298d500add", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "3a37c195-5d07-42a7-a0dc-1b70c60d1eba", "value": "59F3E00AED9FEA88E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "f9d418c8-281b-4861-b45d-c4fd9180f169", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "b37c02a1-bab7-480e-8b4a-f505fdc0bdaf", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495931, "uuid": "01014dd9-e67e-4f52-8a32-64ae487fe92c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495931, "uuid": "355f35f8-910e-4e46-9b1d-035296ca7a9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "b06392c6-9dbf-430c-a1a3-bf68b50edefd", "value": "19c667adeaa173e430253b6e27079b914af2933167bb1a28a2699e010408fcf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34539a79-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "fdb51a74-6190-44bc-b852-df51ec0470a7", "comment": "Malware payload (Dridex)", "value": "1ce79eef1d3f82f23d9a5c6f3f399a3a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "e8a0b38f-ee0d-4f43-93fd-055d3a56a49d", "comment": "Malware payload (Dridex)", "value": "19c6ce80fde18a989b71da349821bfe1857dd0af714984a074b333e741e229df", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "28a66e2f-0c2a-4d78-812f-2ef67611186a", "comment": "Malware payload (Dridex)", "value": "14f6f3c8e935eaf8cc7e4b05682ce634b0a233c3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "905175ac-6449-43de-9b89-12b5acf5c946", "comment": "Malware payload (Dridex)", "value": "df6268f283b2f9aa8fbe9e6b81ef41ccdffbe09d0f33b893fbb2720a3591a25c26186aaef48f5245765a0a6c82c0ba4e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "435be610-60c4-402e-844c-2dd4c919033a", "value": "3BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "041354b8-70b7-492a-a7ec-289a5afcfaca", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "90040b59-7ac7-47a5-803b-18a9a72836a5", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498351, "uuid": "527bbbf4-cc9d-4e09-8d68-5517d88023d8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498351, "uuid": "97fd7eb7-cac7-4211-beac-ecb736303848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "baaeb314-a64a-4d21-9075-da43f86c8c79", "value": "19c6ce80fde18a989b71da349821bfe1857dd0af714984a074b333e741e229df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a1555a-9dc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618477286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477286, "uuid": "31c69d9e-173f-4122-878c-328db53ed17d", "comment": "Malware payload (AgentTesla)", "value": "b492a1ca3de9c40f44beef901fbc8435", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477286, "uuid": "c439ec33-ba02-48d2-84c0-cdb66a39317f", "comment": "Malware payload (AgentTesla)", "value": "1a12c82bc356cec56a15fbeaa972ca5b13c36c5c93c4e37f27815ee582f7cb4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477286, "uuid": "3f48939b-1613-4b0f-80a9-fbb643de7100", "comment": "Malware payload (AgentTesla)", "value": "336fbdeb998653e455fa18d5223abe78c766e1b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477286, "uuid": "0f568033-21fb-4f4f-890f-3261e280fae3", "comment": "Malware payload (AgentTesla)", "value": "568124f5668d8ea95412ce9913150a990c7262de63b336eba78efa515cb0203a22864a2a0878ba223d38740d7cf016a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477286, "uuid": "bb66a780-f58c-45f1-8743-ae4c131366d0", "value": "CCC4234DB217F949E6DC5E99DA4F08196552BAF35D2064A3C8B878CD61C79003FC8CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477286, "uuid": "30b53929-92c6-4eba-9ae8-073880200127", "value": "12288:/JQc4b2Aj87hN/foRs/zi+NLe1ntltfjbdU576HlQY52R76t109M0c28f:/L45qhRfgqfNUfHdU57hYIW109fc28f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477286, "uuid": "c3e288d4-1f36-4631-9d3b-da1541311572", "value": 596451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477286, "uuid": "1d3a8b31-3bc8-4e6c-a58f-c61945865455", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477286, "uuid": "f1d81741-2a11-4061-8d6b-3b3125f6f082", "value": "LifeNet payment 91282196_15-04-2021.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9df54b7-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496051, "uuid": "c56c0489-e57c-46d1-8d39-ce3f14b4fb45", "comment": "Malware payload (Dridex)", "value": "cd55e9f992f2b0d9c055835b432375af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496051, "uuid": "f8924acc-6789-4407-af80-e07326294c28", "comment": "Malware payload (Dridex)", "value": "1a8a97b7c6d5ca09b094aa60186273c7d20944b38fee58e722835b5db4bcdcdb", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496051, "uuid": "7eaccfc6-12d3-413e-aec2-f701a7192f47", "comment": "Malware payload (Dridex)", "value": "d27d2dbafb0382b2a5ca8234c12499b4eb0aa23d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496051, "uuid": "d174571a-0e00-41bb-8339-ec9062836cf9", "comment": "Malware payload (Dridex)", "value": "fecc72c07ee4bb18378959751737efaa8144179c0b82195aaa1cc37b747d0a1f668ec2f0a5de497a671f39af28ca874d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496051, "uuid": "b00b518b-a4fe-4749-a1b9-d2cd5f7b8a57", "value": "DCF3E00AED9FE988E85C51F1CA4D363EE9713E361B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496051, "uuid": "9af0204d-d61a-44dc-8dd7-d44a649edd9a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496051, "uuid": "7ef5910d-6cfa-4b7a-80fd-04586bef7039", "value": "3072:tiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:2eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496051, "uuid": "3b7f4089-14fc-49e3-82e4-7a5010a9b4fa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496051, "uuid": "46a842ba-38e7-4eb5-b99d-0495cf0da4cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496051, "uuid": "1e76094a-deb9-4bb6-9079-8021f8ea3d62", "value": "1a8a97b7c6d5ca09b094aa60186273c7d20944b38fee58e722835b5db4bcdcdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc04eda2-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494283, "uuid": "68d35d1f-8ef2-4172-ab24-9686e140d565", "comment": "Malware payload (AgentTesla)", "value": "19e01e285011a7c258bd070da6fe3371", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494283, "uuid": "ed9fc709-e69c-4dc2-8b06-8bd07cf29112", "comment": "Malware payload (AgentTesla)", "value": "1acc527c628a2aacd9c81d19a9f454646e5a082a6f35db1b8f5834b8d1c8ca5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494283, "uuid": "bd012d51-4f25-4369-a8ef-a94fff6f372f", "comment": "Malware payload (AgentTesla)", "value": "3c1b584d29335f325eb1c0ad63680442e200a799", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494283, "uuid": "2dd66d8b-4ded-491d-8996-408d9646f6a3", "comment": "Malware payload (AgentTesla)", "value": "beda3873a329a82073f25fd8fa9f49fcdf237dededd55a5abd17b071cdd812f9030803f1a9c00312319732568a13c4f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494283, "uuid": "f401091d-1b7d-4be1-9a95-4cad78b85261", "value": "04E4AE3037A9A719D8BF9B740875428127F9FA5AFE01C71D2C94129C9D33A53C722BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494283, "uuid": "14ae5002-2f07-4389-bd8f-a6e8b8704b2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494283, "uuid": "6098fa6c-e4e8-48c4-8985-ea97e8c2fd06", "value": "12288:kYmJCxIt13KWD/Ttyk3KPhUUW9wHdohMd6rTN+/D+4mCrMV:y6WD/T4kK5Up9IdMm0Z+yKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494283, "uuid": "29f61c79-2060-411a-b906-07293043e3a3", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494283, "uuid": "dca736dd-86eb-4d87-87b5-a47be64665f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494283, "uuid": "d11eb4fb-30bd-44df-8da0-63e9338ebdc5", "value": "HL-80996288 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268617fc-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "d63fcdac-3343-4bca-9b7e-ae64588e48db", "comment": "Malware payload (Dridex)", "value": "a6c5aecbfa73e05dd7713c1079abd60e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "f74be735-f248-4839-bfe5-c37b7379895f", "comment": "Malware payload (Dridex)", "value": "1ae35083e5d5ef83259f075312df4c33d619e79cf8960a1876111db5770a80c6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "76dd03d6-43c1-4a44-94b3-13fb106673d1", "comment": "Malware payload (Dridex)", "value": "95f68bc36794143fb9f03f8d42ce259871602e7e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "66c4e8fc-6432-45f9-a62c-4e769cd408ed", "comment": "Malware payload (Dridex)", "value": "2551d7f5d59dcf06e45488bcf9e373586070936039acf700a72c20a565dc7c04a36a3a950ee7713dd15144df39fecd2c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "9373c5a2-c525-4ae8-8244-efba5f2b9e1b", "value": "87F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "2c29c716-edd5-40f1-aa02-5d0f91686824", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "8e2a971b-6eab-44ed-ba4e-0fd31fb8ba0e", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498327, "uuid": "e11e4ac0-e30e-4279-9921-4ad6ae26bf8f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498327, "uuid": "8f71b530-f64a-425a-9173-d4436ed84316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "1152dbc4-14a1-4d4b-9f1f-dd8e85228330", "value": "1ae35083e5d5ef83259f075312df4c33d619e79cf8960a1876111db5770a80c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46df214b-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1618494087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494087, "uuid": "11b44473-efad-4b56-a67b-abe4b5f5ac37", "comment": "Malware payload (Matiex)", "value": "5c25894406d3820f3b0b3c6adcb5e204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494087, "uuid": "0b52a43a-67a2-4d44-b43c-d3cbbf0b3fc5", "comment": "Malware payload (Matiex)", "value": "1af69b5e90ee17eda14504001f969e7c67962578d2ce2bd626516c9edbf1fb1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494087, "uuid": "912c7b8b-63c3-408c-99aa-24d4d454183f", "comment": "Malware payload (Matiex)", "value": "baa68917ea59a1125e5438a21d02a2ce317c5dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494087, "uuid": "9d4d49e6-09f7-4204-8ba7-9cd3bb3028f6", "comment": "Malware payload (Matiex)", "value": "e1588d964c420db64e6684bbf2d711eb6b2f362ee1eaa4516a4954c76e4ddc7b73abc16f86ca304a588789c4f00c80c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494087, "uuid": "edb19b17-3b6d-4af6-9617-3b887a1f7da5", "value": "15355BD722B46E16F0BE5773906330C493FFAC47DB16C2AD3DD150A92D62A81A62DF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494087, "uuid": "86dbbc0f-3be8-4d09-b42a-139dcda977de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494087, "uuid": "b344fb5a-116c-4a5c-bc2b-b81a65e40e11", "value": "12288:unlvoMIwz4TbXYDaF9UZnxNIsbO7gtAtz6fgolu/WzySKRq6NBp+:uJGTbXkLNDbCg2z1huypRq6jp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494087, "uuid": "bd61431a-7011-4106-9b31-f2d9d9dad1d8", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494087, "uuid": "7dfe3cba-3c49-4ca8-aab9-26005d66eec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494087, "uuid": "7eeac6a3-8512-4d62-875e-38076075c041", "value": "New Purchase Order - VINEY2104A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4995b1-9e05-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618503035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503035, "uuid": "a16689c7-2ec3-40c5-96b9-bc6949a95a08", "comment": "Malware payload (NanoCore)", "value": "54c5610c6b5c27ac484e642131c79cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503035, "uuid": "38f14b89-d966-4ebc-8485-2246ecb9ceec", "comment": "Malware payload (NanoCore)", "value": "1b8204f5eea52251f4ca22fb3f589ae3906ddf03b97cbe57c15b282421734157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503035, "uuid": "32a762a1-da22-4a63-a155-8213f00b636f", "comment": "Malware payload (NanoCore)", "value": "1cbd6ca2950ba8018cf6a45a60f38752883140c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503035, "uuid": "5fa345c5-4396-4890-9193-84d180678eb5", "comment": "Malware payload (NanoCore)", "value": "861e42553f63405610ad0d354f4193ea8c357595d11c08e9669ca99764f345dd5a545f18a36a6bb631197fc3ee9fd60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503035, "uuid": "e4b0ac6d-1bd8-476b-9ce9-ae333241cc03", "value": "270501516A5CFA5BC86D1AB5C4A085B243736257E369DF6FEC9E40C80EE0781F91C3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503035, "uuid": "ae3ec018-5b49-41b6-8f92-3826b5893b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503035, "uuid": "56f48cc8-7ba6-4c10-8ae0-c40a73530a18", "value": "12288:kOD1dw99/PtZZLhMlllfvnDBTLzn+CqTAhh3jZ9F3V3/mxokhdGShHVEXL:FDX8Nt/LhSllfvNn+ennvmxokhdnHOXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618503035, "uuid": "48cd03e1-cdcc-4891-8a6f-6fa9affb84a1", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618503035, "uuid": "a1f8a5f4-0b60-447f-ae90-a0d33947d058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503035, "uuid": "654cbaef-48be-4aca-884b-914ca4216085", "value": "54c5610c6b5c27ac484e642131c79cd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db47e11-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495870, "uuid": "4538ab97-2f31-477f-958e-cde17bda4a87", "comment": "Malware payload (Dridex)", "value": "3dd5d9d65b3a06051d834809dc5b4efe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495870, "uuid": "8f23bb97-ee35-4e89-90fc-ff3b9174ff6c", "comment": "Malware payload (Dridex)", "value": "1ba156f7fe99694278912d238466b3454b2d183fc98e3c0f50f3d5de9129b21b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495870, "uuid": "19b9fd52-9430-41c7-92ed-b54b06c015c1", "comment": "Malware payload (Dridex)", "value": "786e2e633a756d6aab8f950e233907f11dc7f497", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495870, "uuid": "79002902-dc36-47b3-b035-e8155a672d92", "comment": "Malware payload (Dridex)", "value": "f01ef88a431b46c9f5b6b082e4d4748dbce0f7a4dde212a8eb556d83efb94f3d8848e227223b32c8d580f64dfbfc9fb8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495870, "uuid": "50fd08b0-68e6-4565-9601-290e416f4774", "value": "08F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495870, "uuid": "0c6ff50a-5886-41c8-b05f-95e7e745724a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495870, "uuid": "3bbc2a15-a783-43d5-90a4-6526e2ac321c", "value": "3072:qA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495870, "uuid": "4a7da1af-da45-40e8-9089-d0ad3c58ef1a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495870, "uuid": "21614ef3-7b8e-418c-a80a-d3b89516dfcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495870, "uuid": "66d65088-a728-4737-8c3c-32aee58e0cda", "value": "1ba156f7fe99694278912d238466b3454b2d183fc98e3c0f50f3d5de9129b21b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb818a8-9e33-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618522824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522824, "uuid": "17356b69-911f-45db-93e9-cfa58ae4cf63", "comment": "Malware payload (Dridex)", "value": "0c10b383afd60bc2bad7b63843c172b1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522824, "uuid": "36311d2d-3879-471c-ac42-df8f2a14a583", "comment": "Malware payload (Dridex)", "value": "1bd32c311a36d3e1da1be01bc7b0eeaae58ef1dba54348f02ca80e84bfc6fc44", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522824, "uuid": "b194a0f4-b012-4559-9716-9648c73d1891", "comment": "Malware payload (Dridex)", "value": "4fd6a88a714e1d32e4738939f49d0174d6c62682", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522824, "uuid": "f83f6a3d-077e-4f94-bfa2-111ad3bd2ed3", "comment": "Malware payload (Dridex)", "value": "6866efa1f97d511381fd63752f4e7858951c6c017bf74835d4530984b5c70544cb697d81d9cf85db805ea4e5626a9e24", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522824, "uuid": "76ca2bfc-b388-4983-b459-eca31440f9af", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522824, "uuid": "6d05c845-1ff0-4f6c-b2b2-e3105ce872e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522824, "uuid": "9bab5c5d-4340-4b91-bd51-4622ebe449b2", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618522824, "uuid": "d3c1401e-7491-4367-ab3a-603c1654640b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618522824, "uuid": "00c9a358-d355-42a4-984e-73fc54ddd416", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522824, "uuid": "df53d5a9-5780-4fa8-a485-b927af62a358", "value": "1bd32c311a36d3e1da1be01bc7b0eeaae58ef1dba54348f02ca80e84bfc6fc44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138e9dae-9e2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618519770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519770, "uuid": "15b5236f-8894-44ef-914b-d84bb5f29db2", "comment": "Malware payload (Dridex)", "value": "458879470166b3754f82e6182bdc226b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519770, "uuid": "5d86775a-5a48-49bd-8254-f50db581f123", "comment": "Malware payload (Dridex)", "value": "1be24c3a7d5bbac4a909791ef5ba672d72461a750a71c20be8938a1bac3b1ec6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519770, "uuid": "b294faaa-e5b7-4cf8-b8ac-c8a70ff14e26", "comment": "Malware payload (Dridex)", "value": "00b12704416eeccdbe6a82bef44f417f3a304b16", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519770, "uuid": "35f47d7b-b3f4-4dec-ab10-aa940766cb53", "comment": "Malware payload (Dridex)", "value": "3793096dc798f2953dbc169bbfd55f1d7e6a44e60e4f52a7eda2bb50fb5022e4275d653df06f52b68acfa8c7140be347", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519770, "uuid": "f90e439f-db3e-45ea-add2-402e2a2f5735", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519770, "uuid": "00c69458-2db5-4c83-bbc9-edf9d008d6bb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519770, "uuid": "b5377cc7-9736-49e7-b473-a6850dd74128", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618519770, "uuid": "a37b53d9-6496-450c-9096-58e7efcccb66", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618519770, "uuid": "5e680d44-f2ea-4f31-89b3-ffca24961cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519770, "uuid": "bf2b8889-3a23-4f89-8073-4e2f39d25ea0", "value": "1be24c3a7d5bbac4a909791ef5ba672d72461a750a71c20be8938a1bac3b1ec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8857ebd-9e33-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618523027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523027, "uuid": "dca7514d-ff44-4455-befe-6495ec4c410c", "comment": "Malware payload (Dridex)", "value": "447351ac7b02f4ae452d31afe41fca1e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523027, "uuid": "6a42239b-d9a3-464e-9706-964bdf008ded", "comment": "Malware payload (Dridex)", "value": "1c1fb03b21c364d75559c4ba65ed02af2001026d0666d1e47c7cbbed20a01baa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523027, "uuid": "bd303a8c-d30f-431f-bd27-3144e495c05b", "comment": "Malware payload (Dridex)", "value": "cf5e12874bd3f29503457614b6202ccdb37f378d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523027, "uuid": "c60b3b5c-11bd-4d2a-8b8f-dfba353ca780", "comment": "Malware payload (Dridex)", "value": "b4635283b1049cba66534046c939fd3a0f3a12d6a90d9f7fa12cc763496d4e7de3041e4d8de2950b54858512433e8fda", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523027, "uuid": "fc811e16-8c0e-444a-a472-cecabe190ec0", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523027, "uuid": "52c24c10-5ba0-4b17-be0e-c34e3f126935", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523027, "uuid": "8d00e804-33fc-456a-8aaf-d9f228333108", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523027, "uuid": "4eca1f7d-1107-4542-9f57-ba86f654b248", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523027, "uuid": "e7782a8d-d8b6-4672-a2a5-407bf2948fca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523027, "uuid": "d8d14bef-c84b-4c4a-ba39-45272a5ac8f3", "value": "1c1fb03b21c364d75559c4ba65ed02af2001026d0666d1e47c7cbbed20a01baa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e855bc-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497016, "uuid": "cd3086f5-ff0f-45ae-80ab-a7efc1d85933", "comment": "Malware payload (Dridex)", "value": "da39fd8a6b1fb0a9d50187f0516ad431", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497016, "uuid": "6bfe046d-6a19-4d3d-af05-ce39c1f161e4", "comment": "Malware payload (Dridex)", "value": "1c37a99af40b48973a3eef834af04ae15c0706eb1637af39ebaae200a9544f72", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497016, "uuid": "3b21d235-7c4f-40c6-88cb-d51914fffa35", "comment": "Malware payload (Dridex)", "value": "f56752dd1b409bf1b3f4dfa878bf8bd38e522360", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497016, "uuid": "3b3272fa-02ee-49b3-a7eb-dae17bd4a8c8", "comment": "Malware payload (Dridex)", "value": "d09e07bf2a5a23fa7d049f3d61702c58b7bc45faa7be6309650f25512e6eda5f46105bfb9573ace20e3c840966ec8fc6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497016, "uuid": "76f79ebb-304e-4f88-b3a9-cb7e1ecf6ad9", "value": "7AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497016, "uuid": "75efdffa-dda3-4d5b-acdc-9b1feecfafaf", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497016, "uuid": "5dfb6b2d-09a3-499a-a1ad-7d041eb31a2b", "value": "3072:riFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:IeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497016, "uuid": "5496069e-3f37-491d-bbfe-8e2532009333", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497016, "uuid": "9fa03e67-65b6-4de2-8f55-42b4e2944cb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497016, "uuid": "35e60413-94ac-4d7d-b39b-0cb1a05f7657", "value": "1c37a99af40b48973a3eef834af04ae15c0706eb1637af39ebaae200a9544f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffd283c-9e40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618528462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528462, "uuid": "7ecb500f-3b0f-4c26-85b1-fc266b8bb924", "comment": "Malware payload (Dridex)", "value": "f5d7d9d0e0fcafa8a781f187a65b8905", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528462, "uuid": "30134fc4-544f-49eb-9fe0-fda7c48be3ed", "comment": "Malware payload (Dridex)", "value": "1c7e8430378381d3a6b0a04a8821b376992d858e1421487b4168542f88b1de30", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528462, "uuid": "085f2689-8ae1-4cb8-a017-e65b0cf6634d", "comment": "Malware payload (Dridex)", "value": "b5ba2782d962a4eb0a877bcef048de82ba0b02d3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528462, "uuid": "bd3aad46-f7f5-4635-a135-d426130f57d5", "comment": "Malware payload (Dridex)", "value": "63d95f59ecca3e7bcfb645c816a13c3cf8f64caf7bff9dc415268ae4d9afe1ae1f32a5f17894c9b4a7d55adb65006a95", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528462, "uuid": "2e5f657c-ef38-47d4-985d-88e8003bb58c", "value": "FEF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528462, "uuid": "15081cc8-c2b9-4a16-819c-3b3d4d8c8ed3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528462, "uuid": "76341705-26b6-4bec-949a-02da02138693", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618528462, "uuid": "9ea095d6-7e5e-4a39-82d8-1628058455a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618528462, "uuid": "ae53041a-2b26-4258-895f-e40a438a3f6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528462, "uuid": "7118ce47-4d1f-4cfa-bb72-f20d6b743024", "value": "1c7e8430378381d3a6b0a04a8821b376992d858e1421487b4168542f88b1de30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987a9b8c-9e32-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618522570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522570, "uuid": "cfed3aaa-638f-444a-84f8-b8630b76b461", "comment": "Malware payload (Dridex)", "value": "fac2dc616d1bcbe6048c3b1dcf364864", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522570, "uuid": "414ade75-dc5b-445a-9636-1854fc55de95", "comment": "Malware payload (Dridex)", "value": "1cf2c6b49197662608e61d9ce76d274d6d2faf9ac73b6eae0af28a72a0b5bfb0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522570, "uuid": "65627958-4094-4240-bc59-18685329f12d", "comment": "Malware payload (Dridex)", "value": "4b439f4c9bfaef0c3f0feea631f7016337ea7745", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522570, "uuid": "aff6f7cb-03f9-4b95-8d3d-834dd661fc23", "comment": "Malware payload (Dridex)", "value": "8e1ecc3d80ccedc387e9e553ff06a94f651db122d0a2b29c9ccb325620f055a8031b09ba647af330e59a1677f6b4b490", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522570, "uuid": "68a3c95e-f31f-4213-902d-260a4e365266", "value": "46F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522570, "uuid": "82fecc1e-e10b-4e18-80ea-f1357f01aec1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522570, "uuid": "83036158-6689-48b9-98e2-253bdae1b0e4", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618522570, "uuid": "3f3d5150-6060-4c40-875c-a7bcbafa0724", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618522570, "uuid": "feb54f94-3155-474b-be74-b93809b676a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522570, "uuid": "24dc3b74-4a02-4bcf-9b55-f6a857eacf10", "value": "1cf2c6b49197662608e61d9ce76d274d6d2faf9ac73b6eae0af28a72a0b5bfb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dad2a19-9e02-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618501883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501883, "uuid": "8f5cf66a-a9ce-4ee1-a5d3-9ec0f6da2657", "comment": "Malware payload (RaccoonStealer)", "value": "8aece0be80642056ffbe8536d6a0afe9", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501883, "uuid": "3848caaa-e1b0-4987-85f9-e953254cbdf6", "comment": "Malware payload (RaccoonStealer)", "value": "1cf375fc2caa68f520a626542f6b285bcd8ad66f93cac008bd9d2226e5641fcf", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501883, "uuid": "fbe1c77e-34a9-4664-87d1-e5e27991514c", "comment": "Malware payload (RaccoonStealer)", "value": "3cae63a3da5393bcf21f46b89a53fd87ff4a3eb6", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501883, "uuid": "b1717200-f1be-4d81-a9ea-26b4d6275dc9", "comment": "Malware payload (RaccoonStealer)", "value": "db8562c8dc504f189c14167eef17eb2eb3151731065373341664a7f43d74b894319ad1b03372c37e49e8353fa4620fa2", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501883, "uuid": "f5b7206e-b351-45d7-a552-a31a5335f076", "value": "C5B4010137D1C472C9A329768525CBB01E7AB4311966268F7FD92BFC2F357E2A72434A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501883, "uuid": "287f4b68-2568-42e3-a950-f5885e5736d8", "value": "e05089ebdc79f6153676cb08f724c74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501883, "uuid": "f8576580-f432-4415-9b72-72225caede96", "value": "12288:1dv0UW2GfVZOtwhGAPsWxJv7IHR796VrDEDfO2HK:HvE26VZekyE9MHRxErDE7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618501883, "uuid": "8e3151ef-4d54-4799-8345-b4300e1b2732", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618501883, "uuid": "40482c30-c300-4f64-b4f0-a659610ed416", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501883, "uuid": "354d8e27-029b-43b3-987e-695677209043", "value": "SecuriteInfo.com.W32.AIDetect.malware1.509.3654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319ee424-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "00ad4b6c-5aa3-41f4-9aae-d669c1e7c70a", "comment": "Malware payload (Dridex)", "value": "a19e4ead5dc0e692429ca0753ecc4d10", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "0c7428e9-bd6d-470b-a865-7d91455413d4", "comment": "Malware payload (Dridex)", "value": "1cf8ce769c89950ec4d2839a70a1c856cbb08e5f2eea310523af2f0c31e3ff7f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "11969d04-58f9-490b-8614-400307414dfc", "comment": "Malware payload (Dridex)", "value": "0a0f72a8afb69452cc6cfe298703a5806b4b228f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515955, "uuid": "f1e90d45-758b-44f8-8dd3-2260d3b2e0b5", "comment": "Malware payload (Dridex)", "value": "2c9d4f3dc09ddcd78383f12960bf7cd1ec740676709ec9cf8d39cd9d86eda06942519136592924a0f0b1133d7f189b43", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "a66e326b-8c4e-4e98-a3a7-7e81413940d7", "value": "32F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "dc9b3470-2fb9-41fe-bbc9-1eca4d04c277", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "dca00aa0-4d7b-4b58-80a6-03381f0a0fd3", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515955, "uuid": "e0f29236-ddf6-408a-ad71-e09e87deaf45", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515955, "uuid": "ffded361-70ae-4cd2-8492-bac22e0dbfcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515955, "uuid": "1cad1eff-e4cb-4234-b7ff-c39b1154381f", "value": "1cf8ce769c89950ec4d2839a70a1c856cbb08e5f2eea310523af2f0c31e3ff7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6c0d64-9da6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618462209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462209, "uuid": "127fd5e2-511a-4bc9-9ba7-0b9b8a25f07d", "comment": "Malware payload (Dridex)", "value": "87e752e7b44e283aecb30c3cb6947112", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462209, "uuid": "49435d81-9245-4e6d-bb26-51b8452bc75c", "comment": "Malware payload (Dridex)", "value": "1d3e595ee0cc905032c63d97c843c363d6d76ed40fe40219147a6d6a3d953ec0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462209, "uuid": "6a93074d-5d5a-43ba-9d41-0cfef2dd7e24", "comment": "Malware payload (Dridex)", "value": "a285e1e09463f449768c0947921a1ea60d7814a3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462209, "uuid": "30bfb58a-237c-49c7-b093-59ef085aade3", "comment": "Malware payload (Dridex)", "value": "2fd0f4d74aa001da102b3d632e10d5ebcf057a1b317970a640486ed53c17e7f86be58356b11889bd0adeae5c5fce3499", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462209, "uuid": "6b7be5c6-bb67-4d89-9ba8-61e637a9be4a", "value": "1B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462209, "uuid": "c15010ab-cb32-42da-9040-06626ef0dca9", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462209, "uuid": "6a0026b5-5e49-4138-836c-1c4a778ef5a5", "value": "3072:k0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:PpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618462209, "uuid": "4049940d-858e-44ae-b963-41d1259d849d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618462209, "uuid": "fa12b10a-e805-48fb-abcb-c204b7b9319b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462209, "uuid": "2be5fe56-6eae-4d13-956b-386682218625", "value": "1d3e595ee0cc905032c63d97c843c363d6d76ed40fe40219147a6d6a3d953ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a340b153-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "5b6827da-f17a-41ed-a2ce-42eb663b38b4", "comment": "Malware payload (Dridex)", "value": "e0909b085378ade3b94dffb15ba59218", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "b7acfede-b6ae-4eb5-821f-d6324cb5ead4", "comment": "Malware payload (Dridex)", "value": "1d3f3b981123fb594a1a7b4c0b93d907b97efc81edc9dee7ce2c3b9315f67ac0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "e4b370d3-9b94-42dc-82ef-9fa3b9d42599", "comment": "Malware payload (Dridex)", "value": "73e0bfcfee43d73b3bf99a1bf0932a09b7fc9ac5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "3f96e170-a127-4dfb-8cd8-4609ab2a29ae", "comment": "Malware payload (Dridex)", "value": "79aa4398491f2daf4b6caef850d466ede3bf280bb7027edde11ee4c0c126593e9dd74810c2ecf85d723f70ecbe6e56eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "ab1c24a4-40ef-4ca4-a8d6-3a5b88acee1e", "value": "90F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "cfcce215-7fd4-487f-85ed-64990bf76310", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "2852f74f-59f3-4c1f-ab50-fa10df5efcae", "value": "3072:CA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:C3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498537, "uuid": "1b8bbcaf-1ea9-4d27-beb2-f20dbf46c982", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498537, "uuid": "6db6226c-5b4e-41dd-85d2-2915b871370a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "bff2f36f-ae6d-49c9-993d-17f2b1f0decc", "value": "1d3f3b981123fb594a1a7b4c0b93d907b97efc81edc9dee7ce2c3b9315f67ac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb73e42f-9d80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618446286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446286, "uuid": "2879a11e-c38d-4672-8846-1417e94788dd", "comment": "Malware payload (Dridex)", "value": "75fb848343ff5e842ae1cebf62a93a0d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446286, "uuid": "b87aac9c-9c6e-4b36-973a-f4af0596b1b0", "comment": "Malware payload (Dridex)", "value": "1d52f3c98ddcdad65978eed896221a280224ac769c6929fbc581906d5b4913fb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446286, "uuid": "04e56c49-e7ab-467d-be53-0455493c14a9", "comment": "Malware payload (Dridex)", "value": "e991e627c586a3849980906deb51befca26921db", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446286, "uuid": "c3264914-b1a4-4ddf-9404-93a7746f1113", "comment": "Malware payload (Dridex)", "value": "a6cee7c9b0974314da23a812901e94c092b84691e94f6818a0d5b87e09b450cef3e7848251293d07f2761dbe6a215aa8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446286, "uuid": "f023a5da-ed6d-43bf-8a1f-c3cae1fc24e0", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446286, "uuid": "c0892fab-cb77-4878-b5d7-ebb46238dd9c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446286, "uuid": "681672fb-449b-45a8-b3ef-85c6ceae9a75", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618446286, "uuid": "a9934dfd-bbe5-41c7-9bc0-ebc4f61b051d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618446286, "uuid": "b9b2a818-c77c-4d1c-a568-a4abd02b24f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446286, "uuid": "d4ddf431-8582-405c-beec-a733617b7c64", "value": "1d52f3c98ddcdad65978eed896221a280224ac769c6929fbc581906d5b4913fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394c230a-9dc6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618476025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476025, "uuid": "cc73aed1-e04a-4a56-874a-a9e057fa2737", "comment": "Malware payload (Dridex)", "value": "b7f3aace58abd2497ce27497076976eb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476025, "uuid": "c8371ac7-ad75-4c55-9b5a-6e991d157588", "comment": "Malware payload (Dridex)", "value": "1d7d9b71d2529a9356f215728c27c2eba97f33f7240e5b23d5c014d40311cfb0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476025, "uuid": "78fc1d8c-c6f5-4a82-a15f-640a684b4d20", "comment": "Malware payload (Dridex)", "value": "8943f06e86540d15e72de15f3221018e89972aca", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476025, "uuid": "737f8175-f161-4b4a-ac81-1380d2b79b23", "comment": "Malware payload (Dridex)", "value": "1440946a43611c1dbf7a84e87941fc8775466c1628f4fde6ed19f1f40c5e9cb4bd841a4641987097596853adf43933fd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476025, "uuid": "6d0d21b3-4ec9-47bc-bfa4-a6bb30d1e359", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476025, "uuid": "4f5ea502-6fdb-4b18-b90f-bd04212bc4a3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476025, "uuid": "cf100ab5-cc9f-4bb1-9ada-693f9c9bb727", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476025, "uuid": "e918bf1b-958a-48a5-8ac9-1d80ddd32cc4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476025, "uuid": "7a76ded1-f73e-4549-8c17-0beac548ebef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476025, "uuid": "5b9bc2b7-c118-4d5f-8eef-d2cf6996f0c8", "value": "1d7d9b71d2529a9356f215728c27c2eba97f33f7240e5b23d5c014d40311cfb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6f9bc5-9e2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618521369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521369, "uuid": "b7448f8b-8fbc-49ac-9789-78c969f41fe8", "comment": "Malware payload (Dridex)", "value": "b6859d34de3f7fdedf250c175f10f222", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521369, "uuid": "1e7ffeaf-20d0-4c8c-8fd2-4e69afd9ad03", "comment": "Malware payload (Dridex)", "value": "1da7bd2bb60b23f0f10f8cc012bef595ed5a27283f397fcabfc017dca2d1466f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521369, "uuid": "b37aca45-9c69-4b5a-945a-e6a0d3f4e45b", "comment": "Malware payload (Dridex)", "value": "81f25548b8359b426a6cb4c504e979bc6760dd74", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521369, "uuid": "78a41c4d-2df3-4fba-95af-2b2d3e1b4a6a", "comment": "Malware payload (Dridex)", "value": "058e4a2189d83c51a5c9a5fcdbebab708e91cde87852aacd275e14bd38a94fd72d4e9c9a5935d9392866840434015756", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521369, "uuid": "bf496001-e587-433b-a726-61c53f226a5c", "value": "7AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521369, "uuid": "be05abed-a1fd-4bee-9d9e-8839f54a1039", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521369, "uuid": "644b72e4-ab91-4cd2-b09e-8929f0b3963a", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618521369, "uuid": "d31b223b-696b-4748-a689-7c1e0c9f4133", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618521369, "uuid": "3c446e0c-e251-41d7-b8d7-25e7ab53caf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521369, "uuid": "ef6ae65a-5d0c-4dc2-ae16-81942f4d4f8a", "value": "1da7bd2bb60b23f0f10f8cc012bef595ed5a27283f397fcabfc017dca2d1466f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde0c21e-9dcd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618479361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479361, "uuid": "a63c33a4-4575-46e6-85a1-84a50e7dd829", "comment": "Malware payload (Dridex)", "value": "7a6f9f7ad80cb7d8fc31d1aab3284731", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479361, "uuid": "e539778b-6b83-46f0-a1cb-72e08fd46f80", "comment": "Malware payload (Dridex)", "value": "1daf5d63b665cb274237dc60a7f4e789bc38dcb8f26c7620cb6b5e76673e33f8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479361, "uuid": "9f116106-542a-4fbd-b0a4-bb7d8b8e91c4", "comment": "Malware payload (Dridex)", "value": "5a9f3a79e9cd1d508e19929183351c37e854805c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479361, "uuid": "ae26cf0c-a04f-49b5-b399-93f332f18fc6", "comment": "Malware payload (Dridex)", "value": "8e03a2b350ad09cffb74f2ef7019d409bd21199b259b6e6af6643eb9cff6c92876ca10c6bafcbd8867bb865df8bd7637", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479361, "uuid": "16e39ffa-c2a0-41b9-8206-bc4de7638ac2", "value": "5D249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479361, "uuid": "c4a57161-daef-4c9a-9720-fc20ad67af2d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479361, "uuid": "8e9d1814-31af-485d-aad3-423e8198b890", "value": "3072:a0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:5pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618479361, "uuid": "19774045-935b-4b0e-a65f-1dd345cc2308", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618479361, "uuid": "4c2981f4-e0ec-42cc-b124-7b1d19e08e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479361, "uuid": "815e8a80-c194-4f10-92b2-0ee5c2a5d524", "value": "1daf5d63b665cb274237dc60a7f4e789bc38dcb8f26c7620cb6b5e76673e33f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c25d6a6-9de5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618489505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618489505, "uuid": "cdd821bc-5396-4b92-8423-95f9567241b9", "comment": "Malware payload (Dridex)", "value": "6fa24f5cc2d7892527e2bd6bb5b13bab", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618489505, "uuid": "2bbb7b58-f5f7-4f8f-b607-8e97923249d0", "comment": "Malware payload (Dridex)", "value": "1dd8c6805656492e4bbc9eec9e41f936e2561598efeb2a45dfc4b05afad2b3b9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618489505, "uuid": "28c5505f-2f81-4d03-8ecb-c96375b0be42", "comment": "Malware payload (Dridex)", "value": "fc7238082a4ebe43b6c9a2b3d47963404bb9fd93", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618489505, "uuid": "8e77d5cd-cfdc-4777-8289-2906fd568572", "comment": "Malware payload (Dridex)", "value": "b896fdbde2c295e965982e165c9631299134c9e8c2c5d072d4f5c0ca9d07899ea4f1b49ddf8aedc3a23b394d2bbcfef2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618489505, "uuid": "ce217958-87ed-4e93-a2ca-66aa69ea3902", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618489505, "uuid": "1b71facd-8905-444a-b910-e65d3b24f556", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618489505, "uuid": "9383b4dd-245c-4c97-baee-f82daf1b3b7b", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618489505, "uuid": "8a278791-1f20-4f56-ad4f-c62469935abd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618489505, "uuid": "45a8f472-9970-4a62-9b00-eefecb1278cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618489505, "uuid": "ebf659b1-4878-4830-8179-8a14adffb52a", "value": "1dd8c6805656492e4bbc9eec9e41f936e2561598efeb2a45dfc4b05afad2b3b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f913bb-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618494350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494350, "uuid": "cb1e548d-723d-4d55-b20c-1bb10b6c26d7", "comment": "Malware payload (SnakeKeylogger)", "value": "c6f26315e927bf5c6764a5b8740ab06f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494350, "uuid": "5c33958a-4921-446b-866e-63deb419a1c3", "comment": "Malware payload (SnakeKeylogger)", "value": "1dd94a5613c355e764ae8a58e35064355a8803e55fb5b7e386bb4b19286e7f07", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494350, "uuid": "f05a8518-b96b-4913-be09-6c7831113b15", "comment": "Malware payload (SnakeKeylogger)", "value": "3bbf84238fe0e42d06be6f6abd9296a61fee6832", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494350, "uuid": "3e78ee80-eda3-4e49-b467-2f4671b82492", "comment": "Malware payload (SnakeKeylogger)", "value": "83c06590c44b2157770f7b939c17f6055a10a178639be7fa73f84b790aa09b08488bcdbd3044fcd367fe94c24dc5aa02", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494350, "uuid": "f8d37dbb-e20f-4883-80fa-dae8d364d2cf", "value": "6454E00E4544C609E85A5E30157E7B3807AB7FC62925EE49BC47B2BBCFF334065562A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494350, "uuid": "b5daf605-d22d-40d3-85d1-838e3ec2bd7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494350, "uuid": "b610b0ea-7e24-4bee-8718-6a4bcffd83d5", "value": "6144:L+QPvU4mGH+MbfSaQShYIziJr++oYfwTiTRFXJDxro:LbAGJffQVx++oYfwyRJNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494350, "uuid": "948eb293-025a-417c-ae89-6a8e2058db6c", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494350, "uuid": "25ac8957-ac57-4ecf-aa71-018b0da5d8ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494350, "uuid": "38f29f2c-3603-45c2-9ca9-c0bb9f80edaf", "value": "SecuriteInfo.com.BackDoor.Wirenet.557.31235.1829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2426b50-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495985, "uuid": "3c3dad34-13c3-4126-93fd-bae3f5a75b81", "comment": "Malware payload (Dridex)", "value": "3b94f5dadd525c9ff8cf71aa36422930", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495985, "uuid": "245dd65e-fc92-46cc-8c71-e00953bf3a49", "comment": "Malware payload (Dridex)", "value": "1e24c425874a7ce69bd54b098cd7f48bccee6e6478a7861efe93124a5416e46d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495985, "uuid": "ca6f9354-7924-4122-b63d-529586f479ec", "comment": "Malware payload (Dridex)", "value": "88004eef72ef04270b5f82aeb6cd468e7d324cbb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495985, "uuid": "d06fad50-5ef8-4ec3-b2cf-b17c98281a1a", "comment": "Malware payload (Dridex)", "value": "f1a424cf61bd2a4c83542c086397f05e04d51d94429e436558073071df8861c0f240224478b31b8ce7e35fddec286105", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495985, "uuid": "8ed74e1c-78fa-4994-8806-6f48f0d1b4b2", "value": "45F3E00AED9FEA88E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495985, "uuid": "0b01472a-8962-4b45-8487-335ee9cd573d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495985, "uuid": "328136c5-7f0f-485e-842b-087473c89c31", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495985, "uuid": "c9af8cfa-e5ae-4f79-ab4c-058b7f6977c5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495985, "uuid": "9ddf7c20-c816-4966-ad7b-763cdffd0423", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495985, "uuid": "907ca1f3-2245-4640-96c5-a8a67f8758c3", "value": "1e24c425874a7ce69bd54b098cd7f48bccee6e6478a7861efe93124a5416e46d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be30d9df-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618514903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514903, "uuid": "ffb7fbcd-d756-44df-bac5-c814356fea7b", "comment": "Malware payload", "value": "8b917f8b6a485d7c65553781b09366e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514903, "uuid": "32e4e827-41e6-4c9a-980f-2e4fc8982057", "comment": "Malware payload", "value": "1e42bc2322c26c4e870f59c7e9d177784491fc695829ba26ca3d21ea419f4c44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514903, "uuid": "f9baab47-8880-4351-8754-73e61de79278", "comment": "Malware payload", "value": "50705943aec7b2abf8f797c8ec017a742a01c4ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514903, "uuid": "f1bef10b-f09d-467d-b65b-9a19c78b7eb1", "comment": "Malware payload", "value": "adb0c71785874e75dba9cac1c9b1de651cb5226027daa07eba57634a4e651b2262edc4d2d12fd3d951bb0082d6f1e48c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514903, "uuid": "fe3c0134-8da4-4816-94df-f5199565e3a6", "value": "10D2AD06496DAC71EC37E3905CB7E2924F3E6480B13672A5DFF6C261C5E88185AF472B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514903, "uuid": "ddb9adba-30f9-4eae-b7b5-0d7e36d58154", "value": "192:BPDxgJoGKtBRhmI3mvTS+dCcdQsmnUQcwLtJBArYg+b38GWZGZtjuCf07Z86g85A:Brx1tOT7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514903, "uuid": "f7520bfd-47b3-4127-ae98-4f3328bf84e3", "value": 30576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514903, "uuid": "b43b432d-0002-4a2e-b416-bf89f0a7adb6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514903, "uuid": "42c8397e-217a-4e2f-9d9d-175b38c0e1f1", "value": "ID2089873702.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4c1dac-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "77ff1ccf-f26c-4556-a220-10f6f5d59bd5", "comment": "Malware payload (Dridex)", "value": "2b38472362b7169789630c88de41c29c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "af5d99a4-fef1-4e79-bb16-9e2f4cc337b3", "comment": "Malware payload (Dridex)", "value": "1e5073b5fec2eee427e8bca00a2c896c1b9846536edc47da07d79483b37bf348", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "76d30f04-8c5d-4193-8c4a-c5c3bb100807", "comment": "Malware payload (Dridex)", "value": "adcd93c450b710fda277a95f18aa836124ab00b1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "52d57627-5a64-4eac-9374-6fe0863fbe17", "comment": "Malware payload (Dridex)", "value": "69587998f1e774d8441b5171d19edbef501d32ee898b5db5f7be158947652b233df5666850f8f5a6c1f6c44b05b57993", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "497395f9-4157-49a0-8beb-09d2b48e9ae4", "value": "51F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "29563e0a-c4a2-49be-9103-03432645541f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "2755310f-b6e4-4e1a-8209-2bf89187deb1", "value": "3072:HA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:H3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464169, "uuid": "2d302f19-b25e-4afa-b967-abd895bc4eb0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464169, "uuid": "86d9789c-cc5b-4142-88fd-2d9e2a220d61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "e2200a55-2a7e-4e22-8c43-472b5b02013e", "value": "1e5073b5fec2eee427e8bca00a2c896c1b9846536edc47da07d79483b37bf348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd2c72a-9e17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618511094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511094, "uuid": "ebe6ce81-1ee8-4699-b865-42f2a85ef519", "comment": "Malware payload (Dridex)", "value": "cc7b9e34c459bebbede7d6252d2833ca", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511094, "uuid": "aafe8e9c-ae80-4501-b1de-d512ef9c9ae3", "comment": "Malware payload (Dridex)", "value": "1e7c7a9722f39e6fb90a8a01942f877a1f130949b4a3344612f184295102e4c4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511094, "uuid": "4ff1d873-f520-4c99-aadd-8ffcc0540313", "comment": "Malware payload (Dridex)", "value": "bb0766807ee525de33c8afa1e2c7b909bf0d043b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511094, "uuid": "3ccebd25-6d91-4da8-8c7b-b50a5bcb1ead", "comment": "Malware payload (Dridex)", "value": "20250f5a6223636ab3a19ca08845c5ebebb584074fb6ebbee9808649c2e6e0775a68843b7e30db1b4685b45c51f08b60", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511094, "uuid": "a9e2f864-51e4-46ef-9903-ec8b39291026", "value": "B9F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511094, "uuid": "9dc4eb81-443b-455d-8154-f3d1927d10ef", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511094, "uuid": "7ba0de38-f554-4086-a434-d1244a9e1946", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618511094, "uuid": "8737c36e-13d0-4ecd-bb84-791cd38034d3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618511094, "uuid": "d379f389-664b-45a1-b98f-8fe099d880c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511094, "uuid": "6e0369a5-b9af-4afa-af77-1d3eef122e33", "value": "1e7c7a9722f39e6fb90a8a01942f877a1f130949b4a3344612f184295102e4c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d63663-9dfc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618499189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499189, "uuid": "dc1b21a6-5cf1-4a10-936a-a62d4e3ad02f", "comment": "Malware payload (AgentTesla)", "value": "27085a9ae919a7788a095bcfb924a3d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499189, "uuid": "25d9338b-d982-459f-bedc-3329f43e2599", "comment": "Malware payload (AgentTesla)", "value": "1e7e7a04e0bc2afbc4055f1f6a9d4d5c53afe4ae0d36bc87c8b6b30fd1d6e5f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499189, "uuid": "67e0e980-65e6-4b71-b159-85370e77de15", "comment": "Malware payload (AgentTesla)", "value": "f42817f5512c5823776596a1160e4517cc39121b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499189, "uuid": "3281b78b-1dbd-4dbb-ae24-ce65bbec0b71", "comment": "Malware payload (AgentTesla)", "value": "27a6ea19a6da050190a79f6363a9c43f8a3f91072bf7156cc19a919c57a0b750cc9e0abf2cc9e9e2a6c313ed78d78fca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499189, "uuid": "c83ee019-51c8-4b5b-ad15-c3b19ffb27eb", "value": "5C056A6131B79659D6E95F38509D1E084EB1AD026923E70C1A6670EF0BF27C38F1EF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499189, "uuid": "9e2b18fa-0b55-46a3-923c-0f5295a1cf1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499189, "uuid": "cd135f07-fff9-4ffd-991b-3948e7eff099", "value": "12288:3b9LBfAYb6k6QVNgbk+2//uJFEoCUIPTqKnOUeMWqK:3b9LWI6k6QVNcy37oCU8TYUeMWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499189, "uuid": "fa174859-5286-4cba-84a3-dbea91721ecc", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499189, "uuid": "c4a60184-90ba-4ee9-8749-f056f14577d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499189, "uuid": "37ced046-d80a-4ce8-8fdb-350f255aa55c", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c56bade-9d97-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618455790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455790, "uuid": "ca80cbdd-2343-46ab-9ab6-c5d26f8573af", "comment": "Malware payload (Dridex)", "value": "dfb68db69b385ae2e63ecf4402a7207d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455790, "uuid": "7263c093-5073-44b9-8c2b-86bb7bab3234", "comment": "Malware payload (Dridex)", "value": "1eb102213f8c3fdf2547d6c69de257516168a6558a1b42425c59cf00abc95358", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455790, "uuid": "0f0ffed5-f0db-4628-8aa9-2ab09646c4dc", "comment": "Malware payload (Dridex)", "value": "d71575ea908dd14159c6b3d1110562053a06bb80", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455790, "uuid": "2ea430ed-3d75-482e-8e50-aaad6305ec98", "comment": "Malware payload (Dridex)", "value": "8e7776a2587bcb17df51d75debbf62a382c01fb9acb99ef858e06aa99c42b7b23d5237b13e0763acff962c7344769790", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455790, "uuid": "c0e06ff5-fd2b-4bff-a2c1-3eb74917b8bb", "value": "E6249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455790, "uuid": "b6192290-ffb0-4716-a182-e9960afcf8e3", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455790, "uuid": "320deb40-36cb-4e12-85fd-c4e1d6fde779", "value": "3072:K0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:JpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618455790, "uuid": "91ad065c-2776-4f9b-b316-7bb2840aa2a9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618455790, "uuid": "a2fb4029-cb3f-4400-80eb-46b471815c39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455790, "uuid": "17fef7cf-e1c9-4aa2-b50f-478ffad3314e", "value": "1eb102213f8c3fdf2547d6c69de257516168a6558a1b42425c59cf00abc95358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f278fe-9dd5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618482698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482698, "uuid": "f5c65b60-878c-4f7b-b7e6-2322a9606bce", "comment": "Malware payload (Dridex)", "value": "f47316cf99a0c70fc29fe2b945427c83", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482698, "uuid": "0f02a5d9-5409-45e5-8a8b-719785033b6c", "comment": "Malware payload (Dridex)", "value": "1ed5d86773bb34d1e23566b779c45eab1d118dd8fb72a8af21d597e16127d3ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482698, "uuid": "70cdf191-9f72-4705-8207-770daf721bea", "comment": "Malware payload (Dridex)", "value": "4888d8117fa77afe6ccc846098f699a3473ad281", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482698, "uuid": "650fa6c0-a76a-4780-a229-c4960a44fb06", "comment": "Malware payload (Dridex)", "value": "3d69b2070dd6efaa3f24230f7212b5d83ef2155f3f3b0055e82dbad8ac9162103d15aaed9bf48aaba984b3fcd1394c6c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482698, "uuid": "348889ac-200c-45c0-9a75-a951d19ea3fe", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482698, "uuid": "bed082e5-6d69-4213-b9c6-de2e9dc13dd5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482698, "uuid": "c96c9177-457b-4894-bbc3-a52ef0d64435", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482698, "uuid": "5e7483cf-e3b9-4d0b-a4d0-7a5f898b078b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482698, "uuid": "75c7d029-a408-4c53-8c73-ccb9b7d23a3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482698, "uuid": "51828c4e-8953-43ee-81f8-eb999e0d2539", "value": "1ed5d86773bb34d1e23566b779c45eab1d118dd8fb72a8af21d597e16127d3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ddcd1a-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "5be6a304-67e4-4ec2-bf3e-a943cbe5837f", "comment": "Malware payload (Dridex)", "value": "ccdc0deae2864a2f43ede77e456befbf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "eda57a8b-27bd-4675-9821-49446f2581eb", "comment": "Malware payload (Dridex)", "value": "1f030c6a539273c9e63240eb121ed3e1f8a8111d6b486f9be8e8a94635575f61", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "22e7ddca-9b74-41e3-9650-1774539f27a4", "comment": "Malware payload (Dridex)", "value": "3b62e044bfe091f01c4b2e0229cde0682cf2993d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "8a58b3e5-17f1-4ecc-9e00-f925718222ce", "comment": "Malware payload (Dridex)", "value": "d944cbe930c5c4841ab9aa2054344998631886261e2c34f698f50c9baccb80a0092359d21cd703ac0df0701bf7bfea32", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "875977db-7f30-4d28-ae56-1b23e99ed27a", "value": "2CF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "b2dabab0-8faf-49c0-8a94-4ed8dfec4196", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "a59d7365-e4ad-4618-aa86-1169eea7db67", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515929, "uuid": "e220c907-1148-4f3a-9099-cca38868d737", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515929, "uuid": "a3eaa1d3-0522-43e0-b9eb-981d4e04d606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "c94f6234-9738-4a95-b9dd-d5280b11e087", "value": "1f030c6a539273c9e63240eb121ed3e1f8a8111d6b486f9be8e8a94635575f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9b2a38-9dc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618477235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477235, "uuid": "b46c7aa9-8212-41bf-964d-2561b93feee0", "comment": "Malware payload (Dridex)", "value": "1d5f80319d24de7b0a7961690680eb27", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477235, "uuid": "f8197252-a647-4d76-91e6-f947fbbe5af7", "comment": "Malware payload (Dridex)", "value": "1f2382e224e47b3ed757ed4046a567971bfce99105cd848112539c98a37318e3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477235, "uuid": "696d7c1f-336c-4d64-92e2-1f9b87b51999", "comment": "Malware payload (Dridex)", "value": "e6f089c389a0dcc1d23742873c045597a4d5a60c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477235, "uuid": "1120062f-8014-4793-bab3-f59f3b30d2f0", "comment": "Malware payload (Dridex)", "value": "50308e0b4a24457439d86347d0bc7a82ae24aedc8151e4ed1dc02cdc356634b1df6e84a72e40dd04215d3f4c694bfcd3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477235, "uuid": "5008126d-396e-497f-85af-3715e4f246f6", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477235, "uuid": "c7f59c1b-5354-4973-852d-5b5cb86ff570", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477235, "uuid": "fa809153-afe1-4c97-ab37-34a3f39886ca", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477235, "uuid": "246ac2ab-8ce4-4f5e-bc2e-a23937aa4e91", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477235, "uuid": "e8852513-1ca4-43f7-aacb-da889307143c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477235, "uuid": "e5a562ed-da95-4ea9-8975-df62c17571ee", "value": "1f2382e224e47b3ed757ed4046a567971bfce99105cd848112539c98a37318e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42aa5f87-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "e9c70107-e04c-47c7-a6d6-7349cb21866d", "comment": "Malware payload (Dridex)", "value": "f817c801e6b3454828f2582eb2b60247", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "e9152373-4114-46a3-a313-4f356f4f7bdb", "comment": "Malware payload (Dridex)", "value": "1f266cb6e28e5c6dba094d9fbe3a6e3db5fdb12f74ad94d360cca3a2ec9d3eb2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "20a47edb-5c4b-487e-acd9-9e5a13a81d3d", "comment": "Malware payload (Dridex)", "value": "774d2ed7a0fd1e2765d82cfd803bfbd7c9f0b5c9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "b6ed81fe-ac6b-4f86-a562-6b9ce79241e4", "comment": "Malware payload (Dridex)", "value": "056d7f5082831dd5a7d77a5e75207d17c187671a73650dfe7b7fed05aa6d98bfa10ededd6c070df5b9a88be6bfaa6fb3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "7be9d5b8-f4a4-45ed-880b-887aa73414a0", "value": "C9F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "bcb08560-7332-4c09-ae31-42b75249e5fe", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "92137820-5fce-4296-8baf-0d93ba30c9f6", "value": "3072:yA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497086, "uuid": "f50e262e-e51b-4ccb-a5b7-5ed812d3f60e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497086, "uuid": "9f05facc-a1a0-49ae-834f-73f26719daa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "e716b991-de2a-4e76-8166-d654856893e4", "value": "1f266cb6e28e5c6dba094d9fbe3a6e3db5fdb12f74ad94d360cca3a2ec9d3eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52321728-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618498830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498830, "uuid": "ab79b12f-a417-4594-8657-1985dbc3c662", "comment": "Malware payload (AgentTesla)", "value": "845b936644da5b09a9489fb45df99b77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498830, "uuid": "727bd11e-4f38-4198-929f-759b7d5ed14d", "comment": "Malware payload (AgentTesla)", "value": "1f44c8727e54ebeac242dbb6b823672fb304a2e7b210002c7aaf061a5451c30a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498830, "uuid": "702d4724-4f15-4fd9-8952-b2ea1bbeb278", "comment": "Malware payload (AgentTesla)", "value": "1d8582603c50f25686b0dbf2cc6d114be80ddbe1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498830, "uuid": "a0db594a-7c03-4b13-9c49-cb6f1a4d7cf1", "comment": "Malware payload (AgentTesla)", "value": "50a303805f51df365f7cccd816b8405c12201f7ad6c3bf7f95c54f23ca7d26c18ead31c1e51ba7adfbeafb43b59c4ccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498830, "uuid": "4eebf808-f271-4f0a-a0e4-9d5ec6795b4a", "value": "E4056B012388AF6DF07C9B756464A70587F0AC06E328DAE97EC774DA0C7DB46DB5260B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498830, "uuid": "47710fe0-cf69-463a-9665-7ad33966b2c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498830, "uuid": "35dccbc2-d697-4287-b77c-2c609dee5586", "value": "12288:b8lhiWEDr8DvBbV5YYbnO0khHfccBbF3uk3NIXxBWT2vpkoyK5WZ:b83SQvtV5XbO0khc+Yk3uvprJ5WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498830, "uuid": "c96b4186-b8d0-4031-9318-e3a30f3daa3e", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498830, "uuid": "a5e19ff2-4b8f-4f51-b944-dfc163cba2d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498830, "uuid": "95c66336-9fa8-4f91-ad3b-c8562ee5545f", "value": "845b936644da5b09a9489fb45df99b77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13015341-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "ace93ec5-9e96-48ea-8ecb-9909781d5c64", "comment": "Malware payload (Dridex)", "value": "5c7ea66cc37e38b1f8e43f12884ebab3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "ef3afa57-5905-4570-a7be-fdea97614e4b", "comment": "Malware payload (Dridex)", "value": "1f73e18f6ff007dd50f546dc04a296b487049b674f42ba18e4304ccbf570d325", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "deeb8574-c114-4b4f-97e2-f7b72870ff15", "comment": "Malware payload (Dridex)", "value": "c335d88b16c2e1b6294f430477cd96069f6c1777", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "c524e402-fdb6-4b5d-9e75-0b86038b14d0", "comment": "Malware payload (Dridex)", "value": "65a2516f2819e35cb85abe79e892f08a562b28aa8d2b54b0cac45cbcb99a5422d122b8659d843b8d14e4326c5bc6bb5b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "0ea000f6-b44f-44b3-ab12-bb161579876e", "value": "6FF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "4e2502ea-3db8-4e62-ac98-c6e60ec79a95", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "e4f8decf-87cc-4e04-aaec-47de2956b113", "value": "3072:YA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497006, "uuid": "1d6951dc-73b5-4044-886c-a14742ca2241", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497006, "uuid": "dbe2f529-ad67-41d5-800c-eabeabf7e50f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "bc58e7ea-fb72-4468-954b-a28be52bc78b", "value": "1f73e18f6ff007dd50f546dc04a296b487049b674f42ba18e4304ccbf570d325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce76734-9e0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618507653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507653, "uuid": "bcaecfa4-13d1-43c9-9bab-3958cbdf9b05", "comment": "Malware payload (Dridex)", "value": "cebc8c7677ed85b1dc97a3ef325fb29e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507653, "uuid": "5e2ba336-2406-4dbe-8505-29ac43d7b7d1", "comment": "Malware payload (Dridex)", "value": "2002357f98ded6196e88cae54cc79ef419c4e1ed5bbba01a57b26cede3cf869d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507653, "uuid": "0dfe2af7-0d4a-4a51-9957-21e77fb10051", "comment": "Malware payload (Dridex)", "value": "782772905c79ae25ce6d6fbeea5fbc9e3440e340", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507653, "uuid": "088a1868-8677-43ad-b2c4-4e46118491b0", "comment": "Malware payload (Dridex)", "value": "9c6a166afb1c0b0aaf4bffa4e45d5c2326403c0b5c83fd8c940a938668030f856bdccc1bf3c6cfcaf22e9c9699a9b9bf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507653, "uuid": "d531565b-597b-45a4-8d4f-7b7a2f18db71", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507653, "uuid": "0229b956-c431-471f-bf3a-8e6e35c6750c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507653, "uuid": "dea7442f-f292-494f-ba97-652137b62a38", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507653, "uuid": "8f61841e-2fd9-46a2-b12e-59d41c156289", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507653, "uuid": "6fbfbe73-593c-40b3-b29e-3d8048cf338b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507653, "uuid": "9de00a52-f051-4987-a1ed-3217d0bc3da5", "value": "2002357f98ded6196e88cae54cc79ef419c4e1ed5bbba01a57b26cede3cf869d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d49e8a-9e38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524925, "uuid": "1c5aa9b9-8c4b-49d0-a0c9-39c4bf4f5949", "comment": "Malware payload (Dridex)", "value": "dbe3b1e5bd64f19c15d2f8ae30dbebbb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524925, "uuid": "a7b9953c-7216-4726-a375-7acd61f50b8a", "comment": "Malware payload (Dridex)", "value": "20545b54a49046068cead7ba7c198a327e2529e4f556c7b8dcd96e5aca3e58c3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524925, "uuid": "35a262ac-4d9f-454f-ad3f-91ef87c2381c", "comment": "Malware payload (Dridex)", "value": "21eb176d06735810796971e7671dc02235195d03", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524925, "uuid": "e8cabc30-9b07-413f-8aaf-bd0b6720b99a", "comment": "Malware payload (Dridex)", "value": "b434726236cc606f2aa039d4eb9de9821b00e4b90aa812219d86a9b5f3fb6e3623d41e8cb9fc0f01aa32db3b1149aef4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524925, "uuid": "0d53e9ff-69e7-4368-9925-cc441fb1571f", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524925, "uuid": "7443c9b2-c56c-40bf-b949-a4c692c9b9cb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524925, "uuid": "b58cf106-a753-40ef-907a-5300823ae00c", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524925, "uuid": "66b2bcc0-e70b-487a-8650-f9a9c1cab01f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524925, "uuid": "3e3a1b03-0744-4d64-97ef-18858e8ce679", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524925, "uuid": "b682ef6e-bd9a-4717-ab59-c7aeabf8e735", "value": "20545b54a49046068cead7ba7c198a327e2529e4f556c7b8dcd96e5aca3e58c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8184779a-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "c17f1c30-8fab-4fb3-af47-2109549fb881", "comment": "Malware payload (Dridex)", "value": "69c2195f38f6a3cc589960684398e36e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "c6217750-0bfb-4328-8fcd-bac27eb6529c", "comment": "Malware payload (Dridex)", "value": "20832aa48103ac30a14069c635c702cb7b059bc488049857136427ff0a49513f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "8a956f80-d986-40fb-b66a-5165654f5028", "comment": "Malware payload (Dridex)", "value": "6871d326a9b86d498fde9f8375e8b08aa397e772", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "79c9bbbe-dc84-4150-8eff-5f3ea9ca37e4", "comment": "Malware payload (Dridex)", "value": "4310a69d89f4a5eb8263efd96612f736fe02ca387f1ce105d17722a25a72a22c453fd40f9b783b6040cc22f3e45e8c87", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "384b44e4-8cd2-46c7-a0a0-45a66e839bbc", "value": "FFF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "802838c1-ac82-44f0-8388-de0d6b5d575e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "e0cec783-29a8-4fb5-8652-8ad4a4448455", "value": "3072:YA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495903, "uuid": "fb51921c-b1f8-46ba-a986-04be2f528b03", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495903, "uuid": "8a278a3c-d116-4aa2-b83f-361631bf0b3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "bd75c63e-3f8c-43c0-8e99-b3786cf58143", "value": "20832aa48103ac30a14069c635c702cb7b059bc488049857136427ff0a49513f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30becd3f-9e39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618525403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525403, "uuid": "9a226f13-c34d-4078-a7ef-39abdc51aaf2", "comment": "Malware payload (Dridex)", "value": "40b2887df20c68bb640c008c28c04a98", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525403, "uuid": "08e8e23c-8618-4933-9646-e387515fa5cc", "comment": "Malware payload (Dridex)", "value": "20a19f1dfafc81e48cff6cdf389c22149e16c10d853c7397833fb70aade01de6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525403, "uuid": "bd2745b5-4457-4ae4-8ae2-1c58a383d665", "comment": "Malware payload (Dridex)", "value": "6f4ceaf5894b73e148ee1e056def077b87260ccb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525403, "uuid": "0272f459-0126-4331-bc84-2d042310ccc2", "comment": "Malware payload (Dridex)", "value": "9ebe6ae044ca912ac033c28ea1d179ab7ac4899da7b3c406a89a5494975d92d8f87c693345222ce7e4951bea880e898e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525403, "uuid": "d47b262b-0e02-4f55-bb3f-e6f8d35b60b0", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525403, "uuid": "629d7225-c097-4581-b26e-3b0ef73888b8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525403, "uuid": "1bf24f4c-cab8-425c-9011-59d25de3d3cb", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618525403, "uuid": "c76d9b20-dcfb-46e7-b48a-94e27b28391f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618525403, "uuid": "adfe2a03-4fb8-43ad-be90-cadfc8389c04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525403, "uuid": "cab2f272-4439-49d1-afe3-f06ea0e27a7e", "value": "20a19f1dfafc81e48cff6cdf389c22149e16c10d853c7397833fb70aade01de6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1969d64a-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "22613406-95c5-4722-80db-dc327dd7a226", "comment": "Malware payload (Dridex)", "value": "30a9c7502122be5f1e899695fd5969af", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "ccb38f2d-5209-45fc-b73f-6cb1b55c7b5c", "comment": "Malware payload (Dridex)", "value": "20c812c72ebb25d0bce051dd68020f3ecd8ed15d2d82d539a62661f8bc9bdfff", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "8c60754a-4b1d-435e-a33e-759f5491bd02", "comment": "Malware payload (Dridex)", "value": "47a9fc02af8e4949daa26092868dcfcd63313d89", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "e982ec3e-0588-4299-8cb4-219ccebf8516", "comment": "Malware payload (Dridex)", "value": "f8170c32756628b3f03d9c63fe174433da46d20a5a40f77d874871370de6f632005213a5d1d5b554033de3467dc8b3e8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "dd51482b-a2f9-468d-bdd3-b8aa678a8e11", "value": "B1F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "2cc12f60-323f-4f19-83c2-eb37f6201f38", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "15a80477-ec83-42cb-a304-35d1883f3204", "value": "3072:jA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:j3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498305, "uuid": "fd4ed433-80fc-466b-855b-5562d410c9b7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498305, "uuid": "07bbc696-a09d-4e95-8b29-f9a2704ab76b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "9330783b-5252-410c-9369-54f928f7f164", "value": "20c812c72ebb25d0bce051dd68020f3ecd8ed15d2d82d539a62661f8bc9bdfff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7adaf7-9df9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498123, "uuid": "033f42ab-6ff6-4e92-89c5-30e5f16d5962", "comment": "Malware payload (Dridex)", "value": "9286a7a2dac0ebd93440356353b59dbf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498123, "uuid": "f3041c33-1419-4913-8532-e8ea930fc603", "comment": "Malware payload (Dridex)", "value": "20dd40dbc14c8c24f64cf1ce4a2feb9d6a9da339a4306a535c4b7f155b2d2fff", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498123, "uuid": "107b3563-28cd-49e0-b1ff-e521dab0d353", "comment": "Malware payload (Dridex)", "value": "70115041508d430209bcea263f9e5312e46a9489", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498123, "uuid": "389f08fb-b64f-411b-9b3d-b08f7bc6ca70", "comment": "Malware payload (Dridex)", "value": "ffce018662deedd8199d25a5bbc367b922c9352c28ca87575ba14f6a5152e647158eca70b185f92bfa32ba47528fab60", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498123, "uuid": "1e1d6d87-081c-4131-a98e-ba0c2a982ddd", "value": "63F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498123, "uuid": "1e5c1bd6-ea66-49e5-892c-48c877ff74a1", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498123, "uuid": "27e1b9df-9f53-404c-bc1f-af56c8f20bcd", "value": "3072:/A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:/3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498123, "uuid": "96754fb7-f928-405e-8b72-f28eb971cf85", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498123, "uuid": "189b2f85-93e7-453f-935f-088283c0ae62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498123, "uuid": "97318123-deea-4c6e-afda-8c988a915d79", "value": "20dd40dbc14c8c24f64cf1ce4a2feb9d6a9da339a4306a535c4b7f155b2d2fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb47684-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498336, "uuid": "553904b8-74dd-4514-a0c5-b3b541a736fd", "comment": "Malware payload (Dridex)", "value": "263d5f825f62f7b7b59c7e3747dbd335", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498336, "uuid": "0458296b-9d85-4563-bd37-ea0e7ae57f53", "comment": "Malware payload (Dridex)", "value": "210bd6938973b98b3407219f772d123330b1edcf729d8dff847f6f7a4477e50e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498336, "uuid": "153582e3-b370-4a37-a1ea-c43df47a64c6", "comment": "Malware payload (Dridex)", "value": "abfcaab6d8735060dd16c65e7c4aa193004f583b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498336, "uuid": "4aecb6f9-c09e-4a5c-921d-88bbb2102eaa", "comment": "Malware payload (Dridex)", "value": "f89a2c957b79af0adf75aa83c05ae9cba13bc0104a0eb4454623a76b85ca1872f80e6140f0d1fd62387253a02b607742", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498336, "uuid": "5d396d0b-2a21-4cf7-8969-03d86fa5db52", "value": "6CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498336, "uuid": "aae6dc7e-1878-480b-8c48-f550edb988d5", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498336, "uuid": "8b45e5a5-9291-49cf-ad9c-47c7d1087e1c", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498336, "uuid": "ef713982-7aba-454c-8393-98ad2b0ff585", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498336, "uuid": "66ddfd67-6c7d-4159-bae9-06612c04185e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498336, "uuid": "04ac000f-9c1b-4cba-b4c0-51a6c89a2c27", "value": "210bd6938973b98b3407219f772d123330b1edcf729d8dff847f6f7a4477e50e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9fc39e-9e39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618525554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525554, "uuid": "20cb7841-84ea-40cd-9899-89225d55f4c4", "comment": "Malware payload (Dridex)", "value": "a601a8deb6a0231b1830cd8db37acf6a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525554, "uuid": "ce8c68a8-5f27-4820-8a1f-7cde7b89a7df", "comment": "Malware payload (Dridex)", "value": "217084c40c95f479dc6b9c0484ab1896b49cb0567cd769fbbb0ed855698c29d6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525554, "uuid": "9a2d42aa-9993-4d24-8fa0-9e676ea70716", "comment": "Malware payload (Dridex)", "value": "c27f58b8bb4eafc148c53f1bf0e370cbb598d03b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525554, "uuid": "290213c8-5905-44bb-98a6-79d26d94db7d", "comment": "Malware payload (Dridex)", "value": "c803cd1b44313128f346bdd27b5b084460506b7a6f9de85d2d007899d543466a16e6e1b92fee84f76a74d24419214eae", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525554, "uuid": "f68fb225-890b-430e-ae99-905d2dc1d074", "value": "73F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525554, "uuid": "00e84d2a-97d1-4add-8a3a-5ba813dcb74d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525554, "uuid": "0c140f73-c4e7-404d-8901-a1ee92a04118", "value": "3072:NiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:WeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618525554, "uuid": "0669720a-e698-47c9-afbc-f9b9a33b2c6c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618525554, "uuid": "c428d2d8-3f5b-443f-bdc3-dd9383914b11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525554, "uuid": "b0a80c0f-d7d5-4f65-8aae-133f775c91c0", "value": "217084c40c95f479dc6b9c0484ab1896b49cb0567cd769fbbb0ed855698c29d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b72382-9dff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618500767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500767, "uuid": "1091c493-2a4c-4736-945d-2bd9735f5f6d", "comment": "Malware payload (Dridex)", "value": "1db1e10797f7b7b005f46cded79e9113", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500767, "uuid": "452023a2-3a68-46c7-85ca-d5c8d1894f19", "comment": "Malware payload (Dridex)", "value": "21d312f8b46b26d867a4e9c24087a2b4a0ea8252927b9b5a66aa540c0a4509bb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500767, "uuid": "8a3327d7-1acf-4b73-8b50-07c62be3a785", "comment": "Malware payload (Dridex)", "value": "a80f70232feb9b9b92a6bd57ce4edb8ecf28fe73", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500767, "uuid": "7314b31c-01ba-4b76-97cb-132bc59e7e6f", "comment": "Malware payload (Dridex)", "value": "4acc7025d836ee7af15d6576376c6c5d65f2571675e186b3ad85d1125c3e1b8bec18fc96bc2362f0c9b786faa9bde7eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500767, "uuid": "2dbbd05a-1879-488b-a56d-7154351afc1c", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500767, "uuid": "bdc9c0b7-020b-4be5-adbf-886691ccc091", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500767, "uuid": "3360696f-5aae-477b-93aa-a85384456421", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618500767, "uuid": "679aa8d9-482d-418c-ba8a-5316bf6eedac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618500767, "uuid": "2b4eec4e-d932-4e94-b211-58edae7bc479", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500767, "uuid": "13bb50b9-0fc7-4c55-a80d-a83881eaf825", "value": "21d312f8b46b26d867a4e9c24087a2b4a0ea8252927b9b5a66aa540c0a4509bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39424b11-9e13-11eb-abe1-42010a9c0039", "comment": "Malware payload (XpertRAT)", "timestamp": 1618509096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509096, "uuid": "cfe09591-361e-444c-9907-ae4d250e2bad", "comment": "Malware payload (XpertRAT)", "value": "bde5cc055efbc8779784a94811e3e5a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509096, "uuid": "9a6be6f2-fc9c-4870-b7fa-59a87cc66c01", "comment": "Malware payload (XpertRAT)", "value": "21d8f3869dae855f7ddb202eca9bc170074ab405c7741cbd4ffb48960494234f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509096, "uuid": "726f892f-7bc6-448a-8cbe-e8625949a123", "comment": "Malware payload (XpertRAT)", "value": "629afe08ffe9d3660e7fd3918122af70fa49a5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509096, "uuid": "cedda8f8-b1b7-4e1c-8472-6eb1084097d9", "comment": "Malware payload (XpertRAT)", "value": "1c08b0e80ae7c2953b4ee70493b58fc58a3980b87202983ce4ef6e9fc8729b17746fa39348f1bcbb023ea549f51be44c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509096, "uuid": "535f3dcb-008d-4e9d-b1a6-cd32c0649f2e", "value": "D1757CCE3270BE9FC497CD3385553CD0A6A9BC66870BD217A09316DCAE1D946DF086E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509096, "uuid": "64237cc6-32de-426d-81f8-6ea48c7cd1ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509096, "uuid": "0e7d5a61-d848-4a3e-be6e-818594920ebe", "value": "24576:OA6uymey+IUTw+ucXBK5I+FUf5GTbRUjyKqyrQxsX1HDr4MIhq6jgck+:yN5G6ZqyECppc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618509096, "uuid": "7c7bd8bb-b57a-4bb4-ac8b-e209354e4a60", "value": 1551872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618509096, "uuid": "891e0acc-fb0e-4b72-ac62-341c16bd6b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509096, "uuid": "a31d3e49-f492-4206-9bb8-d3fc08e4fc31", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db142257-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "a8f9f82c-a24e-4dc7-983b-a203c4f741e1", "comment": "Malware payload (Dridex)", "value": "489360a8f32875c5ddb39363110abc4d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "1ea6134c-5db4-4f11-91fb-aaed231b4cfc", "comment": "Malware payload (Dridex)", "value": "2244a959ebb72fe8420f5ed251200cd228cea0fd6d15781b0c2007fcd81722b1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "2663fd2f-10b0-4ba0-8807-2837f35d87fa", "comment": "Malware payload (Dridex)", "value": "e0d69086a1dd6e09d194a42138587d1c131feaee", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "75516857-847c-43a5-b76c-774281977cfa", "comment": "Malware payload (Dridex)", "value": "e4281aa1a50d2f58b946cdf6847d5bda5bc79e8417954d8689ac516014e6114ebb9520adba14f8dcb3946175e7ad8a6f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "19e7fdb2-3b00-44cf-b422-5be4690258d8", "value": "0CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "2dfe7057-8ef9-4d5a-b17b-b4a709d7308f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "d9f6dd37-4f85-46a7-92c0-f3c98dc75c44", "value": "3072:3A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:33J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496053, "uuid": "7f88523f-e91d-4c98-a1ea-0d79e0d7859b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496053, "uuid": "4564ea6f-590c-41e7-8768-8ff32c25cceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "b5aea726-c126-4eb0-b52e-14fbe109efcc", "value": "2244a959ebb72fe8420f5ed251200cd228cea0fd6d15781b0c2007fcd81722b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a09a904-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618514332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514332, "uuid": "8b5272bf-a6a9-419b-bbeb-7214feb6c032", "comment": "Malware payload", "value": "86382982793e72c743d6472dfb573711", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514332, "uuid": "47f4454d-7988-4abb-a817-7d862b6d6437", "comment": "Malware payload", "value": "2249b2e62706cb8ae5fe283b8bb50c81c59db98d128854e939fca6f07b2dd369", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514332, "uuid": "b4c269af-ea89-4a8e-8503-0c86577102e5", "comment": "Malware payload", "value": "88de51e28f74664c1560af6aa6232e6f7af4a9c8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514332, "uuid": "5beddbef-e0ae-46c0-887d-bc908dee7b6c", "comment": "Malware payload", "value": "36a8fdad59d5ffc7700d681b4f33815da638e4d9d27523102457a8eb972e26610e32404f0a530779a84f22cbcdbfc550", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514332, "uuid": "31b39698-aa36-4dcd-b963-2ec51a0e9ed7", "value": "E185F1E832485EE6DE959F865F59348D1633FB3849DC48C4F09DE3BD1B9B3829A06183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514332, "uuid": "7577e2fc-11a4-4c94-ad32-5e378bcd7dc5", "value": "24576:AelRelRelRelRelRelRelRelRelRelRelRelRelRelRelRelRelRelRelRelRel/:AWWWWWWWWWWWWWWWWWWWWWWWWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514332, "uuid": "ae84942f-f1a7-4d42-97c2-8326701b8150", "value": 1716500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514332, "uuid": "05a017fd-eb4e-4a73-be67-349a3b5fa869", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514332, "uuid": "961797af-d6c7-46bb-82de-8badd18c746b", "value": "TT-2021BR04IS15.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed0649a-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497133, "uuid": "d9df91aa-1822-4e87-8dcb-2bcad2128fd3", "comment": "Malware payload (Dridex)", "value": "17fbd8adf517029671a80cd418701d67", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497133, "uuid": "7c06ddfa-a1e8-40b6-9312-38603f23c96a", "comment": "Malware payload (Dridex)", "value": "2270021350181aa03f32a83e733908403c73dab70f306b1c8d064dea5cd055d7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497133, "uuid": "37f18d12-b931-4115-a4fb-eedab549d80e", "comment": "Malware payload (Dridex)", "value": "738dfd69e71674cbee240e47be83366c644bca3f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497133, "uuid": "546065ac-f817-49cb-b7c7-9ba3e4ce602c", "comment": "Malware payload (Dridex)", "value": "2b78cdd0ad345da684716c9b8b1652ce3156f808e76af6dcf42b8d03f669b2a4402f4c67dec93324a18175664f144bfe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497133, "uuid": "f73a0a6f-5441-46a1-aa3f-1707bca44a78", "value": "93F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497133, "uuid": "21ad966d-9f34-40d7-abed-675462477f28", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497133, "uuid": "814402fd-22de-4e8d-a1fa-8cd46d4d5e57", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497133, "uuid": "e3ca3b9f-a208-4e57-87c9-33e8e1de29c8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497133, "uuid": "cd1bec6f-5c7d-48f9-bf72-173138a20dac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497133, "uuid": "7dbc76fe-cd88-499b-9909-f13810e5b787", "value": "2270021350181aa03f32a83e733908403c73dab70f306b1c8d064dea5cd055d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6ea2ef-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496054, "uuid": "c8ac4979-4670-4a54-908a-59abf4a97e60", "comment": "Malware payload (Dridex)", "value": "ebd953c8ff28469afb4db4c4a5dbc695", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496054, "uuid": "3fd50c20-834a-4965-b85c-5407acfc4ade", "comment": "Malware payload (Dridex)", "value": "228a93345faa8a2fc30f972069edadc7a16dade35c2636a166f567fe494a1a6a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496054, "uuid": "24b5ad67-ab54-412d-8910-d7dc8622a502", "comment": "Malware payload (Dridex)", "value": "3854a8d3c792b7e4f91fbc8925a66af1f8e21802", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496054, "uuid": "0e855324-0e17-4b2c-897a-b750e0e17e35", "comment": "Malware payload (Dridex)", "value": "836aeeb28740b01a6a2ffb0a6bdefaaa70982143c7499305793ea7338a4ee830833634d606f20f9d58bd4243dd1ef264", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496054, "uuid": "f5ab6c11-cc38-4451-9938-24cf8f964785", "value": "74F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496054, "uuid": "4d9d0c65-4877-4283-a980-bb9c557d75db", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496054, "uuid": "b515e23d-9e28-481b-909e-f3ed78fb4223", "value": "3072:uA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:u3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496054, "uuid": "cad4bafe-31da-4d7f-93da-28d00ae9e7f7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496054, "uuid": "6becd20f-cbf2-4a01-9e9a-84ff0f28ba45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496054, "uuid": "9db6e39e-4b18-4c43-812b-b2947199094c", "value": "228a93345faa8a2fc30f972069edadc7a16dade35c2636a166f567fe494a1a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6bedb3-9da6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618462265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462265, "uuid": "713cc4de-84a8-41d7-a162-38404b47b084", "comment": "Malware payload (Dridex)", "value": "81f35ae0b594d3b67fb10aef3e53fe8e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462265, "uuid": "f02dc9c0-390e-4dc9-b4a2-0d32d18f19bc", "comment": "Malware payload (Dridex)", "value": "22d1e4a972fe91dea853939724ff7e98a87dd7db1e1eef46a1704e323ec4ff44", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462265, "uuid": "36b85c03-8096-49a4-8c44-20383cec610c", "comment": "Malware payload (Dridex)", "value": "5f294e3ca69fb90601eaaa17e5260e8d45c42b81", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462265, "uuid": "b6c1b40e-08fa-4530-8b29-7e1e2c44f55e", "comment": "Malware payload (Dridex)", "value": "7f023e8bc792dab5595f13937c53243c4939cca67834821a92623196c321302de3410b63dd92bcf8bdec2fb8dc1f0966", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462265, "uuid": "f0e52b3a-b310-40e0-833b-b42c72226a7e", "value": "03249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462265, "uuid": "80d42b9f-5c7c-40ba-8c6c-4c926b98dc51", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462265, "uuid": "4613cc9c-7530-4277-b84b-e3edf7de5520", "value": "3072:R0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:EpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618462265, "uuid": "b49c1232-0d98-4119-b0e0-d9e42894d91b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618462265, "uuid": "2a869ae3-c7d9-48ff-b91f-494c051b7187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462265, "uuid": "e101ef04-a9ab-4ee1-a4ed-d4d1b8fa89fc", "value": "22d1e4a972fe91dea853939724ff7e98a87dd7db1e1eef46a1704e323ec4ff44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca9df48-9df1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618494741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494741, "uuid": "e11b2f6d-7c63-4ebd-91b9-e17cbc67a891", "comment": "Malware payload (Dridex)", "value": "f6c8f4b3aba8811f2a4e93d65407b386", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494741, "uuid": "e06097bb-0826-4621-9593-c3b8650cb739", "comment": "Malware payload (Dridex)", "value": "22e1dbd3fb0df232779d8e17deb6e5bf10fb78a488ce9dcac1934494fd8dd524", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494741, "uuid": "80714bbf-82f1-4461-9900-c58eb64290fb", "comment": "Malware payload (Dridex)", "value": "44cf822c72908993c44a51db7b1b7138289ade74", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494741, "uuid": "4bdaa36b-dad3-4689-8e57-a22742ae15dc", "comment": "Malware payload (Dridex)", "value": "a28943cad77f3b93ea0c3d874e399455ae505eddc54f3b46bbae4266105033cc6e8804816c2c1967446f6bcca5432503", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494741, "uuid": "350e71ba-8a0f-4017-86c5-5523ad06068d", "value": "A5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494741, "uuid": "eef4e088-3a56-4f36-a046-d29d4f2fffa5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494741, "uuid": "65070bf4-c515-467d-90ff-2c5cce3c9839", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494741, "uuid": "79844686-c590-44aa-b27d-ff3dba59d2e7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494741, "uuid": "1603ca68-21e6-4734-a47e-58fae15748e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494741, "uuid": "5d162c64-2279-4c57-820b-d2a12387f7d1", "value": "22e1dbd3fb0df232779d8e17deb6e5bf10fb78a488ce9dcac1934494fd8dd524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bfcf59-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618514316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514316, "uuid": "0af77697-7331-41a0-b39d-7757b1f7f713", "comment": "Malware payload", "value": "ff6467173b6fe7e3daa6f9003265a30c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514316, "uuid": "a3995b3c-fea5-4990-a0e4-2bc976a7abf0", "comment": "Malware payload", "value": "22e397cec214f7ba74f0b8982d31018155a267f106903c634222e8bd644f7f18", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514316, "uuid": "80f217c9-a77b-4d82-b508-0c314fc9819c", "comment": "Malware payload", "value": "0af9afddeebed6bfad1cc8057868ae816943886a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514316, "uuid": "9b2861bb-0e23-4fa4-a02d-50b252aa976b", "comment": "Malware payload", "value": "2bb39cc3aa62f88fef3a2d8ff95ed8c2f69859231413edce7f0ac2fed6fd7400f93a51df195ebd3ddd176410248572b9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514316, "uuid": "9ee05fa7-49e3-4877-8f92-bd8695a41c36", "value": "0A85F1D81350AAC7E3077D075A46F1482B27F176C4DA05C8F2EEE3B63AB7161DA1B846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514316, "uuid": "0de9bde1-7e7a-4a58-b450-32ee8e165ca2", "value": "49152:EVM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VM4VMK:YBBBBBBBBBBBBBBBBBBBBBBBBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514316, "uuid": "4198a3f6-76f0-4967-96a5-a9209e3d68e9", "value": 1823216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514316, "uuid": "4df4b4ed-f84f-4c51-8416-a73d1a5e02a3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514316, "uuid": "b35f2cd6-397e-42c4-8cb3-862d4ad68db9", "value": "Tax Documents or Scanned Documents.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e3746b-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496796, "uuid": "beb5e803-9060-4f4e-8423-df484d06e9d2", "comment": "Malware payload (Dridex)", "value": "845ba3b3fd7010a192b49634bb7af205", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496796, "uuid": "29d6898e-b5ac-4698-bb5f-a73ba9889586", "comment": "Malware payload (Dridex)", "value": "234ed203efa56e05c53ebe0a278a9061d9e7c425334a4c634b230b2cf65dc1de", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496796, "uuid": "a4f9e82b-941b-4e91-8c3c-5cff9ddce157", "comment": "Malware payload (Dridex)", "value": "0dc9f5e81e4c9a09edc272fc71b7e1479ea322c1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496796, "uuid": "5dfeb89e-a6d2-4677-9329-b396a78a1437", "comment": "Malware payload (Dridex)", "value": "41a3ca1678bfb6b09800d5394f7b107ca280ade16bd163010e7ffc18ff4ab189a729c639f451c2f59b88721e184cbee6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496796, "uuid": "5149aef9-03fd-4236-bcc2-3c0633da33dd", "value": "6CF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496796, "uuid": "d1bf50e2-551b-4614-b496-bbf64b37bb58", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496796, "uuid": "daa6158f-081c-4253-9183-64a2076199dc", "value": "3072:ciFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:/eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496796, "uuid": "3e3098e2-aa28-46ef-bfdb-becbf814c7dc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496796, "uuid": "904e2ddb-b676-4f8d-9d3d-7753a5f0b436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496796, "uuid": "38ba18a2-17da-44e9-ab18-d9cef4f29c3e", "value": "234ed203efa56e05c53ebe0a278a9061d9e7c425334a4c634b230b2cf65dc1de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071a8ea4-9dae-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618465633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465633, "uuid": "99e1affc-acd9-4f7d-a93c-c129f02086d0", "comment": "Malware payload (AgentTesla)", "value": "85b81149bcd1ce94ac20cca87dd2a778", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465633, "uuid": "1f545d1f-f3ae-411c-b2a0-6054c2232cb0", "comment": "Malware payload (AgentTesla)", "value": "238e048752966e9e840a97243fa4f688f180f410f200e5d1a4af3e18e48f7900", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465633, "uuid": "c5acdf1d-be5b-41e8-a2f0-baef16001452", "comment": "Malware payload (AgentTesla)", "value": "1d71efe8afd69da743e2340da41dd7ddda30dc92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465633, "uuid": "b32431e8-3b18-451e-8d39-010f71c6b81c", "comment": "Malware payload (AgentTesla)", "value": "0a312ee3d0869927fdfedfab32f19823ea1d7689b4683a920dfebcc2c30805cf5229322cc4f4a4dcaa2c7bd98e91060d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465633, "uuid": "4dcff86f-7ba0-4634-a424-ed910980fe46", "value": "F50533A73A07F2F5D88702326CF456D535829CC03668737D21732F62E33A6E1B869679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465633, "uuid": "294b9df4-afed-4fba-9f92-8c77c17652bb", "value": "24576:3ij5Muj7VPUsk+d3OkHl3HeVocVMUYgd776zo:Eei5csbd3dByoW7G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465633, "uuid": "196fde47-66a1-4bfc-ab25-6f4c49471324", "value": 833939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465633, "uuid": "ed43b0c7-d2f6-401e-b323-809ed803b0aa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465633, "uuid": "c6bcfef7-a122-4c2b-95f9-ca2619be1dc9", "value": "SWIFT_MT103_pdf.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f96369-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464238, "uuid": "0ccb7839-9109-4862-b162-c99b3bc51228", "comment": "Malware payload (Dridex)", "value": "9acd0e7bdb0ea34a95f6dd7f40555246", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464238, "uuid": "4c4e6632-6d62-425e-92ab-f3f566d8ffcb", "comment": "Malware payload (Dridex)", "value": "239594bfa798c47391cd28495039e83c9ecbd9416e096eb72b89f4305723e9e9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464238, "uuid": "72bf8a62-b166-48e9-b575-c1d171f10a81", "comment": "Malware payload (Dridex)", "value": "bcc00caf4bc31716f5f0ff8f86221778aadf33ee", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464238, "uuid": "c5c555e8-42af-461d-b3a0-e4e5319528c6", "comment": "Malware payload (Dridex)", "value": "5c184c444391c296a3d99b3a7159e6c42fcb528cb8fec1f2deff09581d6782141a6becc682de30193bed1735112b8f73", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464238, "uuid": "107a1fb6-8a35-4cc0-bbb6-f67a95038f26", "value": "C9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464238, "uuid": "dc4f9b3e-4689-4088-925a-0661e9cd5e9b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464238, "uuid": "3c5ebd58-cf7e-481e-9039-637a047eb077", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464238, "uuid": "351b60a4-58b6-4cee-a062-65869f24add4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464238, "uuid": "9b09c653-cb35-492d-ad14-4ea1f15f57d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464238, "uuid": "d5852428-dc2c-4d4e-94b0-8a1509547d0e", "value": "239594bfa798c47391cd28495039e83c9ecbd9416e096eb72b89f4305723e9e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307e1e63-9e18-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618511229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511229, "uuid": "bd663c37-0b2d-4123-bfb8-f2b72db8ae8b", "comment": "Malware payload (Dridex)", "value": "b27566873f8eadbaad8d308ab933708c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511229, "uuid": "5d2dc70f-2d51-49db-9c70-4a49b8f22911", "comment": "Malware payload (Dridex)", "value": "242c4ff42d9d33bc26fbfc4d3c49481b04c1e69102a9ef9bb5617b8e3e3c586b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511229, "uuid": "9ccbd357-2be2-4efd-9a96-fb1776ae2988", "comment": "Malware payload (Dridex)", "value": "cbfb613269f98a2a1620ad722bc4a49a01e972b2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511229, "uuid": "876124b7-25df-426b-b587-5b477e304954", "comment": "Malware payload (Dridex)", "value": "8be6cf7797039b8f885e06bee5c0e8a9b7d6bc230495f8b607e79d613bb09e63ebd68add7fe3ceb9fc8fb8cfbda8780a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511229, "uuid": "b165566a-96eb-436e-88fc-248ea6df117e", "value": "8CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511229, "uuid": "a42538e1-7178-4eac-ad89-d9ee19ffc663", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511229, "uuid": "895ede1b-9990-427c-8542-4b0012ab4fa8", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618511229, "uuid": "769da0ab-d9d2-40d7-9f67-77e038b59dd7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618511229, "uuid": "9ebc19ed-fb04-4ff5-a412-da5246320480", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511229, "uuid": "75ae1f18-9ada-4538-b571-99c643977304", "value": "242c4ff42d9d33bc26fbfc4d3c49481b04c1e69102a9ef9bb5617b8e3e3c586b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a592dc4-9dc2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618474228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474228, "uuid": "343ac58b-363e-4d85-9c57-25911cc30df4", "comment": "Malware payload (Dridex)", "value": "4d5791f88d530e9f60a541e2619bcd1c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474228, "uuid": "8caa8ee3-91c7-4220-a95a-98ba675c75da", "comment": "Malware payload (Dridex)", "value": "2449d1c3f437b1dbf0485d204ad6f11765e8c72dc15377a2345514bbcdcb86ec", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474228, "uuid": "b933ad04-d91b-4af1-b9f3-22d400c237b2", "comment": "Malware payload (Dridex)", "value": "59f6de1e18b9981371120afd9d2c7240aa2518db", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474228, "uuid": "b0753fb7-0a7b-4419-af7a-5a558379427a", "comment": "Malware payload (Dridex)", "value": "a7ab0b300f64754683100a21464d092d81c41f2dc88c801138d8163a5bfe853222087de0091191a3d8c03b6ae99e817f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474228, "uuid": "36e6dc0c-0b03-4dc9-8a1e-5751effe0032", "value": "E8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474228, "uuid": "7cf83834-a348-42d0-b1ab-3c0658e3b0b7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474228, "uuid": "438fec20-5b6d-4847-aa53-f412937906aa", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474228, "uuid": "4e596762-53bb-4c71-90ee-aa89dde175ed", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474228, "uuid": "5b331965-f22b-4b45-9234-d543407e7435", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474228, "uuid": "884a8e42-e8ab-48c5-ab60-7053c32a6693", "value": "2449d1c3f437b1dbf0485d204ad6f11765e8c72dc15377a2345514bbcdcb86ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09b949b-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498532, "uuid": "711e0e07-6842-42b4-ab0d-4c3bf168e198", "comment": "Malware payload (Dridex)", "value": "aba8b058cab21d7ded1e1b9d1a7a155e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498532, "uuid": "a2be83c9-e042-4063-9265-e2333068e8b9", "comment": "Malware payload (Dridex)", "value": "245302e746de309d77dc2621b9123e225731e8277635014f6f6c5155454e8b1e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498532, "uuid": "a961d8e3-b433-42ef-8abb-8ca5e00d89d7", "comment": "Malware payload (Dridex)", "value": "21c5eee0a5635eeaa2230e6b1230d3ece4551ac4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498532, "uuid": "1ec3a634-0f80-4490-89f9-9b9eb917bb4c", "comment": "Malware payload (Dridex)", "value": "2bd25a67a724aa55fa20ae5b489b6d66faff76d55cb08531fab540a1d426e8d106b859865af4e16f52b63b0deb162aaa", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498532, "uuid": "f0788f53-04fc-4e78-999d-0d4a49f3a095", "value": "DFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498532, "uuid": "88be1680-50e9-49fc-bd05-16c02e3a54af", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498532, "uuid": "3dbebb66-46d1-42dd-a4f2-4f36d1b9daf6", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498532, "uuid": "0ab3a879-81ab-4321-b1f3-0212d28097e9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498532, "uuid": "75b9d7ae-e441-4f3f-93e5-31d2edef5c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498532, "uuid": "c3c9b76c-2d5f-408d-bf2c-53e65fdb6e0f", "value": "245302e746de309d77dc2621b9123e225731e8277635014f6f6c5155454e8b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651d74b7-9dc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618477387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477387, "uuid": "8ce2ba30-d43f-46b7-96c0-0a0df8306b7a", "comment": "Malware payload (Dridex)", "value": "f1f35145f2dcf5ba5372ebbefc4ee9fe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477387, "uuid": "822138ca-a91c-4504-a7ea-c755bc59132f", "comment": "Malware payload (Dridex)", "value": "2490d042e4aea7cc8699354b00a3d172818fb23416cc50859dd6a838ea2efe78", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477387, "uuid": "4355150a-6931-4b43-88d4-db73f6c1543d", "comment": "Malware payload (Dridex)", "value": "d2c98af3a82e93e7e61a9c8926a9266c5ed976bf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477387, "uuid": "17b2b720-bad9-42dd-855b-a273b41307c7", "comment": "Malware payload (Dridex)", "value": "77e6cb52c4b702fb65d80b8517365a2ab0958a64a4be8c836050342e765b5ad434021f3aeb88dd355d07391bc31749e7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477387, "uuid": "4eb3a0f5-df08-4013-a59e-861c5a3ef1a6", "value": "28249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477387, "uuid": "92ffcb35-06a8-4c4f-ad6e-ac0f38ce2cc3", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477387, "uuid": "3715823d-050a-4888-8a4f-2bf077c3d79c", "value": "3072:J0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:8pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477387, "uuid": "870d00bf-779d-4c30-ab62-04afa030e6aa", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477387, "uuid": "4e7ba92e-1f7c-42ea-8ed8-168b0bb04c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477387, "uuid": "4bbcafb3-9634-4282-aa7c-cd02e9bddfb5", "value": "2490d042e4aea7cc8699354b00a3d172818fb23416cc50859dd6a838ea2efe78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf46b8f9-9d81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618446615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446615, "uuid": "e4e6074c-2529-4739-b09c-feb42cad0570", "comment": "Malware payload (Dridex)", "value": "79c00bd170378e25af514526107fda71", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446615, "uuid": "db0c4e47-52af-4622-bcdf-71c73dc29dff", "comment": "Malware payload (Dridex)", "value": "24981646b7349f4caaa94c36bfe11d68694acb2ff1f478353d4e6f81666cc349", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446615, "uuid": "040bfa23-e3e3-4dfc-93f7-f38fdeab840c", "comment": "Malware payload (Dridex)", "value": "f34b68e221c7fc56e9af383ab68d346f78e63cab", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446615, "uuid": "1ee3d257-5913-414e-a938-9e1a47c264fa", "comment": "Malware payload (Dridex)", "value": "086059c91a04f64fbc58b5184d695069c36235583c312b42df0e2791a9bdcd885d747d564e63cc087d646d1800b9ffa7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446615, "uuid": "ae42a895-79bb-4a0a-ab69-b95bd299f77e", "value": "9BF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446615, "uuid": "aef722c0-97e0-4801-afe6-06eabec8ddec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446615, "uuid": "0dd7f726-0973-4fdd-86d7-043d84427031", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618446615, "uuid": "1018a022-1197-42e6-b11a-7a72f4be8f0f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618446615, "uuid": "1337f6a1-0482-4ce7-a808-b7fa5f46fa86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446615, "uuid": "e77dbfda-a4c9-4bd3-90a8-5a443522a1be", "value": "24981646b7349f4caaa94c36bfe11d68694acb2ff1f478353d4e6f81666cc349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939a1b06-9e3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618527287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527287, "uuid": "b0630621-cfb9-40b3-ab36-0cd146da327d", "comment": "Malware payload (Dridex)", "value": "a457406f23317fecd0dfc470a2991807", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527287, "uuid": "fba6926b-5568-405c-87e2-786cee057726", "comment": "Malware payload (Dridex)", "value": "24bc89af5b1f66f2e9f4ef33eb468dcc96bb0738cd63851b5394de0ad754d4a3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527287, "uuid": "8da4da61-27f6-4fdc-ac0a-944abd1ab20c", "comment": "Malware payload (Dridex)", "value": "19c6337eb6abd68d5ed65acfb62b5bb2f16bdfbe", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527287, "uuid": "0398cf29-8f81-4749-8430-bb7012bcfa61", "comment": "Malware payload (Dridex)", "value": "0693a658035313ed23cf566fd3e1ed91779efc5e8daefb1f3f68889f9574d466525fb88cec8da750692eb8566f011d89", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527287, "uuid": "f6a3590d-58c6-449a-ad9a-abcfc53af746", "value": "B2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527287, "uuid": "6d912a4f-9488-4f65-b5d2-bb6c5801478e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527287, "uuid": "df618c82-e235-48e3-b056-bee1910967f4", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618527287, "uuid": "c77a18a5-9938-4f44-9e75-f79aab3fd194", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618527287, "uuid": "d824007f-d471-4ab8-9cf1-4647deed7d1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527287, "uuid": "fb809114-0149-4064-8a08-9f2327b0bbaa", "value": "24bc89af5b1f66f2e9f4ef33eb468dcc96bb0738cd63851b5394de0ad754d4a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25fb4bc-9df1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494777, "uuid": "44679d2a-6c57-4077-b0d4-821e948b067f", "comment": "Malware payload (AgentTesla)", "value": "7ba081e7ce27f42ec2fe7263766b9cab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494777, "uuid": "9b6212b4-9fe9-4118-9623-54e236560a42", "comment": "Malware payload (AgentTesla)", "value": "24cc7d0c47d68b1679f037301cf1233126761e7c67f8136539837131f1ff4a1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494777, "uuid": "0fccacd4-1904-4c08-9419-153293769624", "comment": "Malware payload (AgentTesla)", "value": "4c00d12529d89350aab061de10214ef3c08346b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494777, "uuid": "036ca86a-4ab2-420c-a524-afb5ec3b32d5", "comment": "Malware payload (AgentTesla)", "value": "21fb29d89435a6f2ff69d2f99e150629b8e97851cc764ea3cf7eb7350252e7d3b8ed4344b61c3c1c4a218c423cc1fbfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494777, "uuid": "4cb5e0bc-0d41-44b1-8f67-b518dc8ec425", "value": "8D15AD9C7658B6DFC81BCA32C9641C70AA616167D30BD607E01F11AC9E4DA97FF281F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494777, "uuid": "aeeca2cb-eab2-465e-8e57-928e1c640989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494777, "uuid": "a3bf07b6-809b-429e-beb4-dcb7e7dd4c74", "value": "24576:Ayos88X3NX45iAmg9Hzn6lNLAzeQDyl6T3R1/R:cuF4TmgxziNLAzeQGQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494777, "uuid": "a11f7c4a-1527-4f91-8503-d64edff071f8", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494777, "uuid": "cd88921d-67db-4ff5-8d1d-3ced713cc8b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494777, "uuid": "7576481e-464c-440a-8ab1-8406aef0fe00", "value": "Balancepayment-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e826c9-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496021, "uuid": "e58633c6-b9c9-40fe-bb7c-ce47bfad8f37", "comment": "Malware payload (Dridex)", "value": "44261dab2571a8543e15312307bd9dc4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496021, "uuid": "26b17514-d8a4-488c-a063-dc3d3dfea66e", "comment": "Malware payload (Dridex)", "value": "24d98cec29ed12b317fc61ec1ad25ebbb78837ec5428a35122852c5132749111", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496021, "uuid": "7a1958ec-10e2-46b0-aa8f-652f6d3e588a", "comment": "Malware payload (Dridex)", "value": "bb5990386ce045eb3bb8f4e583a2046f304f30ad", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496021, "uuid": "36999f7e-dd0f-4bcd-81a4-5925eecde228", "comment": "Malware payload (Dridex)", "value": "cca802ba54fb5b614d43652f6b7b4aed3c3dcaf9a1f2531d0c89f31fc577b6aabc38ed6d1d7a6ff8337dd04bea159a24", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496021, "uuid": "331540cf-9908-4a11-b6f9-e761affdcc90", "value": "FDF3E10AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496021, "uuid": "f54a3154-d80c-4471-8f1d-b61321a19f1f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496021, "uuid": "d1433ae1-f6b9-4cd3-8b3b-443e6ee3a2f3", "value": "3072:wiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:beAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496021, "uuid": "def6c84f-313f-4a14-9a96-df452d6dafd9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496021, "uuid": "7df4dbbf-9077-4588-9c20-676367000ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496021, "uuid": "d29c84b4-9df0-44f3-8e1f-ef2657e44bad", "value": "24d98cec29ed12b317fc61ec1ad25ebbb78837ec5428a35122852c5132749111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36736ea3-9e2a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618518970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518970, "uuid": "f64368c3-b0df-4883-ae10-100b97fee373", "comment": "Malware payload (Dridex)", "value": "16e855ab441d3de57de6cb3e3d5d7268", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518970, "uuid": "610e09a9-bc88-4456-b25f-66a3b0d192a7", "comment": "Malware payload (Dridex)", "value": "2509bba72f8a772b0d2b0c164b1cdd5092a1b572c36f14e45085ad47b8c4f00f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518970, "uuid": "9fcd6032-a9aa-40b0-a14e-f0ed4eaca2e9", "comment": "Malware payload (Dridex)", "value": "16c3d8088e177e1f76d35b6e94fded3df849f087", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518970, "uuid": "c046cab1-9604-4d22-8610-553dd2c6d9b4", "comment": "Malware payload (Dridex)", "value": "c45375d7ee82b998bd4988e6fdedf3fbfb6f9b36efcb6fea68f488bce5cbfc5fc670a79b46f1f0bdcc698f2f1e1a869c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518970, "uuid": "2ac1a15f-fc8b-4555-9c61-c41b627ec543", "value": "E2F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518970, "uuid": "41c6c00b-9598-4556-8c16-b8d014b264be", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518970, "uuid": "d057a9c6-c5cf-4dc6-b5e4-9a8dca540e28", "value": "3072:eA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:e3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618518970, "uuid": "e03943d1-bf32-491c-890d-a8c7ec262cd8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618518970, "uuid": "87f2ec57-ee90-4d37-8447-56eb40a1b995", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518970, "uuid": "225bcd02-20d9-4afb-8a2a-eaf041371a99", "value": "2509bba72f8a772b0d2b0c164b1cdd5092a1b572c36f14e45085ad47b8c4f00f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ea6f7e-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497063, "uuid": "f3ad6e18-c64f-461c-9438-f3bb81a64b45", "comment": "Malware payload (Dridex)", "value": "5ca9eb5ffa5ee96ca431c37a40d80ae0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497063, "uuid": "c504bd7f-ba3f-4af3-8c97-f545be666b34", "comment": "Malware payload (Dridex)", "value": "25335628e86a992fa2a18115797732a45e2140244c3951e7e5d2e77f458f7166", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497063, "uuid": "93d81d89-e112-4658-b37b-5fbf0ec614b1", "comment": "Malware payload (Dridex)", "value": "a38bc3a469d60bef11a348807aea711f30d3cdee", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497063, "uuid": "2704fc36-d13e-4cda-af22-7b28395f07b8", "comment": "Malware payload (Dridex)", "value": "5fe68dc5642bc04fae2fdcc8b7720e1fc645712229146ea477def7fe170878249cf23c0b6f14f61490d8c94a73fd718f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497063, "uuid": "8ee52ab5-c140-41d4-b83f-f3b101f02991", "value": "B1F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497063, "uuid": "8cb931e2-4442-442e-be29-0740e4ed79b6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497063, "uuid": "4d3e3a9d-51ea-49cb-93f7-cfadeb89037a", "value": "3072:+iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:1eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497063, "uuid": "ac3a3748-8565-444e-9ef3-4a5702fdef0e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497063, "uuid": "d2f1f2c4-395c-40b0-9955-603e96df47c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497063, "uuid": "1a86a131-972b-4905-9975-6198fb3ea4d9", "value": "25335628e86a992fa2a18115797732a45e2140244c3951e7e5d2e77f458f7166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bd7a3a-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "5058d297-f654-4fa9-9f41-b0225b3e63bd", "comment": "Malware payload (Dridex)", "value": "e58afec820a2ae91304d70fb251fbcc6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "43e42e82-2b91-40ff-b212-14f37280bf95", "comment": "Malware payload (Dridex)", "value": "253633eac6cb88fb5be6a28f58a318c67db7f52c6ad7eaaa7687f8fc278e9d0f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "7c405258-4840-4ee9-87fc-552630d88cad", "comment": "Malware payload (Dridex)", "value": "058edf46f5e42b0d9ca3126221b32228e2b17065", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498351, "uuid": "eb34d0ad-a36a-4b87-8d8f-fd16ebc5d303", "comment": "Malware payload (Dridex)", "value": "cd271b8dfc34177eb90c526e28bbd880d0301aa69b7c9c3c43ec99f62b90cd5df2514f92b189f980c6f399927acea162", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "cb12bf05-38c5-4dcc-948e-3ce431a4a310", "value": "04F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "b2f73067-b715-49eb-83f7-c590863adc68", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "cda088ba-7c81-443f-bbde-d15630aa3dde", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498351, "uuid": "de70cf77-23e5-4731-b501-6e1737a7719f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498351, "uuid": "156ddcf6-60e4-4f0c-a6b6-925ebdb2d588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498351, "uuid": "6db247a3-00b0-4809-a168-a774f8a05d81", "value": "253633eac6cb88fb5be6a28f58a318c67db7f52c6ad7eaaa7687f8fc278e9d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc5a6b4-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "ae8fa65c-4098-4f33-b0f5-a368cc4dd785", "comment": "Malware payload (Dridex)", "value": "6d25c3f68d8c53c9f816b4d1e477996d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "adeced8c-4487-447f-8a42-a5f3e8c150b9", "comment": "Malware payload (Dridex)", "value": "25481de5aef6440d9d6c8baae9fc80f1caef4a511330a33e3999dbcce2ca6ef5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "9631d20f-7036-491f-804e-186bb4194bdd", "comment": "Malware payload (Dridex)", "value": "6d7a711d96a3fe74778848235b8496fcd079ab29", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "73a44701-6f75-4d6c-ba53-b81aa7a26de5", "comment": "Malware payload (Dridex)", "value": "882a1d6c8bdd9fdc42463aa979762b820355a43e67777e7963821f6e170574884f4b88f4b5ec61bbb49388d2ec47841b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "b2d28847-77cc-4e15-a7e2-bb32191b1ece", "value": "8DF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "c6c09688-9f4c-43ca-8a6c-93d836c854b9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "e4414876-5a42-4a52-b720-7dee5f200a26", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464299, "uuid": "19ae57b7-8610-434c-a402-85c8ec24c2cb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464299, "uuid": "7d62b986-ba81-4a8e-8edb-d12dd20d11a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "297501ed-dbcc-419d-9f05-0cda859f10ac", "value": "25481de5aef6440d9d6c8baae9fc80f1caef4a511330a33e3999dbcce2ca6ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f092a292-9dbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618472038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472038, "uuid": "26dd425f-b871-4d4c-89f2-9a127314289c", "comment": "Malware payload (Dridex)", "value": "b8b692d045c96875e775d8bd5d766f68", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472038, "uuid": "0054f44d-be04-48d6-851b-326bf4a7b753", "comment": "Malware payload (Dridex)", "value": "25ac706b9e96bdfbc4a1137c3338dbb7df2552207df793fbb2282bc654b70d82", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472038, "uuid": "fe1c345a-9c17-48fd-b778-be37018597aa", "comment": "Malware payload (Dridex)", "value": "83b24c8e4c78661e3f55a84833763387f98bb0e5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472038, "uuid": "dabaad2c-e981-4012-8bc0-c1512ae8720b", "comment": "Malware payload (Dridex)", "value": "bb5edc09f900b5dea3c85333d6d56eff61cca54efabff27b5a2293078ac62ef475af8a9575d581c664d9a701dd4d1d51", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472038, "uuid": "e0c55c08-987e-4ef6-bf35-2c3e5ab3c92d", "value": "36F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472038, "uuid": "bb61ea50-ce7d-412d-8f77-1a102a3326e2", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472038, "uuid": "7118f2d5-82c8-4464-9ab3-7c3b976f751b", "value": "3072:CA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:C3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618472038, "uuid": "595653f0-0a2d-497c-8843-de8b3890bd43", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618472038, "uuid": "3c64bca9-dde9-43a0-9bbc-059422f12112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472038, "uuid": "c85d416a-8b8c-4d87-bd03-74f853762b2b", "value": "25ac706b9e96bdfbc4a1137c3338dbb7df2552207df793fbb2282bc654b70d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ed10e3-9d9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618457982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457982, "uuid": "38b2bd3f-6e2b-4f87-aba0-2ba6fc4cee40", "comment": "Malware payload (Dridex)", "value": "4e3bb1cc3edba3079b6ab8e0d84e281b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457982, "uuid": "463d9880-af4e-4ad3-b969-b6156b8c769b", "comment": "Malware payload (Dridex)", "value": "25d65b3214f196bae02ffa7722d4e2ed403d02bca14815149ef2b655d620efae", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457982, "uuid": "c1a29145-63d2-49d6-906e-1b075ba74b7b", "comment": "Malware payload (Dridex)", "value": "d31a86310c314fe78aedab39427b824c18e89955", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457982, "uuid": "f842502e-a236-4d15-afdb-7e063086f609", "comment": "Malware payload (Dridex)", "value": "63f9a4861316480fd67ff059f57546ede4ead76361cf7b04d00f91b2d91ad6de015cb665441b97e7ff705be475886b01", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457982, "uuid": "7af5e9a4-83e4-42c0-8c1e-f40631893bdc", "value": "41F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457982, "uuid": "b7c1c434-8df1-4f97-b253-062956f06993", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457982, "uuid": "74b315c4-1073-45a1-952e-8d11300a7fce", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618457982, "uuid": "d63bbcf0-cc79-4cfb-9f0b-89a946a8ec5b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618457982, "uuid": "e0fe7ded-0d3f-4073-8565-b996a229ae83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457982, "uuid": "bfa43427-39a6-4fab-8a45-0a1bc2e455a8", "value": "25d65b3214f196bae02ffa7722d4e2ed403d02bca14815149ef2b655d620efae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c174b68-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498954, "uuid": "6dc0925a-fadc-4fc7-b39b-6557f24da8a9", "comment": "Malware payload (Dridex)", "value": "bd1b04449364bf6e548e1a4c518a18d7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498954, "uuid": "b07e940d-77a2-4976-816f-7ae724febd2d", "comment": "Malware payload (Dridex)", "value": "2623f17e3bc40ae58ccb36a6f511f0892315b795a3315ea3410604ef407aac8a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498954, "uuid": "6c635450-c186-409e-8c36-d847b8f1da24", "comment": "Malware payload (Dridex)", "value": "74f1de7a18a3cc437025acc7c75941098bd12b26", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498954, "uuid": "6fc7a7e3-54d5-4079-981f-8ac0060c6da0", "comment": "Malware payload (Dridex)", "value": "52e49e5978f73eed054409f55db01fc1eb31ef633abfd2052cdc0c35b8730a6f8b5b6f29881395c8f0e1e204604e340b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498954, "uuid": "716438d3-1f56-4819-86c5-e1b0755c4c87", "value": "D1F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498954, "uuid": "884f59cc-f40b-4578-833d-be1569562b18", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498954, "uuid": "65c60c50-cf0d-4f19-a8b7-a12d28d11135", "value": "3072:xA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:x3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498954, "uuid": "1676908f-c254-4330-8147-2c6c8e96004a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498954, "uuid": "6a16a43b-b95a-413e-a9c0-c744df6ba7fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498954, "uuid": "07374085-4f93-4990-a0f5-bf4a01499d38", "value": "2623f17e3bc40ae58ccb36a6f511f0892315b795a3315ea3410604ef407aac8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30b3159-9de3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618488792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488792, "uuid": "e09df03c-caf2-4bb2-94ae-1eded903ce4c", "comment": "Malware payload (Dridex)", "value": "69b74d7e8a6d345cfb6dfe545701d34f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488792, "uuid": "0ab7eab6-dabc-47e9-971b-811f5e988715", "comment": "Malware payload (Dridex)", "value": "262ca78bf8a0a96cfd56d1d077294f7f6b029d3cdc040d450d5267ae99ad1a84", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488792, "uuid": "53d9e955-ca73-459d-b794-8cd156a939ac", "comment": "Malware payload (Dridex)", "value": "16d527769b99c49ad82441a556d4f3f832c1f160", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488792, "uuid": "60f90d8a-ac00-4338-8008-06907dfdc628", "comment": "Malware payload (Dridex)", "value": "3fe3914526402aa03bd7efb6f3c5183c58126ca940d822e246444d4590928943f5f800e610adc10f3c17dd6fe40c6afe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488792, "uuid": "40de4214-1bca-4c0c-a9b1-07e9254fa148", "value": "74F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488792, "uuid": "342fa6a8-2e16-4188-8b89-f79d1c227247", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488792, "uuid": "297b3cb5-c3cf-43c8-96d2-eacdfac505a4", "value": "3072:TA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:T3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618488792, "uuid": "0994c74b-893e-431e-abb1-35cab5f70ca4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618488792, "uuid": "200d75df-5b8c-4478-8369-1c72b1f7bd0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488792, "uuid": "4783d9ce-61ca-4f22-ab72-b4677338571d", "value": "262ca78bf8a0a96cfd56d1d077294f7f6b029d3cdc040d450d5267ae99ad1a84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5364aa0f-9e03-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618502268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502268, "uuid": "01c6f16f-bf63-4126-a18e-5fa5b87c4093", "comment": "Malware payload (AgentTesla)", "value": "f6f6c33b3eaf1dc05f05e081727a7b50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502268, "uuid": "65a64147-eefd-44b0-9a6c-36dbdac2b716", "comment": "Malware payload (AgentTesla)", "value": "26615da3f4f2236194f8292f2279855cf82a3dc996281a89e127996a928b9cc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502268, "uuid": "488adbcf-d9c8-41e7-86e3-9476c1116501", "comment": "Malware payload (AgentTesla)", "value": "916f8b29643d4248a8dde6178cc0a3693b11355f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502268, "uuid": "72e8f8d8-60bf-4978-9446-95490168447b", "comment": "Malware payload (AgentTesla)", "value": "8707e52aa73c29d737b45986e6aa753bafba150db58d6104cd9737a9db6db08e8babba88f51369d0a0d6e531558ea4e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502268, "uuid": "16dcbab3-972a-4a8d-975f-86ac5598023e", "value": "D025013233A47BA3E07F563844A1058502F1FD156672DF4F7CE4B58D6AB2B528362B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502268, "uuid": "6cb7b8f7-c965-46f4-a54b-d10974439f8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502268, "uuid": "8853429b-1de6-4ab6-90b5-beefa365cb2c", "value": "24576:gkyo5h5WR59EJOd8r065YAkwdy3nWRAo5hrtQ57l:gZYP0KYf0y3WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618502268, "uuid": "87185a93-f776-401c-b0a1-53a40a7403dc", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618502268, "uuid": "00cd7bd1-4d5d-44fc-8a06-77cd35f98056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502268, "uuid": "f44b9bb3-381e-4dae-b90a-aae922d7aa64", "value": "f6f6c33b3eaf1dc05f05e081727a7b50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b4d5e6-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497095, "uuid": "9438f508-63b0-41d6-a1ee-4f1cfd148d16", "comment": "Malware payload (Dridex)", "value": "8c48d8211882d37b1b2a1a52432a2fef", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497095, "uuid": "b8e80398-4b2f-4d13-a4ee-dad418a610c5", "comment": "Malware payload (Dridex)", "value": "267c00e9a073322e6bf908034a16b3d6240c520e20909866ff1fe66e30147732", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497095, "uuid": "574e8884-c6ad-4158-8169-039ddb444ada", "comment": "Malware payload (Dridex)", "value": "ef3829cd86fd64109723ca73f20765a6cdcd0c51", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497095, "uuid": "ecd7c3d1-3057-411d-a370-e60d047011b0", "comment": "Malware payload (Dridex)", "value": "9041a4d7afa1fefbe5f8c03d8359d3b6aa14059308afd35821ea8684e5c4c3500a05daf22760671a1c744253692cfd67", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497095, "uuid": "dcc03b4b-5736-41bd-860d-6c6ffdf65c37", "value": "43F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497095, "uuid": "acc2892e-ae8b-4cda-99a8-5e1df1203243", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497095, "uuid": "39b6718b-ece7-4f1b-9a22-aa485dd0b739", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497095, "uuid": "3a1695e4-dc72-443c-91ed-b3332e7cf03d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497095, "uuid": "d737502b-6457-4713-aea1-b4427704178f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497095, "uuid": "8e4c74bf-3dc7-47e1-bed4-e371d4040090", "value": "267c00e9a073322e6bf908034a16b3d6240c520e20909866ff1fe66e30147732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397da935-9d96-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618455410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455410, "uuid": "56fbcce1-0905-43ad-9c1b-7ce8fa90dacb", "comment": "Malware payload (Dridex)", "value": "8614c70797b68bc33b62bbafc5b0b8dd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455410, "uuid": "993dc227-c70b-474f-bc91-068922369143", "comment": "Malware payload (Dridex)", "value": "2717ed10f48378b49ab462b12b5eba0ef6aba27d86b5d6d8a574eb80c6c733f8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455410, "uuid": "8dbd74a8-f10f-4a2d-85e4-d4c240635aed", "comment": "Malware payload (Dridex)", "value": "dbc0bc8ea6b23e8327d472c6bd513bb63b6088a5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455410, "uuid": "56bbb85d-ced9-4ea6-84d4-30674a6b414d", "comment": "Malware payload (Dridex)", "value": "baa2a48e09d36465aaea64bb1466967a489114855f1ef34d4b102f6721c7e7693c2b37382bb7c2c21d86fc12541773b1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455410, "uuid": "6242dd31-3e71-4ced-8170-1d32b481597a", "value": "1BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455410, "uuid": "346c80f7-0166-49f6-9d32-1f86989e2919", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455410, "uuid": "ba12aefa-b414-4da0-a8ea-52ce94d09cb2", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618455410, "uuid": "5a2a3c32-4ab0-43bc-a878-b0def8af2494", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618455410, "uuid": "6ca053cd-5c3d-4d02-8323-813bd718fd7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455410, "uuid": "ca165887-1d43-4788-9c42-bbb9080b4369", "value": "2717ed10f48378b49ab462b12b5eba0ef6aba27d86b5d6d8a574eb80c6c733f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8150889-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618514490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514490, "uuid": "176b75e9-a281-4897-ae5b-3fcd33c8eebd", "comment": "Malware payload (AgentTesla)", "value": "012d66e94bd1367e3ce1646385842ad6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514490, "uuid": "3e83d4df-b0b8-4a8f-995a-2f98553587e5", "comment": "Malware payload (AgentTesla)", "value": "271edb9a54451a8fe31b67798772894a54274f0e1661f3e5a21c02dff9755dd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514490, "uuid": "049e2a60-c739-4437-b146-b3021256a798", "comment": "Malware payload (AgentTesla)", "value": "751c6b277ea259f7118e0c07f9de5a18e9b00b19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514490, "uuid": "65592288-8ac0-4851-a27a-7e5cd24d0db9", "comment": "Malware payload (AgentTesla)", "value": "9719b5205d2d7b1bfa626d968e57a17994ab517608fb513962ccf51c5fa88c8dd10e0734ea696db0a545d3f88075123d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514490, "uuid": "e58c88f7-8658-465b-8f01-7f70587fc5ba", "value": "BAB4239E79C14F07EF8337FA209960418069DC220641DA13B9FE7BED5479B48DB372A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514490, "uuid": "5badc271-61a5-4063-a7e2-4a9f288e037c", "value": "12288:DPjOmC3lBejgPzTMEQtA5d23kqdajJvnWHmsbedX9:DPWlfLTMvtA5dwdEPWGsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514490, "uuid": "5964145f-3beb-4a68-9d81-25b1454f6be4", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514490, "uuid": "f396b244-03f2-4076-815e-876f49d532c9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514490, "uuid": "714cc391-352a-4862-9724-6e17bff27a92", "value": "Citaat.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515d1ff7-9e09-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618504842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504842, "uuid": "8277d6ff-4db1-4ead-830f-c398c8a0cab1", "comment": "Malware payload (AgentTesla)", "value": "11756043c194c2f6cea0567ccb83e3a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504842, "uuid": "f62b7dfd-d4fd-4960-9c2a-ee8cf649359f", "comment": "Malware payload (AgentTesla)", "value": "273c6c00d02a71e616afbfdf35b0d114e478ec6ef7d26cc3d44c047b1ba5665f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504842, "uuid": "e95ee9f4-d2ba-424c-8204-94da5ba43839", "comment": "Malware payload (AgentTesla)", "value": "c1d56888bdb83bc72a17cbd7125064d2abb7942b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504842, "uuid": "9e01ee08-55b0-4209-b4aa-1340757cd12b", "comment": "Malware payload (AgentTesla)", "value": "d3fbc07d3f9d25147587017cebe8a60c919b43b7e708e66924e46eb3c3e2149ca5630e361768f0ae8d9467db5a1c2476", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504842, "uuid": "a73502ae-9fa8-4620-b369-7651d9eea2b8", "value": "C3056A6132B7D654D6E94F3440AD5E141EB1AE026933E70C19A674EF0BB27838F1EF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504842, "uuid": "4ca86343-322d-4a64-9456-ecb8dedf5b21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504842, "uuid": "cea7d34c-7f23-49f3-b4fc-575b21bb282a", "value": "12288:iQXNrXvAtKdEEjHbHzAKk6Q2M8cUyAoJkwPnLxSfukp+r76CzeO6tvQ/:iWN8A3H0OQ2LRoJymkud3wvQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618504842, "uuid": "e1ca9e92-8da4-4e89-974d-254cf5091c2f", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618504842, "uuid": "c4fe4527-bca5-44b6-b2a3-d5468ddc9736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504842, "uuid": "1b36a513-30aa-439d-88d2-0b3563d5bc5b", "value": "11756043c194c2f6cea0567ccb83e3a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55836a3c-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480797, "uuid": "8f4ad1c0-6043-425f-ae1c-c6b4dc188673", "comment": "Malware payload (Dridex)", "value": "31689c7d18231090bde1bbef2c692812", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480797, "uuid": "5d641bb5-50da-44f2-94f4-b851d78e995a", "comment": "Malware payload (Dridex)", "value": "27a109a6f5aaac6ba8f0249c3caeac9e34d365c09208066dc2f277f9f79f7fc7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480797, "uuid": "8f0a5822-4708-4546-ad70-8c966d646a04", "comment": "Malware payload (Dridex)", "value": "aa9d7d99b27e2144b4737ba1ef767bdde798594f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480797, "uuid": "9312ed78-60cd-470c-95f8-bccd075347f6", "comment": "Malware payload (Dridex)", "value": "3ed07b0569544f3ee6bee6fda66adb1cc0cd0920cba6fbe1dd4b488b30f43119e8472569b634f34b421bddf91c216610", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480797, "uuid": "34d46304-f5a6-44ff-ac1a-a26ea27ee2cf", "value": "9AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480797, "uuid": "47ab592c-06a7-4373-9afb-d7100374278a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480797, "uuid": "9c8606d3-7058-4814-b9d4-86708ee200f8", "value": "3072:MiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:veAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480797, "uuid": "6884dc40-199d-4ac3-81c6-660311af0bce", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480797, "uuid": "63042fb8-c432-4d02-b7ce-e278e33d151c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480797, "uuid": "327f577e-ad7a-4afe-9618-de06980c6188", "value": "27a109a6f5aaac6ba8f0249c3caeac9e34d365c09208066dc2f277f9f79f7fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244d2fde-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496606, "uuid": "41343e30-aa0c-465d-97bb-026e717a04fc", "comment": "Malware payload (Dridex)", "value": "3bfcacb3c01e885f5812de8ba0a67d86", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496606, "uuid": "b47215a0-318a-4ad3-87f6-1a326a4e2f2c", "comment": "Malware payload (Dridex)", "value": "27d14cba3e96884ce36d910069b110ef4541a8c79f1567125bee332277224336", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496606, "uuid": "0968f293-b2e1-49fd-92c6-a3d624aee831", "comment": "Malware payload (Dridex)", "value": "c9ee4c690bdcd69fa6c1978eb32b76b4b8871c16", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496606, "uuid": "8785c011-b470-446f-8f97-4100733a5360", "comment": "Malware payload (Dridex)", "value": "c81947c4f2f9ff366b4ef0ef96a5c939978d2f33b964bca6e22e34f99d55c4860445e4fa87927a71260bc1500c8976c1", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496606, "uuid": "c61aeefa-62c6-4e7c-b330-ae9b655c8400", "value": "61F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496606, "uuid": "89683189-2a39-4fe2-94d2-923cc8d96da4", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496606, "uuid": "64c5a2e0-0738-414c-90ce-0fb442c1c81f", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496606, "uuid": "7935ce02-7eda-4aa9-8abe-ea414b9ad0e7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496606, "uuid": "af64f1fa-a60a-4dcb-8067-63978ea12166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496606, "uuid": "bb182eb7-b2e7-4dd6-b4cb-9c27d99a60d3", "value": "27d14cba3e96884ce36d910069b110ef4541a8c79f1567125bee332277224336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97323ac-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464295, "uuid": "39ecf15c-3a06-4407-84e4-d3c0a4f5f3b8", "comment": "Malware payload (Dridex)", "value": "08c3f7d8c8ff43515be94e7ff245eb5a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464295, "uuid": "cab27abc-f3df-4851-8ef6-c25c52e4f1df", "comment": "Malware payload (Dridex)", "value": "2800f5b8df1652f3d5183856403b524a08ac59e1b51549d0f39ad04c1dc2548c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464295, "uuid": "97b1b27e-6f70-4c7e-bc35-e74a4d4f68c8", "comment": "Malware payload (Dridex)", "value": "2d966c59fc589a2a50a7fd6c76b058f5acd99e3d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464295, "uuid": "366bcf68-e29a-4b32-b149-0f6a4a302ea6", "comment": "Malware payload (Dridex)", "value": "177af82ae97c5346087b60b583e30ae34614157782fbb53125988aee92e94614e52a6c1771547c9f3ac4eb482595dcb8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464295, "uuid": "e09458e7-8ea7-48c8-ae08-ab838ccab928", "value": "74F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464295, "uuid": "54b778e0-6676-458b-8c89-3e68ee326a07", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464295, "uuid": "aeaf64aa-c499-469c-9baf-c2814f789e81", "value": "3072:JA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:J3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464295, "uuid": "c898f724-633c-4e39-8bb9-d481e0be2cf3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464295, "uuid": "5d1ac39b-8e4e-4ffc-88f9-19423d8e4004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464295, "uuid": "563cdf4c-f9f1-4334-8a41-cf81550910e5", "value": "2800f5b8df1652f3d5183856403b524a08ac59e1b51549d0f39ad04c1dc2548c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5b3405-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495871, "uuid": "e82d8bb2-8e9e-446b-809f-1070d6743df4", "comment": "Malware payload (Dridex)", "value": "77ffc1e98caa94ba457bbfb0dd769645", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495871, "uuid": "95825c72-7121-4eea-a60e-e1785d5b38f1", "comment": "Malware payload (Dridex)", "value": "2820ee5db2b31cc4e8541c6f54f438b8dfb5e4b7790f5e7cee64b99aff2d8b90", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495871, "uuid": "71583515-360c-4533-8b12-0900a8879624", "comment": "Malware payload (Dridex)", "value": "93cde06a18088a23bc873f57a7891d85e0cdeb41", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495871, "uuid": "d4ded4e8-fa47-46ae-9eea-5d49f61f9c35", "comment": "Malware payload (Dridex)", "value": "ad0f43010890a931beaf60073575753591c1eb56cff884c4d5279d53a9124badb8716d5114838fc972e92a7d35767063", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495871, "uuid": "e5d4600e-63cc-4389-8d52-2745ecde122a", "value": "75F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F53725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495871, "uuid": "1b54346a-ad61-4975-8c64-1b7bcc286b02", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495871, "uuid": "c667a0ce-fcf0-4005-b213-ef4b168a9d62", "value": "3072:oA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:o3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495871, "uuid": "0af2c54e-2d16-40fd-82aa-e2ac65cf0a59", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495871, "uuid": "6a932bf0-1f7d-4066-bb7e-038f8f8cb1ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495871, "uuid": "68b02b95-85e4-4e91-a57b-1afaaf2f57c8", "value": "2820ee5db2b31cc4e8541c6f54f438b8dfb5e4b7790f5e7cee64b99aff2d8b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cbc995-9dd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618482010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482010, "uuid": "78ac5261-75d0-44f2-85aa-99778df9f491", "comment": "Malware payload (Dridex)", "value": "f849720582808489db2171b92f797152", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482010, "uuid": "a4b18eeb-5887-45cd-bb46-af75ece949e4", "comment": "Malware payload (Dridex)", "value": "2882dc9f42523a6983b68e43b7cc78446798202e6d2438b1f15015ab8c65ca90", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482010, "uuid": "a1620bf2-b943-481b-bd57-ba9578595a61", "comment": "Malware payload (Dridex)", "value": "2b2f84115954cbb8f9c90dcd3d71a2a13ec7ddbc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482010, "uuid": "b621c80d-04c5-41ac-a833-8042e6089b10", "comment": "Malware payload (Dridex)", "value": "54458abb58f599b471848a2c1770237d9a2519c2e14c09eb97707f19789d3a365c5b5cf270c41a120075e109442476b6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482010, "uuid": "eff56394-eacb-4478-bc57-1c693291db06", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482010, "uuid": "fa3d9e80-adeb-4d31-ab17-e8d6ee1d60e1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482010, "uuid": "1d9a6a9f-4cef-47e5-ba01-b57e402b4033", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482010, "uuid": "4ebb1762-5fba-472d-8f1e-a67ddfd7c7ec", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482010, "uuid": "219e0434-829b-493e-9859-180c2717d4fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482010, "uuid": "8db6d987-12b1-4d9f-90b4-27cfa8c33595", "value": "2882dc9f42523a6983b68e43b7cc78446798202e6d2438b1f15015ab8c65ca90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412d9ad4-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "bd7d172c-4220-40a1-8ce1-9b0399bdc5f8", "comment": "Malware payload (Dridex)", "value": "154096ba93290391286b03ec35b9aa5f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "827bd325-eb7e-4454-a750-f341a4107155", "comment": "Malware payload (Dridex)", "value": "28a3d7c559147bf430ddcbcea534468e6b8acb07a6704061f52d0e180e7a2d42", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "40e77278-1d59-4d3b-9778-109d048da0ed", "comment": "Malware payload (Dridex)", "value": "4d62d2c4541880aaeb9b77c02729dcb1e55579bb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "55a46375-c810-4267-a780-5ee9e98fb85c", "comment": "Malware payload (Dridex)", "value": "f759c92c9c37fdf09ef930be447a702ad593ffb6ca3ffaa932e33fe7da5628ea1caeb659899c240b095d7a5613b7734b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "cab4e3cf-ae95-4f43-ad0d-3702d3334efb", "value": "4FF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "6403eb65-37f6-49ed-b55f-1231023db2b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "22e39e7f-23e7-4baf-b21c-db04d19e9659", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515981, "uuid": "ffcd382d-6d80-4775-97cb-a4e8f45b94bb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515981, "uuid": "838c7852-5026-41ca-8630-00b9dbf0a6b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "797aeac4-8a1b-4a78-998e-02ef162b6dfc", "value": "28a3d7c559147bf430ddcbcea534468e6b8acb07a6704061f52d0e180e7a2d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a443dc40-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495961, "uuid": "ae9e5d42-6628-4255-ae73-20039319bd31", "comment": "Malware payload (Dridex)", "value": "521cc750e4496dac89c081d7013f4c0b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495961, "uuid": "0cb9053e-9dc7-42da-ab35-9994d0726ea2", "comment": "Malware payload (Dridex)", "value": "28c2868179e852d587bf447ef72d12708acbe301f31ee4fedb5627e770be774c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495961, "uuid": "c09a61f9-5dde-4c59-ae04-537cff4dc245", "comment": "Malware payload (Dridex)", "value": "3c2b3c160d3729ee37ee2713762774c6bb1f4235", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495961, "uuid": "9d654d33-36d6-40e1-b118-d7170e2db590", "comment": "Malware payload (Dridex)", "value": "3dfc1f0ab68a88e9cc3ffac9bad97d4675a4924d9d5eb9d1f0f33ad81ed2780e6aea19ea9742095ea8c80a5ad0846eac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495961, "uuid": "5bbda04b-f388-49c2-a74b-66f03e56ec48", "value": "86F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495961, "uuid": "79fa1461-750d-483e-b1e3-61f5a7c09836", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495961, "uuid": "575becec-66e1-4209-ba6f-22ffdd82d0a9", "value": "3072:PA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:P3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495961, "uuid": "5d28188a-ee84-49ad-b904-4850b1389cdb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495961, "uuid": "45c70f33-eef0-40f0-996e-f501c041b007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495961, "uuid": "094877cb-62c6-40eb-b6a2-119a86be1f3a", "value": "28c2868179e852d587bf447ef72d12708acbe301f31ee4fedb5627e770be774c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa21d3b-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464439, "uuid": "9ede540d-dc07-4566-936c-85a8eec7c947", "comment": "Malware payload (Dridex)", "value": "208553c8cee8adb3bd213ad8259f9695", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464439, "uuid": "9797596e-9ce0-4025-b4a3-bebf69c6bc3e", "comment": "Malware payload (Dridex)", "value": "28c7babc8f600c7b5b570352902874072ff6517233b54a0ecd2975b904a13b26", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464439, "uuid": "9cdc15a3-9eed-41f7-a739-a2d26d7daf8a", "comment": "Malware payload (Dridex)", "value": "e01d36b7a3bd8f87c8cc1345007bad88548bf716", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464439, "uuid": "c7193069-9d1b-47dd-a8c6-ddfae51bbc75", "comment": "Malware payload (Dridex)", "value": "b0b14808626ef1884f84ffcccec90fc3d3b585246cfc58e8cccbc5f74e857334959b794c7cb3dca8494106c894bd9d0c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464439, "uuid": "4c6a87e2-2382-49ba-a0bd-804e131a136e", "value": "2AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464439, "uuid": "6ea6fe43-02cb-4a81-8161-a67ce2476741", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464439, "uuid": "fd64403e-12cc-4657-a6e9-f86def79cc80", "value": "3072:yA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464439, "uuid": "597a9dc9-0f5d-4fa2-ad68-79a4945f73ed", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464439, "uuid": "7c408838-3dff-4d5e-a36a-fdc6fd674b02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464439, "uuid": "4210e312-1934-4317-875b-16469b0b97b7", "value": "28c7babc8f600c7b5b570352902874072ff6517233b54a0ecd2975b904a13b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6836e16-9e37-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524849, "uuid": "4703d05f-e5f4-480d-8691-9aba5be7c247", "comment": "Malware payload (Dridex)", "value": "1bfb90bea850f33bf980efe57d5eb143", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524849, "uuid": "d8687580-280b-4856-bb55-d9ce79fd4cfa", "comment": "Malware payload (Dridex)", "value": "28cc38e0bc2ab9eb7a8d508e337e9d335101dee81488ca2635a9179268dfa9ad", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524849, "uuid": "71dc3673-d3a0-40c6-a7f1-83f494938c63", "comment": "Malware payload (Dridex)", "value": "bb2a1db6c4a4f5f205fd41e4d5ae509cfedd5848", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524849, "uuid": "dca38983-3c17-468f-aa1c-d220d05a9b34", "comment": "Malware payload (Dridex)", "value": "8c528e357fed13dc24805d6a9377438976ecf712e7a5e9e9de680030eac9c02411c33330a1e8eef5952f9feeec92f8a8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524849, "uuid": "cbbcabba-b8da-4db1-bfe7-7b01bbe43fec", "value": "9EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524849, "uuid": "d3add6b7-f011-4584-9b93-a88b6cd300b8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524849, "uuid": "7a155562-8eac-46ee-b5b2-339fad578a1d", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524849, "uuid": "fd676eeb-6f5d-4fe7-95a9-b1cab627ae12", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524849, "uuid": "63d710ae-b0e2-4701-8f93-c8d1d77b3d6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524849, "uuid": "82e56d08-84b7-4d54-89b9-5ddd6d45b38a", "value": "28cc38e0bc2ab9eb7a8d508e337e9d335101dee81488ca2635a9179268dfa9ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59301a7e-9daf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618466200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466200, "uuid": "7eb8bc29-224c-4a78-b918-17f2f5b8643e", "comment": "Malware payload (AgentTesla)", "value": "1e3460053d44e79c353a3344df2a6796", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466200, "uuid": "6c5c5f21-f0b4-47d9-b94e-382080f8d64c", "comment": "Malware payload (AgentTesla)", "value": "296013a2a5de6181979963d9b07bdc97a6bc6f286645334faba7fda505a668b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466200, "uuid": "8687c806-1163-44ca-b328-14a39e3a9820", "comment": "Malware payload (AgentTesla)", "value": "83a01c4020c36ef2347f1a453d77c970f73ec49a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466200, "uuid": "f3845b3e-f214-44c2-a2b2-9c4019979254", "comment": "Malware payload (AgentTesla)", "value": "419f9c714530ac3c83c5c8ae162dd693d79dba5b8c02b2ec3629d05c54ba186d3694c9a8f9d2ee7d6b14640079855bb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466200, "uuid": "618213f3-579a-44e6-8dd1-22e4223ab83c", "value": "12E4230DBDB2765C9EF68C702B38CE4BAACC0D185722FE48506E4D75E1E79448CF86A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466200, "uuid": "6ee3b71a-cf83-4f4d-9f4a-720dbc564130", "value": "12288:DaB2L3NF84yCt/llBk+LisX3WzH9ANmqyDoPjSOWWnlJjiLjTV15NfBT:DbdF84yCJS+bE8JyDGlcjb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466200, "uuid": "dc50e47e-fd1c-4456-9447-cf1735a4dd9f", "value": 679403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466200, "uuid": "8fb9c28c-b750-49a4-ab81-a8de5e3f64a8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466200, "uuid": "8dc9ca85-06ba-4422-a16d-ae041b47ecc3", "value": "PO #4500290652.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66db09c-9dde-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618486650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486650, "uuid": "ccd008ee-a02e-4875-b688-ba2dc9ea64db", "comment": "Malware payload", "value": "41bb85a2488536c8d676c4534163959a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486650, "uuid": "94f7e48a-4a72-4fa7-80c8-15917e933175", "comment": "Malware payload", "value": "2989fb08084199015e5c1b921d82f855b0c415f05d81bef60ce3f18f68708f8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486650, "uuid": "cc50a73e-2a01-4da5-808f-f4d70b22c1b3", "comment": "Malware payload", "value": "3262fa7fd0894010bb6562cd6a9865b9ac739e8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486650, "uuid": "b4687fa0-6522-4842-b6a0-214da88bd8cf", "comment": "Malware payload", "value": "90c46bf74aed0449c3b6b1e9df287ef875a5536adf0377548ecd464f3ba45ba90fcc91d9877c2c338bbc862cb2594935", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486650, "uuid": "95900e17-9883-43ef-831a-b2f816024cfb", "value": "2DC4D0663798DF55E1BF9B792821110113F5E10BD732E58D7DD802EE1AB2F808B2B792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486650, "uuid": "320e3f02-b820-4de0-996b-d462fbfde6a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486650, "uuid": "a50e40cc-d578-4dc8-ab28-7a8e3c4e8930", "value": "12288:+ty09A/gK1YZm0T6YQlLwqbXAVejfNW1TAwa3XS3/:90IK0FXl0qjAYfNWpVwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618486650, "uuid": "95e2d7a8-582f-4db6-89c8-25bad7c11f67", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618486650, "uuid": "aa92bc8c-b82e-45a1-b3eb-fc614591a0bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486650, "uuid": "7bb42903-61b4-45ea-a596-f509155e1e0b", "value": "HSBC-Payment Advice Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39151ad-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "75eeb966-3a80-409e-b768-ad2835d62649", "comment": "Malware payload (Dridex)", "value": "4b7de5b918f7b579df8cfefd39a956eb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "7a66374f-ebf5-4a99-bb7a-67560e59d1c8", "comment": "Malware payload (Dridex)", "value": "29e2d75eb264fc48b599abbe00b37c7ef33d0639329a940bcd51a31852369374", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "b7ac36b1-0413-4e04-abbd-7dd0d2d6fe76", "comment": "Malware payload (Dridex)", "value": "cc0ff2fea654e4ea667fd9a8a1b1cc26012fa478", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498537, "uuid": "cf302829-3c38-40e1-b603-7b37cd9981ed", "comment": "Malware payload (Dridex)", "value": "b4d2a0477eabe0856af9de8e37e7ca476e1fe22ca13ed620310af8bd2945e175ae552368475d18a0165ce467ba9eb64d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "23a5646c-0caf-4507-b4f0-e3089af15dff", "value": "83F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "c41e867e-fe35-43f2-9023-226a70aab88b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "d6c7d027-6cb8-42a1-97c4-0a4e571a009a", "value": "3072:XiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:seAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498537, "uuid": "0112e91f-30b0-4237-a676-cdcc5050a990", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498537, "uuid": "96832259-e955-4b48-838a-7bdd24fe3efd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498537, "uuid": "167400df-10c7-451b-904d-b7b0903ed415", "value": "29e2d75eb264fc48b599abbe00b37c7ef33d0639329a940bcd51a31852369374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2aa575-9e0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618506199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506199, "uuid": "0a93195c-0283-4138-aa0e-a448ab675e57", "comment": "Malware payload (AgentTesla)", "value": "8ba355ee1376f65c1549fff46959ab10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506199, "uuid": "47c54160-6974-4cc6-a049-f45b418014c5", "comment": "Malware payload (AgentTesla)", "value": "29ebec67d2006c81333565581d8c2b123a3fbeee5123180b25feccb3b02f838e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506199, "uuid": "ee973d5c-77aa-4372-92e0-269a94552404", "comment": "Malware payload (AgentTesla)", "value": "08f5e448f97b727e7193e3e476e5e172031047b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506199, "uuid": "376ed61b-d493-4edd-a227-70128df86422", "comment": "Malware payload (AgentTesla)", "value": "880e938ce8115a356213e63cad1fefade9548ff3f7ca9b02a3f53a4d92f40cb4c84be9451932b3249b96cff450c583ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506199, "uuid": "dd6090a6-1a00-44b5-9eb0-eed69687de8a", "value": "B7C4AE506A9CFB82E07E5BF688A054314736AD13D722D36F9CDD78E91A70B82F81D253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506199, "uuid": "f501feb3-e467-4d3f-b1ed-d3b4c36dea9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506199, "uuid": "a7a484ee-90ce-45f7-b97d-2d2b03201516", "value": "12288:wiWNWZ9FmDLDGubMdiCSGR5DtUof+LqNzc9VJxkr:9WCFm3DtSN+me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618506199, "uuid": "71ff814e-bc4b-49c9-850e-96a1e0fbe7a0", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618506199, "uuid": "52810289-cd27-4b79-a5d6-bae05b6c37fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506199, "uuid": "f788d7ae-fd4f-48a7-85d4-9b139777579e", "value": "8ba355ee1376f65c1549fff46959ab10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ad927a-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618514509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514509, "uuid": "9b89f1e8-86df-4abf-b972-a698efa85099", "comment": "Malware payload", "value": "08fac6a7ef626527b6309e5f6583e550", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514509, "uuid": "8c86ab19-b75b-41ff-94cb-c5dab785193b", "comment": "Malware payload", "value": "2a629a91c668103065c4a3f5c9296f0f1534c01cbc1151e36c48720fb69d20d6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514509, "uuid": "1e9ab7b6-6b0a-40f5-ac3b-9de290710f70", "comment": "Malware payload", "value": "8d12a3e92260bc73749a15b36e1da32365fc7b72", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514509, "uuid": "abeb6c5c-6368-4048-ae35-9b5a3c6bbb78", "comment": "Malware payload", "value": "d436b641bf5cf0ed47fa79614734d5c10637b62b4611cdb7a13c204481ae6cb4ac2c7fcdd8e256e413cd0e8cd67c116c", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514509, "uuid": "ffc4fab6-5f5e-48c3-83a4-7e7ae80e73b9", "value": "8AD53383F8D4C720E54D1876E9E78918249FAC92AF0A4D246BED344A757BB2DE7C1334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514509, "uuid": "b9047746-8782-46f8-a4cd-4eddb8ac9d1b", "value": "49152:j2Zw01joiCB09g+nU8n0D9escflidyylv7lZRq8HYoo/Yjq1jE1/RWjb1Fu:j2Zz1sie093fYdyyp7lHq83Qgq1qMbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514509, "uuid": "42f89d3b-da2d-4f29-84ec-853acbcd71e5", "value": 2763776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514509, "uuid": "9de6424e-e415-490f-b16e-11a75e53a701", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514509, "uuid": "0b1d2517-7240-4502-8fd8-de4755076a75", "value": "83325878.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c83141-9e1d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618513387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513387, "uuid": "b26dbba6-5de8-45f0-8fc7-88d72f9a139f", "comment": "Malware payload (Dridex)", "value": "58f3f952dd7ed11ba64447d929e8e3a0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513387, "uuid": "9b8d4682-7af1-41a7-b0eb-1a077ad2facc", "comment": "Malware payload (Dridex)", "value": "2a6e1486e3e5d9cb83ffc5c7934ed7a7f5b391e733e8f4262847188981bb431b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513387, "uuid": "6b15de49-0b2c-4858-b00d-65248a942b8e", "comment": "Malware payload (Dridex)", "value": "7ef86b0128cf3052de2ee97964f6070dad8f172f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513387, "uuid": "5b84a886-4d70-4841-9622-73d3bf6ce34f", "comment": "Malware payload (Dridex)", "value": "9d31c42eba5884232af99f69a031e24edf5e472a48979de4cc9ba6a2479f0fbe0297ea93e15b33ec59c07e4a733fa461", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513387, "uuid": "77292248-c879-48bb-9bd6-11a7eeb35ed2", "value": "E4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513387, "uuid": "59715299-60f5-465e-8884-0a3aa8ba523e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513387, "uuid": "acf50afc-f0cf-4dbd-b3e5-c1ab49f8dc15", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618513387, "uuid": "65f578e6-e17b-4a44-acd8-bc20c5c67f9b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618513387, "uuid": "2dcbf369-9497-4253-8f34-552aef6699b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513387, "uuid": "c95f39b9-cad4-4790-bc48-a99aebc98ad6", "value": "2a6e1486e3e5d9cb83ffc5c7934ed7a7f5b391e733e8f4262847188981bb431b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece98041-9db4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618468595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468595, "uuid": "c01b4541-b062-4259-8cef-a800ed642af3", "comment": "Malware payload (AgentTesla)", "value": "325cbeb8e09f48d7017c553ad34c0712", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468595, "uuid": "0d6d3684-be7d-42f6-a33d-6a1c94803d41", "comment": "Malware payload (AgentTesla)", "value": "2a73be7051b0ada8252c9ab6aec9777a0cbcf477a5551051fca150b05d80d174", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468595, "uuid": "c779bf31-60f0-437e-aefe-777a7c4b3b4b", "comment": "Malware payload (AgentTesla)", "value": "0bc9853c966bde1897649f6b568ea4cc9373b514", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468595, "uuid": "51c74835-2707-40fb-999b-ed1139e8f4f4", "comment": "Malware payload (AgentTesla)", "value": "0597b09ee15fe4f0e6d7baa656a2fe08888683aac4a2461ae5ccc9d5a592401fbf2c4cf7e628a09fb37cd26b0e161674", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468595, "uuid": "47be7448-d529-4bcc-9f88-974cfac31f86", "value": "7CE42361F099431B7B725E08790288B0F18B3584F51736F6E2160E5FFFD8EBC26685A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468595, "uuid": "9da895ad-7533-43f1-aab7-2332815545ab", "value": "12288:rRfSBIEWUtBcFHQN56yDn2Bm0C/KpxDh0hbaZasrTEMecgQwIEXgI:rxH/Fk56yDnkmHKLh0he3w7cgQN2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618468595, "uuid": "cf6a96f0-badf-4232-aabf-e7f565f9fde4", "value": 669685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618468595, "uuid": "60588961-a70f-4fbd-8417-361a5f7454b9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468595, "uuid": "fcbb6973-a927-45bd-a387-d9f8395a8bea", "value": "Purchase order PO1908514.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50bf4e6-9dd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618483615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483615, "uuid": "7246f320-1391-4fd8-a976-a8fc6ebcaf48", "comment": "Malware payload (Dridex)", "value": "680a1aa63d8040214fd0b38877bb94a0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483615, "uuid": "944e5874-6d73-4e92-b7d8-3c2c9057049e", "comment": "Malware payload (Dridex)", "value": "2a78e7afa8ee0db4fcd878cf90a7cef153593715e3c09000622dc14fa0cf5c71", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483615, "uuid": "dda35dc2-7ee1-4b50-a896-4b5393ff5cbf", "comment": "Malware payload (Dridex)", "value": "a8413233a7a01f51ca616a1b47036d6f687907d5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483615, "uuid": "c077365d-b88c-4c9b-931c-f5aaa5768e68", "comment": "Malware payload (Dridex)", "value": "734b78ad645d2c9fc4bd532e055285349eca7c2a89b6128014047d2292faa0ff31e72e548fa3d470af02404c57628991", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483615, "uuid": "bc046be5-73a5-4f93-b291-f62d57ddfee2", "value": "6AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483615, "uuid": "ab41bd22-49e4-4911-911e-cca885a830e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483615, "uuid": "211934f6-78df-4312-bc7d-bbcbc589f976", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618483615, "uuid": "f7119492-d48a-4c3c-ba9a-e139020590b3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618483615, "uuid": "114085d7-391a-4a82-b830-d10caff9ff7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483615, "uuid": "8df85ea6-6d01-4339-a559-c48789de2828", "value": "2a78e7afa8ee0db4fcd878cf90a7cef153593715e3c09000622dc14fa0cf5c71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bab213-9e26-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618517417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618517417, "uuid": "986ba596-883a-43b9-97f0-bff5e71542c9", "comment": "Malware payload", "value": "974e5a81969170823d71683598795bd4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618517417, "uuid": "ab502e99-1e8f-4688-9a3d-95118e8387f4", "comment": "Malware payload", "value": "2a83e5031a308214231a20a8396e3db423d66d0463559d8db31493d5b128a874", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618517417, "uuid": "3ce6a88c-41b8-4dfb-ba3e-0f4efd1fd00e", "comment": "Malware payload", "value": "c0fc8162ec457e3d6fb3033b2903583fae838b28", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618517417, "uuid": "bf404519-9894-446a-a381-382a8d4c44da", "comment": "Malware payload", "value": "bfcc0063e09ce1c01b65813f5d44d659301ce3bcf219a2bb4056156d1ea0adcff3eaed1059e879df9a3376fb860acfa6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618517417, "uuid": "4f4c83d2-c618-432c-9f9b-fa4d09cfc570", "value": "15F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618517417, "uuid": "e09be107-7213-4533-894c-251cc3fcef8f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618517417, "uuid": "8c317433-3f37-422f-8641-44983b606259", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618517417, "uuid": "67e3ef57-cb01-4338-8036-b060b052205e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618517417, "uuid": "568735a0-8d29-4495-a022-dfdbe9f3e42a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618517417, "uuid": "fe2e12e3-2ddd-40b4-b5f5-1b4f7fc6030d", "value": "2a83e5031a308214231a20a8396e3db423d66d0463559d8db31493d5b128a874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642a68c7-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496713, "uuid": "f0184b2c-7cf0-42c9-9aad-6ab92d3636b8", "comment": "Malware payload (Dridex)", "value": "266ba937c1f3fa3567d7d65bc85e4bcf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496713, "uuid": "2c419a8a-ccd6-4c1c-a398-f0154685d2da", "comment": "Malware payload (Dridex)", "value": "2b428041e3516280f32239c461a643e44f89e5ed8a2460063fa17a3af169731b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496713, "uuid": "375a2c4c-4595-4929-b6ce-767b1929a3d4", "comment": "Malware payload (Dridex)", "value": "1b51f3a83dc4b60906c79e2331bb7808bd4b982f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496713, "uuid": "da0f481a-4b47-4ede-bb86-1f1a68b00a31", "comment": "Malware payload (Dridex)", "value": "6cfe2630887740560e360e96e25b27981aefdc792d0c5bc9a8c334f9974bfef2d9b85dceb39b6af3d887d29c9b3ab9aa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496713, "uuid": "dd2cc5ac-c0e4-404c-aa05-64e6e42d1db6", "value": "F3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496713, "uuid": "7a96031d-abdc-45fa-980a-068ac6277c4b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496713, "uuid": "3f524c57-7dd1-42a3-b738-7d9a24fc49fa", "value": "3072:IA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:I3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496713, "uuid": "8b892b7d-0bc9-4c00-ad8a-4c2b17bd2396", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496713, "uuid": "0173773f-8d46-40d6-9e23-9ddb0144fa64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496713, "uuid": "d051f681-389b-4ff1-bbd8-864ec6313d4e", "value": "2b428041e3516280f32239c461a643e44f89e5ed8a2460063fa17a3af169731b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee564e4-9e3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618526205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526205, "uuid": "d43d376b-0d2a-4727-823d-8cac0e804399", "comment": "Malware payload (Dridex)", "value": "771271a92ab8917e13433105ea57f7b8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526205, "uuid": "56a942e4-c5bf-4e2c-b1f3-cbc709cb48f6", "comment": "Malware payload (Dridex)", "value": "2b8549442adf32ddddacfe6a02d4438979b29b39d59d04765658332bb199fce8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526205, "uuid": "e4d240f4-0d16-4246-989a-b4cd44216764", "comment": "Malware payload (Dridex)", "value": "58bba38e2c57379ce55a39fcc26b1fae1b835fbe", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526205, "uuid": "c41efd2e-4139-449f-8369-de53a39232f9", "comment": "Malware payload (Dridex)", "value": "851332de148d72810266d08c82f8064be054b1be7a6a443b892402c27af0c99d77f78a8dc810d148d4da0758cf622ef0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526205, "uuid": "492a4f30-2e6f-4602-99c3-691fd0946c24", "value": "6AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526205, "uuid": "91c82cde-ae91-40d5-995f-e6a367e87b06", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526205, "uuid": "59dc98e2-78eb-41b2-b87b-af8e493a6cad", "value": "3072:0A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:03J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618526205, "uuid": "de955137-c2ba-42a5-a373-2525ce1522e2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618526205, "uuid": "ab7f99f0-61f3-4027-a45b-3b9016159d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526205, "uuid": "27900057-b2d4-4967-bd02-ce9c081fd9aa", "value": "2b8549442adf32ddddacfe6a02d4438979b29b39d59d04765658332bb199fce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2411294-9dcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618478456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478456, "uuid": "a68d71c4-20bb-4d8f-bf1b-35835bef220a", "comment": "Malware payload (Dridex)", "value": "5519293487213b6e42998038a39427a4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478456, "uuid": "a1f0c53b-44b7-4b2c-8e0c-0a73668c0d75", "comment": "Malware payload (Dridex)", "value": "2bda05e22a14672097e953ac22de7808cbecf8b0b278e21b739af0acf3a55cbe", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478456, "uuid": "53c5c18f-f3e1-400a-b61c-7e1239084e0d", "comment": "Malware payload (Dridex)", "value": "05ed4ba424d3191fe3cc556f6ec2da56fee1de49", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478456, "uuid": "3ce3413b-7b75-4ffc-a670-93233fc54bb4", "comment": "Malware payload (Dridex)", "value": "1e031692e5e77f3202299d3b62a4bfe4d974f8690d0b6ba455007005cf798145b1a6089c73bc109842aaada61e349a47", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478456, "uuid": "3f857465-f6ae-4369-ab1f-8c5165c946be", "value": "7AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478456, "uuid": "a7923e9a-ab09-44ff-9c5b-3997ab43b869", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478456, "uuid": "76a3dadc-b6c3-4067-9cbc-f39508dca234", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618478456, "uuid": "dc31f136-0f49-4147-90b0-f6e63194920b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618478456, "uuid": "61aa98f7-2cde-449a-839f-f71ec88cdd1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478456, "uuid": "17367664-4dc7-41f0-a8a1-3b6dc0a78051", "value": "2bda05e22a14672097e953ac22de7808cbecf8b0b278e21b739af0acf3a55cbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618b8d36-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497567, "uuid": "3593fa00-3d33-4ec1-9f27-41f3fd091293", "comment": "Malware payload (Dridex)", "value": "a394c980a223efca9b17dddc9efcc174", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497567, "uuid": "9915c524-abb4-48b0-be22-d54e1aef90c9", "comment": "Malware payload (Dridex)", "value": "2bdbb8dafea8195169cabc2ac544104bf4787eff8f0b05680e368dd6b44e2551", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497567, "uuid": "5346ca40-0fa6-40a4-b193-cd4040b4a65d", "comment": "Malware payload (Dridex)", "value": "9da4c8f184a9932eda73dce342cb2374f907024d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497567, "uuid": "8274a8ff-1cd2-423f-a4e3-5a61e8f034cb", "comment": "Malware payload (Dridex)", "value": "e6e8293e2ae02d85e1ae1b22866830736848915268a330cc2cb15b9980c038f6f594d2161e36a3cbc221f9a358cbdb3c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497567, "uuid": "8c9b742a-3f96-47a4-8b06-26c34e2b24ed", "value": "D5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497567, "uuid": "62f0a38b-7e53-4701-8351-49720e976b42", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497567, "uuid": "72a87b94-6ae3-46e2-a1e6-d69cf21ff905", "value": "3072:8iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:feAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497567, "uuid": "f81172dc-10a0-45d0-a044-e3cc3c1d7521", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497567, "uuid": "48a77834-a024-426c-aa5b-d36f8bad3919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497567, "uuid": "7b1648e3-adcd-44b4-ab22-9d71dfd75949", "value": "2bdbb8dafea8195169cabc2ac544104bf4787eff8f0b05680e368dd6b44e2551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9b073f-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "31faeb65-97ab-47ee-b71e-00faf6a0a2b6", "comment": "Malware payload (Dridex)", "value": "a85cc8867faa9d2d67db6f1d9a1187da", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "45ccffd8-2abe-4aff-8946-f6fe692c88a8", "comment": "Malware payload (Dridex)", "value": "2c0d96876a963d4930f68aea3b17c16efbdff38743d4fdc69ab13d34c82e7064", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "555b0e88-c306-4797-aca3-dd69b6e536d8", "comment": "Malware payload (Dridex)", "value": "8067025bf80557024d6f4cd483430ba02a99c411", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496053, "uuid": "004ae5a3-070b-4a0c-ad3d-854ee812e8fe", "comment": "Malware payload (Dridex)", "value": "d480fe64636214c4269bfd7ddcb75bc7169267c422dbd0aac346a5946975ffaf99f6f4d5ed6aa46134e4f4bb309563ec", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "621abe69-31e2-45db-a6cf-e9f74df94a0c", "value": "9FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "d5ddaf71-c8cc-4b22-9d9b-33baa2ab8ad8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "3c1c73a7-0c94-44f8-a515-eb38f3332908", "value": "3072:xiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:CeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496053, "uuid": "6cfc873e-8611-46fa-a91a-db43bc165921", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496053, "uuid": "78256c72-b1c6-43f4-8e83-9e76caabfa7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496053, "uuid": "619b1324-29f3-4b2c-a8cf-dfa10292dd38", "value": "2c0d96876a963d4930f68aea3b17c16efbdff38743d4fdc69ab13d34c82e7064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e04319b-9dcc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618478690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478690, "uuid": "915d1d11-45c2-4be2-a9cb-78d3d3eea060", "comment": "Malware payload (Dridex)", "value": "9c5a2ef3d31f4198ed3055159e11b58e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478690, "uuid": "3d8e1fc4-4817-42a1-9b51-b38c2379e489", "comment": "Malware payload (Dridex)", "value": "2c50db0ff33c959c4e124655587158f9788218bced63f79c69dc13b3c3c7b67c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478690, "uuid": "fd485efd-c666-4942-ae1d-bd69f5386ed0", "comment": "Malware payload (Dridex)", "value": "7e9cfd2a7e17c159c2bd7058929ee983aa2463c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478690, "uuid": "7a6c48ef-6f45-4804-9c2f-34785fc90a16", "comment": "Malware payload (Dridex)", "value": "6f7fe2691287b46d0ea3590191d2f6a9cc3e27692bedc854c737367b598c27422434f6585a78214c5d3416b51ca5eedf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478690, "uuid": "e6719cec-88fb-4a3f-8cdc-8d66dd957853", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478690, "uuid": "5b46f7ce-2abb-4502-b8f6-581a7951bb9a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478690, "uuid": "25af0c25-e68b-498b-b046-aeeae2e88f0f", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618478690, "uuid": "2e388fda-d379-4e39-ba8e-d3a3153e4538", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618478690, "uuid": "b88942cb-aa46-44d0-93a5-2d37fc8e3104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478690, "uuid": "ae35250a-217d-4ebc-ba86-a3feb5ab81dd", "value": "2c50db0ff33c959c4e124655587158f9788218bced63f79c69dc13b3c3c7b67c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddcfe23-9d99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618456813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456813, "uuid": "35c2d581-2d9f-4387-924b-5e24a1dffe72", "comment": "Malware payload (Dridex)", "value": "575c00bcd66ccb618e206bf8a8d69c4d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456813, "uuid": "2907fe8c-2942-4754-a09a-537abc99945e", "comment": "Malware payload (Dridex)", "value": "2c789911f21b58387cea68080505df06a891f39ac526d62e5a94306d55b85f66", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456813, "uuid": "9a0bcc66-4efd-4540-9a7a-e502e819e369", "comment": "Malware payload (Dridex)", "value": "3a8f15c337361de29bb5f4f072efdaaace07fbea", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456813, "uuid": "658559d1-6f8b-4965-95f0-a8befae643f2", "comment": "Malware payload (Dridex)", "value": "2d00f50207ec0166ce40f1e0c35a936cac80a48ea107c407af97eba6aede3480e106141bf2c90fa3a5484a44dd0afb79", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456813, "uuid": "c6a2b8a4-91ca-4a70-b361-e471a92017b6", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456813, "uuid": "a00c2057-7f7f-4aa6-8857-02c127c1c7ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456813, "uuid": "07bc9afc-0e49-4049-920c-1d67eb7d1e19", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618456813, "uuid": "476a4e58-e993-478d-a97a-6ff1ba757014", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618456813, "uuid": "ef4d8e6a-c9b4-483a-9eb7-24928855fb33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456813, "uuid": "0bd2d195-5743-43d9-bcaf-9d4c70656be8", "value": "2c789911f21b58387cea68080505df06a891f39ac526d62e5a94306d55b85f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e1274f-9e2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520397, "uuid": "1efa07a9-33d4-4b60-ba4e-d3a050e2262c", "comment": "Malware payload (Dridex)", "value": "7e50bb5729ce98709f33a06be6bda8cb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520397, "uuid": "aba0b758-8fbc-438e-aec6-f5c88b93c541", "comment": "Malware payload (Dridex)", "value": "2c88a801d9dfb5d39df0a7a38c30ce0f36df2d9dac417c1daa1a32b16d3701e2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520397, "uuid": "3ff6b986-8460-457c-8634-d10a85993ebe", "comment": "Malware payload (Dridex)", "value": "4896f9aec6cf7e9ec1d6df9f77a4eb573cc730bc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520397, "uuid": "32d7e923-71bb-4c3d-b9c5-aaeae64f0a7b", "comment": "Malware payload (Dridex)", "value": "1810f195840ee0d4a6a5b41745ac2c7be9ee832ab6f3f676479f202750101fa7b03a6e9e1e378051cb2dc3c37f0692f8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520397, "uuid": "b1538e22-53f4-42d9-8a96-d8f4ade333c8", "value": "5DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520397, "uuid": "cc7ef084-bb07-4c82-92ec-f9b7bdccd0e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520397, "uuid": "3b5eb7d1-db84-4632-9b9a-18d0edf9b44e", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520397, "uuid": "c62f2169-51f7-4b29-a6bb-5a8c6c5284d1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520397, "uuid": "a3221e8b-f751-47f0-907b-f261ce32a4dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520397, "uuid": "164a7d91-2c35-4e34-aebc-699d157348fe", "value": "2c88a801d9dfb5d39df0a7a38c30ce0f36df2d9dac417c1daa1a32b16d3701e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207b8bc0-9db4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618468252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468252, "uuid": "5f86d8a7-17a9-41e5-b850-a65b88f7ea74", "comment": "Malware payload (Dridex)", "value": "d797a006e956855c2b975253d6b3be86", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468252, "uuid": "c2603496-5b5d-4d5e-8efa-277d8b4ea015", "comment": "Malware payload (Dridex)", "value": "2cc458e237ef2e8f1e56a259f48bd0449058aaa585e866ddacd3ed1122d32891", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468252, "uuid": "ad39005a-fba7-4950-a22f-9490f43b71a4", "comment": "Malware payload (Dridex)", "value": "568e07c3890c5b09db2f596aee89c8daefe5ede4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468252, "uuid": "8f344642-1d4c-4521-bea8-968ad69d664f", "comment": "Malware payload (Dridex)", "value": "0a8cfb1a69f6c78c530b5854ec434dc45b3a4910561d8fcf129a29f67551f11ac7e91a3d4317681b3222b906c3eabec9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468252, "uuid": "a79d4466-2ea8-4c5b-8e9c-fdb5d4096510", "value": "9CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468252, "uuid": "1a7ab56b-18d3-4cb7-a002-b774844e4630", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468252, "uuid": "2e98699e-7813-4106-b63c-85c03aa53f3e", "value": "3072:uA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:u3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618468252, "uuid": "4ef3c190-d853-456f-9f52-ca0f91f7d775", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618468252, "uuid": "53c44d40-0db6-43cb-b639-e8558cd56d0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468252, "uuid": "86913d6d-47a7-4564-94bc-3182e874d1e0", "value": "2cc458e237ef2e8f1e56a259f48bd0449058aaa585e866ddacd3ed1122d32891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aca6e73-9ddb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618485208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485208, "uuid": "f13db5d7-7f4c-4565-ac4b-b295466e85d2", "comment": "Malware payload (Dridex)", "value": "8625538772f3cc0ac1a588f9d554fef4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485208, "uuid": "249929b2-3945-46a1-93c6-77c004d093c2", "comment": "Malware payload (Dridex)", "value": "2ccd527c5e8f5076289e89b7cc052883e24a2dbc06a55d49a80433ae77d5ec21", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485208, "uuid": "cb623538-d2b1-4f68-ade8-b871f867f3b2", "comment": "Malware payload (Dridex)", "value": "c0f5459b1c099f4fd71dc416683e5a46c025374b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485208, "uuid": "4fa14385-3951-4bf6-ab23-8dddf23d8719", "comment": "Malware payload (Dridex)", "value": "cb84dee402b13c749514f572bbf06ad75cdc8babcb1b0a4d883bc21ad6a84dafd0c3444b92afebf5130ee1994ccbe4a6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485208, "uuid": "96b8f122-a7ad-449f-b4d7-2c6fbd0cb1d0", "value": "6FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485208, "uuid": "06d6fad1-0399-472c-b303-60fe0f8c4be4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485208, "uuid": "d7a417cc-3a20-4bb4-bd82-a6db2619db2d", "value": "3072:Hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618485208, "uuid": "4e55eda3-a488-493b-93cb-887c80cde835", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618485208, "uuid": "f7a908ed-aadc-4457-9924-0354c63a55ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485208, "uuid": "810f064c-ab25-471a-a3ad-14276d503f2c", "value": "2ccd527c5e8f5076289e89b7cc052883e24a2dbc06a55d49a80433ae77d5ec21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23592f9d-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618498752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498752, "uuid": "40f7c075-6a52-4958-a52d-b46cc2fb98cb", "comment": "Malware payload (RaccoonStealer)", "value": "8427425712b6d0d560b9c3c460036689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498752, "uuid": "e010888e-fd4d-497a-83d4-d084bff06ed6", "comment": "Malware payload (RaccoonStealer)", "value": "2dce7fdaf0e4da29585a84a1ac8dd655b5406721ff6420b39eb453879f6bca5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498752, "uuid": "f065f47a-f884-4490-bba4-56e54cf09ab3", "comment": "Malware payload (RaccoonStealer)", "value": "9a749567bdc704152bba350b20afcc7284bcf63c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498752, "uuid": "308b173e-2b04-4fd2-82de-a230dd84a79d", "comment": "Malware payload (RaccoonStealer)", "value": "660e2c9a171a7d992415e1d8891bc597ccd0a7aa9d45e03ea5743dcdace0c4e4a292220956b2ee3d84192e3444f66e39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498752, "uuid": "25908cb4-72bc-4981-9e04-a706e451cfbb", "value": "26B4E01136C0C073D193247199A9C7F51B6BB8755B6296CF6BC81BBC8F346E29B21B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498752, "uuid": "6f54f7f4-f31f-4a0c-abd4-ac0e5464b653", "value": "03bbd5f96704bd9fb2cfa55264805236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498752, "uuid": "b94f3120-59b7-4130-a9b3-347150d2efa2", "value": "12288:/gDmrhvjGjhaq5iYjazSD3ien9zNrD2X:IcChaq2SDZ32X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498752, "uuid": "dbcfc949-bac2-4448-8a00-813b404fad46", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498752, "uuid": "aef456c9-e286-48e7-a308-6df041d55ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498752, "uuid": "ce954673-7d5e-4079-84cd-d6476efc014b", "value": "8427425712b6d0d560b9c3c460036689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5b364c-9df3-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618495307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495307, "uuid": "3b674357-3b0e-4f69-a584-f4564fdb2bda", "comment": "Malware payload (NanoCore)", "value": "72bd0c31ef89a62a08cfca0b4d072e7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495307, "uuid": "7ccfedd6-5025-43ad-ae35-5181dc93b74b", "comment": "Malware payload (NanoCore)", "value": "2def1a4491ece08cc5489400f1ccf2475538bc981a18c149e0c6ba2e71925759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495307, "uuid": "a571fecc-6451-44a8-a6fc-87cf6e9c0560", "comment": "Malware payload (NanoCore)", "value": "420ccaf86c2a694c0ca9122870d18fddf58bd53f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495307, "uuid": "8b5b88b0-57a3-4d2f-a390-6629ea418bad", "comment": "Malware payload (NanoCore)", "value": "fab78f6a9854d045df4931fc43ed111fc64d683398eabc3fc3a8895ae75b89a19dd2842db721165ac4331f7a45b14419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495307, "uuid": "36be333a-d541-4ae9-9cd2-bc44fb8f857c", "value": "CF7412B7318071FAC8514D7019251AA27BA3CE2562E16B17B794F75E5E3B0D0EB0F2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495307, "uuid": "4d573c06-4598-4d14-bc88-14da48f10a16", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495307, "uuid": "26fe10a7-780e-4462-a101-4bae2dc26167", "value": "6144:sPXnmst9IxdG70dmVNzs+GKKZ/GA8ChM1SFqobt2rAO7nIwtiP14l:KX70IVNzRGtxhM1SsobgAanIwoPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495307, "uuid": "cf90aa19-8301-4dbc-827f-c205ec06f5bb", "value": 348522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495307, "uuid": "f3ed1922-6988-4654-800e-faa7dd080fe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495307, "uuid": "dba1a192-1f12-4019-a4b1-dae290dbfb5c", "value": "MT103 Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656a1494-9e18-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1618511318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511318, "uuid": "78980621-11f6-4506-8144-57c304aee8b1", "comment": "Malware payload (BazaLoader)", "value": "1fa020f37a9780eb6e8203d9723c6256", "object_relation": "md5", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511318, "uuid": "88a80012-d11b-498e-8b4b-168363854d38", "comment": "Malware payload (BazaLoader)", "value": "2e5275c35b262674705f3c2bd6becc80a067f2660798881d0f5344ac97bd592d", "object_relation": "sha256", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511318, "uuid": "97de5b56-4129-404b-bba6-1d2402fca8e0", "comment": "Malware payload (BazaLoader)", "value": "0a2c0f582ca9a6f2a95100235ac199be1c1aa37a", "object_relation": "sha1", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511318, "uuid": "31bd9400-70cf-4438-8729-51ebf25ca8e4", "comment": "Malware payload (BazaLoader)", "value": "25f2507c4f3ba629fc76e34da57eeb6769e6f71059f0855f5fed51b17d4a4164c54f1230b4f50a65ce05d23933b2e5fc", "object_relation": "sha3-384", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511318, "uuid": "eba398cc-1023-492f-96b8-e58d2ac21a13", "value": "0544AE43F29240E9E17FC6768E915626FE3138265B34DE1F436047A1EE32B90AE2DF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511318, "uuid": "36deb402-c458-4adb-8967-5df260f2eba2", "value": "cc214655089f13d387ac39cfc5307c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511318, "uuid": "6dc32aab-9d0e-455c-8312-7be5aee821a6", "value": "6144:apbsp5OF6v4GNlEIlVpCq6RCEEot8BA9LhzC7jlc:aRsp5OF6vBNlllVpCq6Rw0BC7jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618511318, "uuid": "b6a77afa-6209-46f9-8103-c3b02f6662e6", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618511318, "uuid": "0be6dd3b-10f1-4c96-8a82-c1056857ad5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511318, "uuid": "d4ddd39b-8d1f-4b32-b77c-00232c24cd85", "value": "erihds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905bdeae-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "a162931c-6f62-4ecf-8608-2f043f0eaa74", "comment": "Malware payload (Dridex)", "value": "676065c22879e3b4e434cbff894de316", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "68c7c376-73d0-426c-ada5-f837d6836ed2", "comment": "Malware payload (Dridex)", "value": "2e8863505115178b923e8591a0fa1956a7e09ac279b6a56590c40ab879bd2ea6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "42057cba-7a8e-424b-944a-d98f7741ab04", "comment": "Malware payload (Dridex)", "value": "448e3028b2e148235a77164ec1363e2e15892340", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496787, "uuid": "4ca23c65-cfd9-4807-912b-6f015c0542d5", "comment": "Malware payload (Dridex)", "value": "6fb77a6f8885e87807438298ac9a3d2cbaebfddb5daba795e1baa0ac4a8cb54429de425bc878ed38360968dd381fb29f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "7708fe0f-1bb8-4e8a-b4e1-33dfd9ceaee8", "value": "07F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "f83d5d8b-83da-43aa-b815-e421bd40b22a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "32a7bd68-b882-4350-98b2-928099d637fe", "value": "3072:nA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:n3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496787, "uuid": "d114005e-263d-4d8c-985f-707870b4f123", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496787, "uuid": "45e39959-a6ec-42b9-83fb-5fb0b2dd78da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496787, "uuid": "41b4985d-4490-4818-8d02-359b9172ae02", "value": "2e8863505115178b923e8591a0fa1956a7e09ac279b6a56590c40ab879bd2ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d23eeb4-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497157, "uuid": "1786cb43-3a1e-4ad0-b9c8-3564ae472926", "comment": "Malware payload (Dridex)", "value": "a929ec71658ab2d50cee1a63923b1687", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497157, "uuid": "51460948-9416-4f12-94b8-cbb8d19f4922", "comment": "Malware payload (Dridex)", "value": "2e8b1159ccfc19a827ceeddaef15ad5c96afeedab827cb5ac3fe075346c47f8b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497157, "uuid": "546285d5-9068-4910-913a-a7c0f538bfe8", "comment": "Malware payload (Dridex)", "value": "c2a77b61cddfe11517d64eebcea4f31e68d0ff4b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497157, "uuid": "9162b381-3378-4813-8c12-fdb268f25209", "comment": "Malware payload (Dridex)", "value": "5e0583ac89eae30f82cbed0c593a2e4a0bda34802509e60ea602e20789d6755458760ac0e4d74d86883e6e6dd011375f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497157, "uuid": "f37aa085-fcd5-4454-9984-e8626e110dc0", "value": "8CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497157, "uuid": "5ac4f447-7fdc-4c9c-b2ca-72f9e64ccdda", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497157, "uuid": "77efaf43-134d-4aff-91ac-99737a2f5933", "value": "3072:6iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:5eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497157, "uuid": "b31f0521-f36b-4748-9dc4-5e7794efe7ba", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497157, "uuid": "12facdae-133e-4141-9490-86c5db8aabe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497157, "uuid": "41e210db-33b6-4755-afd4-79b93889fb29", "value": "2e8b1159ccfc19a827ceeddaef15ad5c96afeedab827cb5ac3fe075346c47f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dda9c39-9e0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618505614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505614, "uuid": "8c8ea9a2-2bd4-4cdb-a8d6-3c030e5f2fc7", "comment": "Malware payload (Dridex)", "value": "cd1812358c8e30745894a070a8eb2a8d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505614, "uuid": "18e45993-29cb-4e42-9ce7-21f5d3653380", "comment": "Malware payload (Dridex)", "value": "2eaf4081463a2b85cb3e794d194c5c3298a77bff488a207123d63141fb1d498e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505614, "uuid": "280e1db1-e123-4c1d-9abd-da6ea7a000c6", "comment": "Malware payload (Dridex)", "value": "cff5997930b4343733edbfa2dcd0d9813bc8b26f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505614, "uuid": "f1f449c7-bb6a-4048-9f8f-7d3c3e238a18", "comment": "Malware payload (Dridex)", "value": "5167b1f1439ba1460aeaefb231fb75167d315a2dfa4e2017ccd84a4c35d3d63cca78ef9888e2d13833dd02af07676801", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505614, "uuid": "b89ea167-c157-471f-8bc1-9fe0a4432953", "value": "96F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505614, "uuid": "a3d3d18e-d7f0-4c58-808e-337b57b4cc43", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505614, "uuid": "479723f9-3046-4b23-b5c8-e39a726db1b1", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618505614, "uuid": "81ec5ba9-3b89-4f7d-9299-6d16f34c3e83", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618505614, "uuid": "f6d827a7-b38d-4e90-941d-e0b98245f1b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505614, "uuid": "a8c36848-df04-49a8-9d8e-a35fcad43307", "value": "2eaf4081463a2b85cb3e794d194c5c3298a77bff488a207123d63141fb1d498e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a857f7a-9daf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618466256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466256, "uuid": "6b02dddd-9c09-4fb4-bc9d-14bcbce0769b", "comment": "Malware payload (Dridex)", "value": "f0415ba82dbea5382fdbcd9567040b94", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466256, "uuid": "eb71a01b-423f-4775-943b-adf328d3d437", "comment": "Malware payload (Dridex)", "value": "2ee5ecd88aa0e726a7ccbe69ab7c67522f3565883d6e804ab963c755268a641b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466256, "uuid": "625469b4-db4e-4dc0-b527-8f7b9e1e790a", "comment": "Malware payload (Dridex)", "value": "7f6ba6241e1666e530452738e839a37a13da2d0d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466256, "uuid": "57ccd12f-e050-4a2a-b29a-350e11cddfdc", "comment": "Malware payload (Dridex)", "value": "57ffe84e0f8eac46b5ae93ec5e62fba39b314a753a09f076f4397d2ff1cdf4205ad552016ec82f0579f1ae327d4e65c8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466256, "uuid": "aa396012-a3e7-482a-9062-548f4621edc3", "value": "81F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466256, "uuid": "117dfe02-417b-4b5e-be35-a8d9481a9476", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466256, "uuid": "ee2b8d02-b377-4c01-92b1-5b4ab227019f", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466256, "uuid": "4b2df3ba-66d1-44d9-9ffc-69eaf8ea2fb9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466256, "uuid": "9d3ce68c-6e15-45a4-9b66-1741033f0f15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466256, "uuid": "8081efd3-26b2-40b7-9fbd-4018bf0c9864", "value": "2ee5ecd88aa0e726a7ccbe69ab7c67522f3565883d6e804ab963c755268a641b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8562bb-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495950, "uuid": "c12d0176-63cf-414b-80ba-b173a7486144", "comment": "Malware payload (Dridex)", "value": "c0ac064771d11cfd6441f0c8caa99718", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495950, "uuid": "1e1fa443-33fb-40ce-9aca-eb35f2a1800c", "comment": "Malware payload (Dridex)", "value": "2f03caa9e3bc32527405cbb06b3bd4dc6b41add2262d1a82069b4949da7f0a86", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495950, "uuid": "fc2152b2-2015-45d9-ace9-dc6c2be7b495", "comment": "Malware payload (Dridex)", "value": "c53b5fa328e865c67a3e1cebc86fcdc30360f401", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495950, "uuid": "7b3e8601-3a5a-4dd2-8c76-dca0d4dfadb2", "comment": "Malware payload (Dridex)", "value": "75d5953055353fe05982391b41c586181b31c4a94ff5906fa9bd944b5cb9e10cfceb468b69dda6aca67a3cc93c3427dc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495950, "uuid": "5be96c62-b46f-4822-88d9-d46569b9a51f", "value": "5FF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495950, "uuid": "2f85c1f1-2cc6-4a53-b251-d29952d225a3", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495950, "uuid": "49ccc9bf-a0ec-4dd8-9a43-6754840451e0", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495950, "uuid": "ec9419f6-8aff-48ef-9ad0-94945c10636f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495950, "uuid": "3ce93381-4225-4c5b-9cd5-9916bd0eb568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495950, "uuid": "eadd4225-2d3a-4f0d-a3a8-a9bc8485b47b", "value": "2f03caa9e3bc32527405cbb06b3bd4dc6b41add2262d1a82069b4949da7f0a86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cc1406-9de8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618490674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490674, "uuid": "98c8fa9b-0c7f-4608-aea4-36ffd90a962d", "comment": "Malware payload (Dridex)", "value": "f37f085f6a993a2e0584bd8e60286e9f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490674, "uuid": "b7cd42c9-6f8a-435f-9504-f72a3487d02f", "comment": "Malware payload (Dridex)", "value": "2f03ddbc201057c0f53957b4a27ad492eec1dbbcd1835b3904c10fa681ba8b53", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490674, "uuid": "223be606-9b9f-4826-a0f3-4b68bb8a2798", "comment": "Malware payload (Dridex)", "value": "d57f42d2d02b8cde49736a2d947b4c40b958f48c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490674, "uuid": "575aee58-6009-4e05-bc82-f76ccd6bf7c5", "comment": "Malware payload (Dridex)", "value": "0bd287c6f2ee9ff8701613405f36b718f03b2c43912f6fce9e405a54c5d3156d1a17453e26722a5c5f6d1efb78d6862b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490674, "uuid": "f26959cd-eda2-4633-8f96-ae7262fafd2b", "value": "75F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490674, "uuid": "d6098ff5-c328-4cee-a69b-f243d1875fa7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490674, "uuid": "47f0c22c-a492-430a-a709-c9e89a6488a4", "value": "3072:+A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:+3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618490674, "uuid": "e9d32ec5-7ba9-4a24-9373-fb08e7059a16", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618490674, "uuid": "3c5fb98e-b6b4-482f-88fc-e298cca851f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490674, "uuid": "32ac84bc-8d23-4a6d-9bca-f45b548535fd", "value": "2f03ddbc201057c0f53957b4a27ad492eec1dbbcd1835b3904c10fa681ba8b53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2249f48c-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497461, "uuid": "76209126-5912-40d7-b4bf-50d855c2111e", "comment": "Malware payload (Dridex)", "value": "01cff2c1da9b86cad649834256a64785", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497461, "uuid": "4723932d-4575-4f55-ac95-b0135ea64520", "comment": "Malware payload (Dridex)", "value": "2f0bfba914061bf147b3c15a37eab25034bdd1ff06f8cbd53bbe2c6ece0d8271", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497461, "uuid": "096f0e52-b0ec-4fd9-813f-a92480aa88b7", "comment": "Malware payload (Dridex)", "value": "b9c0eb484d28f9559c3e6b3f13b673dcaf80a128", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497461, "uuid": "3b3bd1eb-d9d4-4528-b776-d84493a97f79", "comment": "Malware payload (Dridex)", "value": "2716d6da8e862138db2328be4389cbdcbf4514b7b494ebaf6e96b3be46dbd1aa776ab33058d0dd68e17369b427459b71", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497461, "uuid": "d2ca21c6-49a3-4b63-a396-7aa8de7f6dac", "value": "83F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497461, "uuid": "55cacc77-04d2-4bcc-826c-8999e857f5e8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497461, "uuid": "8b97907b-052a-44cf-8ca0-b2f7506327d9", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497461, "uuid": "c39c9a74-e9e1-463d-a992-485c51cbb2d4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497461, "uuid": "ade25829-a882-4e79-99e4-5243b21b8b14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497461, "uuid": "00f3a261-39e0-4f2f-a825-6ef9f6f28311", "value": "2f0bfba914061bf147b3c15a37eab25034bdd1ff06f8cbd53bbe2c6ece0d8271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00702b5b-9da2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618460468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460468, "uuid": "996480dc-224c-491c-aafa-ec0fe73b69e2", "comment": "Malware payload (Dridex)", "value": "6aac643044ddbbd43a2bbdf0bdac9aaf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460468, "uuid": "f2f7a002-6f58-41db-bd7a-cc4621fe0d8d", "comment": "Malware payload (Dridex)", "value": "2f218557b50cdc29ef2b1038ceeacae052288427e0c16ffa3c94e084a2df87d7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460468, "uuid": "35914182-8c18-4830-bd20-1a5c93678acf", "comment": "Malware payload (Dridex)", "value": "cee6c7b86fe3c9e68c2ec30290fe54354d3b163d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460468, "uuid": "5be811ea-71d9-4404-b7c8-55a0f9238453", "comment": "Malware payload (Dridex)", "value": "77e22eefc799c82739622d776bcb3e3c5ed8f95666e279f32cda9be889e55ec2a528448f9ec6be3f8d4bf07c7b7d22e1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460468, "uuid": "9425e815-ecf6-4aa7-8188-049cf26bfe1a", "value": "F0249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460468, "uuid": "5f9057a6-527b-4842-a68e-4ca8f4e9dbf6", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460468, "uuid": "e36ce511-f236-479a-b3b8-26cbf9d8366a", "value": "3072:R0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:EpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618460468, "uuid": "49516e28-4362-4d1d-872c-aabdafa219b9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618460468, "uuid": "d9140ffe-a6e4-4799-bb01-77bffcff66df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460468, "uuid": "51ee2337-4d61-44b8-9087-51b337ba36bb", "value": "2f218557b50cdc29ef2b1038ceeacae052288427e0c16ffa3c94e084a2df87d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438ad077-9da4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618461439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461439, "uuid": "dec3dc8e-c22e-4152-bbf5-38c22b3ba6b3", "comment": "Malware payload (Dridex)", "value": "347ab59ccdf5f046c1dd2d333a4c6e1f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461439, "uuid": "ed2e1a9f-a039-4a6b-91b3-08a394b2bd73", "comment": "Malware payload (Dridex)", "value": "2f541f012271d45dac2985cb812e68bf5d6a0e6fbcc09bcc1e41e29ecefac76a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461439, "uuid": "596202ee-4606-42c9-b7be-46c2a83d02bc", "comment": "Malware payload (Dridex)", "value": "c4ed32a731249119298bf4656b61457057f1c3d9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618461439, "uuid": "c168b5e6-258c-4567-8689-62a077c23938", "comment": "Malware payload (Dridex)", "value": "20cde5fd8fdd52e692f5b54c9efba8e5eb99883a3586e71ac5442c1702ae7e916bd99476c0fad8f24a6963b0e6659eb8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461439, "uuid": "d3d93489-cd10-44a9-bcd1-1ba17a39f020", "value": "14249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461439, "uuid": "d3014f1d-7aa8-43a5-8af6-c2d194926b35", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461439, "uuid": "393405e8-cb9a-4221-ad96-a9feca746da5", "value": "3072:k0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:PpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618461439, "uuid": "697538da-472f-47f0-b54e-feec42e75547", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618461439, "uuid": "d818acbb-c4b9-458b-baef-eae57144ac70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618461439, "uuid": "ad91dd96-7511-40f8-8a98-f4fead6060bc", "value": "2f541f012271d45dac2985cb812e68bf5d6a0e6fbcc09bcc1e41e29ecefac76a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caec10d-9dc1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618473856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473856, "uuid": "033015f9-2456-4f63-a816-1b790575df40", "comment": "Malware payload (Dridex)", "value": "e13e237ae5ec17f54dc2200a9f1c0a30", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473856, "uuid": "2cdfade5-92c4-44bc-a9e9-51833d110470", "comment": "Malware payload (Dridex)", "value": "2fb6b8d618acd820bc3ef55db2956c8ccf92ae2a2c1eb3fb30afb69d6f41fb4a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473856, "uuid": "56b42701-a456-4aab-80a6-5e650db4c6b7", "comment": "Malware payload (Dridex)", "value": "10d89759c3aaa0d2aa426634255cc0315c168251", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473856, "uuid": "57c2806f-6ec9-4ac3-b586-80c7bdc344d6", "comment": "Malware payload (Dridex)", "value": "ac5b3a2c627fd5481ee2fc298b71e7d8b64f56413a877845f82de8523333244661970398ee93c4d1696ee7ff6a2314eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473856, "uuid": "a36b7046-48d5-428c-980f-ff8947bdff3f", "value": "ED249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473856, "uuid": "7942e853-483b-4d7b-94d1-5bddd4f0a5c2", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473856, "uuid": "943a9887-1e3e-4032-a2b4-a4dbb398738b", "value": "3072:/0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:epepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618473856, "uuid": "073087de-cafb-489e-ad8b-6c130dd3dce3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618473856, "uuid": "a5676225-0bd6-4fdd-9092-847577d9c6bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473856, "uuid": "a3c4f8b6-e534-44c4-95f3-3f20e90bead9", "value": "2fb6b8d618acd820bc3ef55db2956c8ccf92ae2a2c1eb3fb30afb69d6f41fb4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e369c9-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495875, "uuid": "dacaa3ac-c844-45f4-80cd-fb0826440080", "comment": "Malware payload (Dridex)", "value": "96984d25f16f02fab9173ec3e8dc2e8a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495875, "uuid": "d2303ecc-3fb7-43c4-8c99-e021fd9987c6", "comment": "Malware payload (Dridex)", "value": "2fd388ff39a3abf41867a3b7e005f201d0700e46de45194c4cca36a295b4a208", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495875, "uuid": "7cc9b7ca-616f-438b-81ed-cc0174f26b52", "comment": "Malware payload (Dridex)", "value": "91dc3a8cc0f24af78c9c6409bfa1f002092ef514", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495875, "uuid": "53af5451-d85c-44a1-b093-b4a6a2c7d0a3", "comment": "Malware payload (Dridex)", "value": "0e1f65460f845270773521816e4731938b1da05173469d5be9698a9e8ba77e70af64cd8dffa3213c337122e4c0cf66da", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495875, "uuid": "6581e02a-8157-4ce5-bd0a-963e6cf3059a", "value": "80F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495875, "uuid": "8a4028f2-f7c5-4850-91c8-a66a49b6646d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495875, "uuid": "cda0a61c-722e-4116-8134-ec715fc03741", "value": "3072:uA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:u3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495875, "uuid": "2fa42a5b-c059-476c-9196-23fca853bce5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495875, "uuid": "8af9881a-c55c-4984-a771-9d88fa9d8ef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495875, "uuid": "18a0a368-842f-424e-a48f-a0a6a21b40ca", "value": "2fd388ff39a3abf41867a3b7e005f201d0700e46de45194c4cca36a295b4a208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2ec972-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498983, "uuid": "59d47e9d-cdbd-4bd9-b0ff-bba437cf843f", "comment": "Malware payload (Dridex)", "value": "4a81623353abbdf8dc0635105e5a1acb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498983, "uuid": "72ffb319-2c3e-4b1c-b138-d789697da057", "comment": "Malware payload (Dridex)", "value": "2fdef84bc652650713f9353fc5a0a3f5612c737d018c0a0f4af759e5964e06fe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498983, "uuid": "a5944592-70f4-4892-b314-6dd46bdb7b0d", "comment": "Malware payload (Dridex)", "value": "d1e8b32636d271e4c555c708abb011305427aab3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498983, "uuid": "f8c59322-3490-4da8-a1fa-5c388d8c9d72", "comment": "Malware payload (Dridex)", "value": "b7db4b1b32c21e2c545469d47ef434c1cfed8750b6560c09e6a81046fe41d8ad4d3b5b3a08425acade4945763b244438", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498983, "uuid": "3831db5b-da5b-467f-b1cf-26386844532e", "value": "B6F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498983, "uuid": "80a0d523-9c15-445e-baed-bc1445029997", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498983, "uuid": "d9f7d7e3-d8ec-4394-b005-3e0d3fccd81f", "value": "3072:UA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:U3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498983, "uuid": "1a0aaee5-7917-45d9-91cc-d1b4b9fde856", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498983, "uuid": "5821619d-670d-43b1-99ad-6a331f59577d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498983, "uuid": "1d3f73d0-5b35-4bb0-b685-8bc68efedafe", "value": "2fdef84bc652650713f9353fc5a0a3f5612c737d018c0a0f4af759e5964e06fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57120af-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464207, "uuid": "66e99ea2-d882-4b51-8e0e-790874b18e3e", "comment": "Malware payload (Dridex)", "value": "59cbf723b2639ddff091274977390140", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464207, "uuid": "c1c57e54-245d-4a25-aa51-393d357c687c", "comment": "Malware payload (Dridex)", "value": "2ffb7f169759bfa9ceceb42c55148cb9332129b219c37e310b42a2a120fa14c2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464207, "uuid": "e7d30cc8-aba6-450a-afff-6af7cf7296e4", "comment": "Malware payload (Dridex)", "value": "9051391fbb7828d36693a279ca8d7035686a0559", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464207, "uuid": "51111280-2bca-4587-be70-19f0b1ad93a8", "comment": "Malware payload (Dridex)", "value": "b1537934803412438c11c05b3e1bff5dedcc0733524e35bfd837a01c183fba689e2cb4f197061e36095e9fcd3bcbc4d6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464207, "uuid": "39993939-2035-4b89-9cd2-ea989dcc0dd1", "value": "F4F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464207, "uuid": "b9e22f10-645b-4589-836c-6606b59a7daf", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464207, "uuid": "b0061ecd-0c77-461f-8122-a9755a158c7b", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464207, "uuid": "439c61cd-794d-4266-bdf5-167d9a6433fd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464207, "uuid": "7a612e4f-5de0-4563-964e-0807c7aa537d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464207, "uuid": "4b15c203-06a9-49a3-96ac-ba53a23cbefa", "value": "2ffb7f169759bfa9ceceb42c55148cb9332129b219c37e310b42a2a120fa14c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4172500a-9e16-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618510398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510398, "uuid": "3b2b7776-96a6-489f-a6fe-64ea30c19acd", "comment": "Malware payload (Dridex)", "value": "58b4c4217bc88553e799f48f5ba3c922", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510398, "uuid": "6759599c-9ff8-4cbf-af2b-9da257989fe2", "comment": "Malware payload (Dridex)", "value": "3022ee64417a5512b5d5dc29e70977072eacad43683f1f50a195acad94c1d82b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510398, "uuid": "bdeefabe-0649-437b-8d61-41b6abe1c06d", "comment": "Malware payload (Dridex)", "value": "f70a58fa01ff7d04664b36163e31bca18e1f7ea2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510398, "uuid": "4e10ca48-3943-4a96-82e8-bb4318c09b2a", "comment": "Malware payload (Dridex)", "value": "c85f3124f97cd0bfec2c4e19188eec56b23e50713015db757fa5481f508691ca9c9811b9db3ea5109e9aca5f2d7d7229", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510398, "uuid": "c9adf25f-f460-4b42-96d9-d8da5b53fd45", "value": "A5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510398, "uuid": "7f1d18ee-4c69-43bf-989f-8ebc062aa0fe", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510398, "uuid": "3d90bc7e-9dfb-4b1d-bc56-c0841b091c69", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618510398, "uuid": "d359c475-7eba-45ef-9c3c-9b0e1daa23a6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618510398, "uuid": "3047a26d-98f8-4479-a9cb-3fdb79bfeef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510398, "uuid": "77a888cb-5c41-4a8e-810a-3ffcf8bc4e50", "value": "3022ee64417a5512b5d5dc29e70977072eacad43683f1f50a195acad94c1d82b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86e1c0f-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618514437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514437, "uuid": "3e98fbaf-6e5b-41d6-8db7-dc62d9ecb476", "comment": "Malware payload (Dridex)", "value": "a9e2db643b5bd79c306987708508f207", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514437, "uuid": "b37b3225-5010-4e46-a992-3b640e39d718", "comment": "Malware payload (Dridex)", "value": "30a4b5390606933c21c295e694f04eba80840d13d717eca92379d9e8ffa063de", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514437, "uuid": "ed4534ca-89af-4ab3-8c51-f300ce8ef5a1", "comment": "Malware payload (Dridex)", "value": "c83b6e4f419fb5140f258583ad8cff34d86b96ea", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514437, "uuid": "249bcfc9-ed3c-4193-b6da-e1e441b74f6d", "comment": "Malware payload (Dridex)", "value": "f2031b7c88d0b07b6ca734ed4291ed13c995e7c6d27c49f5abbec6979f52f6a069d52efb90153ba651b952597d7eb03e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514437, "uuid": "615146a5-fc27-45c3-b50a-9cf2dec85dc0", "value": "06F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514437, "uuid": "ab4136da-f879-4ecb-9f7e-34db49e33894", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514437, "uuid": "b4927544-fe28-462f-a6bc-c28b61c4ff7e", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514437, "uuid": "b2322a0e-ce3f-4c47-a523-8ed798a092f7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514437, "uuid": "1672ba3f-c996-4bcd-88db-eba4770f1ab9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514437, "uuid": "073fe30a-4570-4381-8cbf-ac5e956e9d5f", "value": "30a4b5390606933c21c295e694f04eba80840d13d717eca92379d9e8ffa063de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b99590-9e17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618510833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510833, "uuid": "e3176dd6-ddfe-4471-8fb3-36da75d8fc68", "comment": "Malware payload (Dridex)", "value": "1519d5bf4829d40d68ec89a7a89e7bb9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510833, "uuid": "9894ea6f-400a-470f-b61b-2203adcb9bb5", "comment": "Malware payload (Dridex)", "value": "30b282a9b2c06251046ff0bc65de825eaf3b311285cb07085d70e39b5cc2e980", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510833, "uuid": "ae4958ea-ee7e-451e-b117-b892e9d405b7", "comment": "Malware payload (Dridex)", "value": "94537736fcfcb53af9e695f317be9565ca840a88", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510833, "uuid": "9cd6247e-53d9-4d37-bd4b-773f7c9ad9f5", "comment": "Malware payload (Dridex)", "value": "2340d3a69a09a10a00adaed0cdfd730ff66e80fa3f1cdc105d20dbda4169dbcf135b334f073dadfba6be9158018a9a9a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510833, "uuid": "be519325-45be-4917-8122-9f00d30c7220", "value": "6EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510833, "uuid": "d264fecf-18eb-4986-8ee8-77220e59c54d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510833, "uuid": "11feae72-6d3b-436f-8667-b349826e32e0", "value": "3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618510833, "uuid": "21846bc4-5fff-4cb8-b058-124c2b502a87", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618510833, "uuid": "6c8c7bef-277b-436e-ab11-527b8effcad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510833, "uuid": "f2b7e864-19d7-46ae-878e-dd568844821f", "value": "30b282a9b2c06251046ff0bc65de825eaf3b311285cb07085d70e39b5cc2e980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf6afa9-9e41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618529153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529153, "uuid": "8e4f057b-a3f3-498e-b4c9-854ef55451bd", "comment": "Malware payload (Dridex)", "value": "959489d773b8b2b5e09754cbe9f2aff0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529153, "uuid": "a2cb21c5-5bed-4bde-9c24-0c6813bfd76c", "comment": "Malware payload (Dridex)", "value": "30b93682aa312b169b2ca8afb5b585583ad2d1f9436873fd74ca083bed453dff", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529153, "uuid": "74a91934-969a-4998-8ea4-1aa24e9e041f", "comment": "Malware payload (Dridex)", "value": "b8a0f2573fb09548cd2c90a466b027f05d0b5b4b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529153, "uuid": "07faa728-d859-45e0-87fc-71026ab391ff", "comment": "Malware payload (Dridex)", "value": "aef153d8845aa27ed3c536e27965734ffeb55e8fc7648fcd006fde0339dc8cbf6251afda4dd05071ecaf4efbd5371628", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529153, "uuid": "010efa2e-b136-42a0-abd8-c234b4cae753", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529153, "uuid": "2c392882-7692-4771-bbdd-98bedb2af14c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529153, "uuid": "284fc43f-7670-4f98-b04c-6d755c037844", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618529153, "uuid": "3c541271-b407-4b05-83f5-409fbd1efff6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618529153, "uuid": "d1008dbd-2f03-461b-b23a-8527f1729af2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529153, "uuid": "8e4e1b3b-6880-4642-97ea-8eacab53da1e", "value": "30b93682aa312b169b2ca8afb5b585583ad2d1f9436873fd74ca083bed453dff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa31cfc-9e21-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515442, "uuid": "8f479843-00a5-4452-b753-a6bd9eb4cd5c", "comment": "Malware payload (Dridex)", "value": "f87a300b4b5133a41cd8b3b6c467aeea", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515442, "uuid": "d958d044-dbd1-4fa2-bc67-c50d79e943c3", "comment": "Malware payload (Dridex)", "value": "30df5c7e09b549684b0027f8a9a4f91e40514d400b663afc9e3c3c4dcb4b8695", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515442, "uuid": "76fe2865-4863-4eab-a5ed-5199afec38ba", "comment": "Malware payload (Dridex)", "value": "dbddd8fd337a2534411e36f87fcb5e4f783a74cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515442, "uuid": "b0a33954-4cbf-439d-9e2a-cda6ff353b2f", "comment": "Malware payload (Dridex)", "value": "8c16775b2359cd6db31653f4c8d9c44d8209ab23b77e5d10d3dfb5b28df52c989da62d73867cc5719322e0d0a72721d9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515442, "uuid": "a0e53515-bdc5-4b1d-bd3e-ef5baaf2c99d", "value": "19F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515442, "uuid": "9e7fad5e-d8e9-4811-86a6-442c3156fdaf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515442, "uuid": "c8ece5f3-838c-424c-9cd6-f0a4c31d068d", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515442, "uuid": "def5780f-868f-4073-82fa-d85d6da3b564", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515442, "uuid": "9544b154-c74b-4383-a7bf-777bb310eca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515442, "uuid": "29ba1cbe-c791-46f3-a827-886fcf27ab19", "value": "30df5c7e09b549684b0027f8a9a4f91e40514d400b663afc9e3c3c4dcb4b8695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6c9092-9dc5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618475841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475841, "uuid": "e1bca61e-d58b-47ff-b453-dd8b4f0acf9c", "comment": "Malware payload (Dridex)", "value": "25c3969fcdd0730310a0081647f4fb44", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475841, "uuid": "417e66e1-9a20-44b0-9b7b-e306185d661a", "comment": "Malware payload (Dridex)", "value": "310b97c205dcea87d8ecdab7e3d8ffce2a22ac4b72ad0f4b7e776f3335be81a8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475841, "uuid": "ff4cc2e2-1c22-4fcc-bc38-fb2866678a8d", "comment": "Malware payload (Dridex)", "value": "3b97afb97aa7e240a75551bfb04c28c9205c1ee0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475841, "uuid": "655cbabe-381d-42d1-9a90-d526316f899e", "comment": "Malware payload (Dridex)", "value": "0b3423ab6c7a08c0c44359fbc52a707d9c35a5d8793ab1541ec0117cfeed82d759eb3abbd7fc4aa32c948aa818844979", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475841, "uuid": "d3952581-8000-419f-a6a0-ccf396476f76", "value": "C5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475841, "uuid": "49838971-99bc-4b24-b9d6-30e89167515f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475841, "uuid": "a5330273-47ba-4bf4-b2d3-241685249bda", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475841, "uuid": "5363f299-e0c9-4705-b595-858a0846953f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475841, "uuid": "f354ffc5-91f1-452b-9977-510ad685e497", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475841, "uuid": "951279e8-5ebe-4c0e-aabf-82ce961ab932", "value": "310b97c205dcea87d8ecdab7e3d8ffce2a22ac4b72ad0f4b7e776f3335be81a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab86c369-9d88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618449588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449588, "uuid": "a957bbf0-3d30-487c-b2fe-a7e9b55afbd3", "comment": "Malware payload (Dridex)", "value": "80db166990f09405a989781d8ba56e75", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449588, "uuid": "30023141-5ba8-4b7d-9d86-e0476f8fd355", "comment": "Malware payload (Dridex)", "value": "31242c4029a1af1eef0d4ada8d840250678d4f3fd774738337260151780e8fe8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449588, "uuid": "8c572248-5d62-445e-8bb9-54d9a1a5ece1", "comment": "Malware payload (Dridex)", "value": "92ab779b41fa8bb3d9f2567562ebc435a358887e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449588, "uuid": "dcbd14e8-8d27-4785-b7f1-07a64886c519", "comment": "Malware payload (Dridex)", "value": "541070a5d04f2d2be20082f729b7fd79e9df7360c5f53ad1b1def3e3cf76c0aef5b7888371cad5c08c1848e82ba20421", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449588, "uuid": "e98e488d-6438-4ff1-9272-439cb1f8dc12", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449588, "uuid": "b5a411fd-9b44-426f-a0c1-92e63b8fb737", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449588, "uuid": "37f48296-0c81-443b-b320-83db4f27df89", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618449588, "uuid": "b3b47151-280c-42b5-8eb9-79e60d6bb9ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618449588, "uuid": "19b270d0-f9eb-442d-ac3c-9f9c04e14072", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449588, "uuid": "dba9b3a1-f345-4c82-8178-8f7630ddfa7b", "value": "31242c4029a1af1eef0d4ada8d840250678d4f3fd774738337260151780e8fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7524a643-9d95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618455080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455080, "uuid": "357197db-b62a-4737-bdc5-ae328f6e7f55", "comment": "Malware payload (Dridex)", "value": "2cebc683292693fe7a5e205b44e93940", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455080, "uuid": "bfb9658e-9bb4-46da-a9bd-b85d1619716e", "comment": "Malware payload (Dridex)", "value": "317061767679631fef1982a8184dd886e7dfe56e51298de8c9a95742f3a9119a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455080, "uuid": "0638e0e8-46f9-4e72-bd3d-6ded94af48bf", "comment": "Malware payload (Dridex)", "value": "78a1b8ed18735d7a9bbf8d45401b2a7613a54a86", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455080, "uuid": "65e18fe2-f130-47ea-baa2-e11eea8ad376", "comment": "Malware payload (Dridex)", "value": "abaaea6cd95dca850e7f7be38c84380f1b8c6ef2a38c10659daa2b131573cd21368a75253c032a9d4c7bcb9838914b8e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455080, "uuid": "53171eed-ea91-40a0-859e-dbd80d000d41", "value": "91F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455080, "uuid": "f1b0a131-e297-49fb-924c-ef9b4dd49ad4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455080, "uuid": "e5bb3cc3-e439-4f5f-9476-f3cec7eaa20e", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618455080, "uuid": "7a7516a8-f54b-445f-8b50-11eff38b6ffa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618455080, "uuid": "449f4303-df9d-4bf1-a6ef-d737302a5510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455080, "uuid": "fa00afd9-c90a-45c1-8405-edc6074c005b", "value": "317061767679631fef1982a8184dd886e7dfe56e51298de8c9a95742f3a9119a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bfe7bc-9db0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618466508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466508, "uuid": "6d3c88f5-bf47-4039-a3b1-99306063b6b0", "comment": "Malware payload (Dridex)", "value": "2b23e9ac2943b7e0d6039c26ae5e41ed", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466508, "uuid": "73273f16-449d-4004-adfc-82b7388f499d", "comment": "Malware payload (Dridex)", "value": "3173e79bd47055faa3ebc0194bbff36e7cc133c72a417f1760553b727401454f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466508, "uuid": "7b094ea4-0cc4-484a-9197-83e357438944", "comment": "Malware payload (Dridex)", "value": "99e452305fab562aa197e0e1b64033f6f1a787bc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466508, "uuid": "cf868fd7-73d0-4461-91c3-7f0159d37ed1", "comment": "Malware payload (Dridex)", "value": "17b681de792540263dc71d08a4db1d5e0c24e7b3847127506c897aeeadf82bc9d39aac7aacfefd04704c555498abf239", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466508, "uuid": "dd36fab5-cc1c-43bf-b14b-e08844c479ef", "value": "BE249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466508, "uuid": "dfa63c5a-ea19-4fb0-979a-6d0882d63b14", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466508, "uuid": "84df2f02-e9fc-45d6-86e2-bb41b5c6673a", "value": "3072:O0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:NpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466508, "uuid": "09f84920-0d74-40a5-84df-0d2c99c3308c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466508, "uuid": "db24fb26-b2eb-4cbe-ab09-462dd5f67e85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466508, "uuid": "0fc988b0-2512-46ba-9387-9d9386ac9a08", "value": "3173e79bd47055faa3ebc0194bbff36e7cc133c72a417f1760553b727401454f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb105b93-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496026, "uuid": "99a0b236-a551-4fe4-bc4e-a638b82d603b", "comment": "Malware payload (Dridex)", "value": "7f7dc990f0806095a10c3d548f2d4811", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496026, "uuid": "740a556d-0d5e-487b-b4d0-9937a5d39bbf", "comment": "Malware payload (Dridex)", "value": "317411201a0fc073534f12f146d6d3d271fab54d90a72aedd80a7f54cf348133", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496026, "uuid": "3966f2f9-50b7-484f-9b58-6f9538343829", "comment": "Malware payload (Dridex)", "value": "5ba09076cb71723372f845daf6d69da0375e2508", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496026, "uuid": "e5a58401-6f2a-476c-ad27-d46914b82be4", "comment": "Malware payload (Dridex)", "value": "2329b055e08e65eb39d2e8edffdf2a5d0512df77d3d989f134661c1a71806a774aaecca83dbf26154d7a7d2125a6f040", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496026, "uuid": "d8dc4123-fe52-4877-a09f-6682e138a9b3", "value": "1DF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496026, "uuid": "f314942c-32ca-48f1-857f-86ff4089b356", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496026, "uuid": "2146d82d-05b8-466f-bcca-9c02fc02122e", "value": "3072:PA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:P3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496026, "uuid": "3b8ada33-0c22-4955-ac18-d1c47c507c1d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496026, "uuid": "9ec6dc6b-818b-44e6-ae10-68d8077767e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496026, "uuid": "b764eb63-11b6-4086-97d1-4015432fa74e", "value": "317411201a0fc073534f12f146d6d3d271fab54d90a72aedd80a7f54cf348133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ac6e1e-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "e332d39b-ad69-469b-99cf-bafc364b1257", "comment": "Malware payload (Dridex)", "value": "9781acafa6e7f0f8218380b77a084251", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "fff415e6-b396-48a8-806d-f097f30e4dea", "comment": "Malware payload (Dridex)", "value": "31b5c5f17ae38f383ab0c5febcf0ac17bb264aa5a13ffe5e93d22dc3a2b61866", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "530883d8-e4f5-466f-8851-89133e617ab3", "comment": "Malware payload (Dridex)", "value": "da3e55a5f6e9d082c24f07115dce2c258dae3659", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "f153886b-ca28-4922-9098-be45b4ff30c3", "comment": "Malware payload (Dridex)", "value": "a20e41ed65738cf4fc2b3037a5895e083b8033afafb44496d334b038b39e17faef9d5d6b54f0cd974be8e195699f27ab", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "7d762d47-b766-45cb-81a3-ba24dfa0f1e1", "value": "11F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "71488553-9ec8-4517-b80c-5011d3a5a026", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "0c819398-af6d-4a75-a6b1-05da0f4ba96c", "value": "3072:7lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:7lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515930, "uuid": "55bedf58-57f0-4858-8289-ee1f4e7769c3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515930, "uuid": "497de5f8-03d7-4954-9d3a-722aeee27500", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "b825db09-050f-4b0a-a376-5f95d3ff265b", "value": "31b5c5f17ae38f383ab0c5febcf0ac17bb264aa5a13ffe5e93d22dc3a2b61866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd7a8f5-9e1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618512859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512859, "uuid": "125a8257-d897-4cc7-8151-43e990a2afe4", "comment": "Malware payload (Dridex)", "value": "8174399bf4b5cbc2b907bcd37cd88620", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512859, "uuid": "777e691f-3662-4a09-bc68-2ab62cbc8bc2", "comment": "Malware payload (Dridex)", "value": "31c4f36e4197984f4ba805e861f81d49259113db69cc88b3691f43ed2d04dffd", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512859, "uuid": "224f2e8c-25c5-4ed4-8b48-94e12c4be4f2", "comment": "Malware payload (Dridex)", "value": "b678c054d802a1940468a63fd777f1e8f415a744", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618512859, "uuid": "b1347467-3fe3-43ba-9138-433b396b5d45", "comment": "Malware payload (Dridex)", "value": "c0492691ddcf46c26f418a0437c39d8f8f0ea7cd24008af4a856a3b1c9713aa3fe83c16f951d2f69902a7246633491f5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512859, "uuid": "e2b0a7d7-ae13-4193-97ed-36ac2fd5d219", "value": "29F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512859, "uuid": "c3e50ec8-6944-4de1-9648-a3a495394140", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512859, "uuid": "6711854d-89d1-4807-abdb-668cebc729da", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618512859, "uuid": "62a696d1-2a4e-4f29-9a4f-4c8e7f32223a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618512859, "uuid": "e9689146-354a-49da-8561-c7147f4978a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618512859, "uuid": "9afff7af-d446-480b-8dc9-355dd9bdc1a2", "value": "31c4f36e4197984f4ba805e861f81d49259113db69cc88b3691f43ed2d04dffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954f64e4-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496366, "uuid": "6ec4b538-ee38-4916-9256-307a3a279580", "comment": "Malware payload (Dridex)", "value": "02df737120a8bc6b35fe5397876515d2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496366, "uuid": "35c39f68-3b0e-4174-9a97-dc6a30940aec", "comment": "Malware payload (Dridex)", "value": "31cb1411947185b3a58f0f5a0a45e1c8ffc78cdfb130910eb2d4bc03c2ffac44", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496366, "uuid": "3ff9c664-4720-4042-ae15-a9d7d90667f7", "comment": "Malware payload (Dridex)", "value": "9be8fa41359b4c4f3bdea3136044c93764ccadc6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496366, "uuid": "5b8b81b9-073d-42e8-9f7a-12f5a42106a5", "comment": "Malware payload (Dridex)", "value": "cd446ed58e134b49667b21cb03b64ce0ba3ac55863a6435b58416a0315c7c9a4a207004b23875f69dadfd9b334d30eb2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496366, "uuid": "94a11cd6-c7e7-4b79-8e3a-941ed8de572d", "value": "54F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496366, "uuid": "8aa74a05-cfad-44f4-bc52-14e7353571be", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496366, "uuid": "dc8f86ee-69b5-4e5d-84a2-2eef259c5e30", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496366, "uuid": "49e5a937-f1e1-40d0-b9ab-54012da7704b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496366, "uuid": "39e65983-c15f-436d-b55d-d9d1a09a6188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496366, "uuid": "168d60e1-8d6a-43b0-8bfb-54f4252275e5", "value": "31cb1411947185b3a58f0f5a0a45e1c8ffc78cdfb130910eb2d4bc03c2ffac44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a55a08-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496608, "uuid": "53e352be-ab05-451b-9d12-dd3e7f18f249", "comment": "Malware payload (Dridex)", "value": "83c0ef1c2a60f8e9769ae93fb2aa16af", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496608, "uuid": "a6868699-fd46-4a11-b0dd-0455c00dd804", "comment": "Malware payload (Dridex)", "value": "3314c74fa480495a88c2ad49fc9db7379733ca66775d039f24e495fec7c3f1e9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496608, "uuid": "4a3cc289-0736-48ac-89b7-67b67f1ef721", "comment": "Malware payload (Dridex)", "value": "5a0d1e71c3e250b026c771df0f10ec3f9eb8904f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496608, "uuid": "46a55b2c-8208-47c6-a6a7-df2dcece21b5", "comment": "Malware payload (Dridex)", "value": "da814afb6912cfbde1b1a8b5caa249458cdbb3eff812076de2610106e6d85a27bb99fe6ce771a20f2d58c74038615ff4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496608, "uuid": "a9bbc198-79ba-45b8-b5ec-0304a334ae5c", "value": "97F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496608, "uuid": "96d24fb8-021e-4240-9e08-73764ba0a64d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496608, "uuid": "f19b5a98-bb4b-40e1-9261-c52e689bc2d9", "value": "3072:vA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:v3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496608, "uuid": "ac2b67c2-af90-461f-a1ea-f56a70fbcd62", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496608, "uuid": "14152058-e677-4658-b2da-ecf766aebc91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496608, "uuid": "94fc2b70-407c-4624-9de9-531a143c3791", "value": "3314c74fa480495a88c2ad49fc9db7379733ca66775d039f24e495fec7c3f1e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8947a1d8-9db4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618468428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468428, "uuid": "48ea2e2f-8d3f-4332-954f-267468c2ccca", "comment": "Malware payload (Dridex)", "value": "aa19af0ca3adbb0671509731cfc63ff3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468428, "uuid": "dd81b47e-aff1-4600-8a40-13f6d8bb0140", "comment": "Malware payload (Dridex)", "value": "3345d8db90d053d05f17087bf60c767610f8195636b360b7681f9304656a91ee", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468428, "uuid": "bfeeb906-3c9b-4a86-bc86-f10af1bb61ed", "comment": "Malware payload (Dridex)", "value": "df75bbdb0e04d8fdfdff33b901fb066aa4db5bc2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468428, "uuid": "f1b2a640-ca45-4ee7-8a4b-df0738c9641e", "comment": "Malware payload (Dridex)", "value": "03ea4e8ec36cc9e87bf5f11da60e65d2ad25f95c150c207588a14ceea247f04752cd7919fd7a4fb082619b7660848782", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468428, "uuid": "dd18278a-fa15-4967-bb96-7ba979abf797", "value": "29F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468428, "uuid": "ba7ab49d-f80f-432c-b42c-73840392c8cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468428, "uuid": "6898788b-acbc-4d05-abc8-64e11b97927c", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618468428, "uuid": "54d71e5d-60c9-4aaa-b9a6-9ad44861229f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618468428, "uuid": "53fe23e7-1975-4b68-8f38-8e38cc887f31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468428, "uuid": "3a62f796-4038-4007-be11-67a3f7be8da4", "value": "3345d8db90d053d05f17087bf60c767610f8195636b360b7681f9304656a91ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31541445-9dde-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618486320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486320, "uuid": "e5c10cfa-6a4a-4091-88e6-6632ae4b116e", "comment": "Malware payload (NanoCore)", "value": "9c4d38ba3433603d3fe4a2f69a369c7c", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486320, "uuid": "27e9b634-6f27-4e42-905a-4f811acee302", "comment": "Malware payload (NanoCore)", "value": "3354bdd8ccc26fcde720560773a0a3fa4f808dae9010a3fdc5af003858b23e2b", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486320, "uuid": "1b055bca-fb02-4dac-b735-ff149ffd4e5b", "comment": "Malware payload (NanoCore)", "value": "a49bd33547d0521d241aa95067af627487410993", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486320, "uuid": "5026dd6e-49f6-4276-9a3d-2a678fb47a26", "comment": "Malware payload (NanoCore)", "value": "fa0cbc0bd73285b55daa5ea4969c0fc1f42d4bd290395e61208f792d491d4ae9ac537faaf7425b5593f8f9ae9e484cd1", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486320, "uuid": "91022afa-b331-4d1c-92a1-d4ac2f15a0ca", "value": "0E55DFA83654B6DFC81BCE72C9A41D74AA6161A7D30BC207E04F12DCDA0D697FE191F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486320, "uuid": "28bc49ef-c6ea-4d0b-b3fa-9984e18afe8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486320, "uuid": "b031a922-7695-4fe2-9961-1fce44b7aab5", "value": "24576:K9m8RPz7mftuAiydQ84w9IQ0+mUuKkKdTeK0QA2VN:fMg0Aiyio90hnKXdKK0QdVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618486320, "uuid": "a553842f-1f22-459e-817a-91075362de60", "value": 1383936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618486320, "uuid": "40466657-ed16-47cc-94ba-8cc5d3163737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486320, "uuid": "6eee8c04-5f99-44c2-a00b-d9ca0a52805e", "value": "SecuriteInfo.com.Trojan.PackedNET.658.8528.13917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49599355-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464026, "uuid": "eb29d9e1-59ed-492e-8217-b6971ca992c5", "comment": "Malware payload (Dridex)", "value": "1e4c6c7d490798db756d76560b3351ae", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464026, "uuid": "c17ec050-a00d-456f-9306-6ec48d7a1db2", "comment": "Malware payload (Dridex)", "value": "336603c95e7f19d4595fcecf75cf8b5ee0c0f41a139f428c7ff19faa5d9d72d4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464026, "uuid": "b262cd28-43a0-4338-848a-d394b7ff16e0", "comment": "Malware payload (Dridex)", "value": "9bbf9e519df9ee0ec6887f12368919348d713fee", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464026, "uuid": "e0d12bdc-e53b-4b48-a225-de89624274db", "comment": "Malware payload (Dridex)", "value": "22fff0ed0b7fcac15594ba9be157a496aee4c90e472984d9a51cbc302bdbab35958df80ef842cd32d72d1a3302426bc3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464026, "uuid": "fc27398c-b657-4d4c-bdf3-cd19e1110f85", "value": "2EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464026, "uuid": "dd26eaa7-1726-4f26-9dc2-bc44cfe9d387", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464026, "uuid": "90e9840f-aefc-4bc2-921b-0aec48dfb201", "value": "3072:nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464026, "uuid": "b7478cd0-ba1f-420d-a2da-ac642676e203", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464026, "uuid": "e86fb6b3-d386-41a2-96de-54b6baf7da4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464026, "uuid": "5684c320-67bd-4f6a-b49f-56d36d6c10bd", "value": "336603c95e7f19d4595fcecf75cf8b5ee0c0f41a139f428c7ff19faa5d9d72d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2321ea-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516052, "uuid": "ece9aba5-4cfe-4f90-abf3-4c9935fbd911", "comment": "Malware payload (Dridex)", "value": "9627e04255d7aa1ebeabc7e0bf08224d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516052, "uuid": "be4ed91b-18a4-4e3d-8b71-8a1e167f84a5", "comment": "Malware payload (Dridex)", "value": "33adee63274349e2a982b8fcf4043883f4d46669f463edf9c4f29c073ccb92cb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516052, "uuid": "eda7a51a-8092-40ed-b934-5c443782a57a", "comment": "Malware payload (Dridex)", "value": "fe0853938849c9dd5aaa88b7cc23e95c16d696ce", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516052, "uuid": "fdde59db-2aad-4f98-91f5-3c7da0ec6510", "comment": "Malware payload (Dridex)", "value": "f1c5753135e8bcf99c784429de149f0b40c44e39d3a2ed003ddc5c3e61239bcaf21b28dda2395c7122bf0dfd25795936", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516052, "uuid": "ec76732e-34d0-4b44-8770-4226f447821d", "value": "AFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516052, "uuid": "5cdf1e29-f961-4b99-89a4-6f2077ba3ec8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516052, "uuid": "4ac0a959-95cb-4626-9032-2af8b4ad9ef4", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516052, "uuid": "ebaf24a9-ec5a-4613-bcf0-a9743c340d51", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516052, "uuid": "06ffecac-215d-4214-999e-4cebe329b933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516052, "uuid": "f216ae84-308a-4592-974e-b607d3033749", "value": "33adee63274349e2a982b8fcf4043883f4d46669f463edf9c4f29c073ccb92cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4990d17-9e3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618527772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527772, "uuid": "eb75dcaa-38be-4bfe-b448-d295573363a9", "comment": "Malware payload (Dridex)", "value": "9ffa915cfbcbebe3b77e73da7187a7cc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527772, "uuid": "5964d31c-4fcd-45a5-9349-0e3b33f5e60f", "comment": "Malware payload (Dridex)", "value": "3412be5ebe59697bb47c7c7f2b6fe6f95044d88b9c7bbf9f36fbabfda7384156", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527772, "uuid": "eb9b9d9b-000b-41d2-bd78-e3ffa5ef210f", "comment": "Malware payload (Dridex)", "value": "315ed221723a85b47d0b4e7115f11bfbc890a847", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527772, "uuid": "d2fb5351-2bf6-449d-8029-09d134ef6884", "comment": "Malware payload (Dridex)", "value": "d452a2a268f2621b317661adddeaf16d767da7a4db23934607efb2169c1e20a80d93a98bce4cb6edd472d4a67ff4303b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527772, "uuid": "1fdefdb5-1011-4821-8702-92f4179f249c", "value": "9DF3C088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527772, "uuid": "2ea1bd34-9dd4-44be-ab60-c7a9b50659f6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527772, "uuid": "85041ca2-fe5d-447b-add3-07997bb708e3", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618527772, "uuid": "c388d5e7-df4c-46d0-9731-6ee8c8a41f06", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618527772, "uuid": "3117b93d-6aa8-4d7f-8b28-87265819e5ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527772, "uuid": "ba4b62b2-dd6d-4344-9a06-93fcc9d06d71", "value": "3412be5ebe59697bb47c7c7f2b6fe6f95044d88b9c7bbf9f36fbabfda7384156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ba8a8e-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618494142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494142, "uuid": "0a44c5c3-b384-45c4-a01b-846d852ef9a6", "comment": "Malware payload (Dridex)", "value": "e2c0a5a5506b7914a6eccf825dec0601", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494142, "uuid": "fa1126d9-533f-40e0-a2de-0fa8ba47d5d2", "comment": "Malware payload (Dridex)", "value": "3418b94a8a856c45502a4c1b16b08b3ad894274d18f4f92e5eb2e4438a876fe0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494142, "uuid": "9d75d056-1655-4cdc-93c4-fc5c568395f6", "comment": "Malware payload (Dridex)", "value": "1ccea0b582d54b43165f61382434108be3ea8e16", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494142, "uuid": "860464fb-101a-44ee-8f54-4390b23eaf25", "comment": "Malware payload (Dridex)", "value": "25625cc00e0b828149a3b460fd535a28d341fb667b63f8f22519c439a47bffe03c72e1d800a40f2d1b365b2bea0f2b2b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494142, "uuid": "42974624-7f06-41a5-bcbf-dbad94a87131", "value": "D7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494142, "uuid": "d0ebb981-4724-4cbf-beec-53633805b98f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494142, "uuid": "81646353-582d-4432-9177-766e1d6a8a35", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494142, "uuid": "0f6153a4-d9ff-4af5-8a2c-315c1875ded1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494142, "uuid": "6b377f58-48e2-4ede-9749-04360e5cb3ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494142, "uuid": "938c4192-d0bc-480a-89f0-89bf50dd1264", "value": "3418b94a8a856c45502a4c1b16b08b3ad894274d18f4f92e5eb2e4438a876fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30368ed8-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "9fd6cc80-42c8-4b2d-95a7-6c5aeb699d8c", "comment": "Malware payload (Dridex)", "value": "23eb02e85781ec0ac81712e0bcc3073d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "c05f0bc1-3ed8-446c-844c-946195792a1a", "comment": "Malware payload (Dridex)", "value": "3440faf8686d03aa46facfa05516f5e676bab3d1f49365c9cd036b4d3a244c40", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "a1d41077-cb9c-4835-92e2-8c61dde89d79", "comment": "Malware payload (Dridex)", "value": "d7ff32b96dfd0b7be769e86bb48221c623798073", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "11ba4b2f-e775-4c4b-a567-9e76b64e23f2", "comment": "Malware payload (Dridex)", "value": "0e108631d65df1468667fc4a222b9e0306c019f052e463641aa039f3c2660d2c6cda2de84c9608fcad25a1526cb448de", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "1f1f1ed6-0ee3-493f-98a7-ce2bb3cf0a8a", "value": "71F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "bdad3789-4504-4484-bd30-98727df4e063", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "a21412c3-f47c-4ea6-87ad-55be354a49f5", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515953, "uuid": "2d08cee1-44c9-429e-90d6-56c6b9467892", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515953, "uuid": "195aa81f-0d0c-41b3-9391-f52d7fab14e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "868f28e2-07ed-40d3-944b-141c25d13454", "value": "3440faf8686d03aa46facfa05516f5e676bab3d1f49365c9cd036b4d3a244c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c396732-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495706, "uuid": "5a4820f8-6655-4afa-80bb-cacab7437895", "comment": "Malware payload (Dridex)", "value": "e5b7d8bcce76b394d9b1c65e4a7761f5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495706, "uuid": "cc72b479-56fe-4829-8929-da298eed3039", "comment": "Malware payload (Dridex)", "value": "3475420644492346f44e79ed9a4b7c4ff3d9ca3d98b2931ffe436091e9b0b778", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495706, "uuid": "9f49c207-c2f1-4cee-bbde-2d652fc1ed1f", "comment": "Malware payload (Dridex)", "value": "4c5039dc64a018d254fca859388299f90ac723d3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495706, "uuid": "a61549d7-bb69-4ea7-8406-03c562769f54", "comment": "Malware payload (Dridex)", "value": "cd48d1d512f94b6d2b044743ccedfe5ef7fd899beea5e0de56abe27e08b49466a8183c5f2c52fa9c48a511a0792e8789", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495706, "uuid": "308cce10-96ab-45fb-852e-afd355f16944", "value": "1BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495706, "uuid": "4a870c8d-5733-4ed0-8c22-9380611d6a8e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495706, "uuid": "7ea898bf-8265-419a-b024-68fd1f423cb6", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495706, "uuid": "e557493d-c95d-4c08-bf8f-6b4d835591cf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495706, "uuid": "15e8231e-56e5-46c4-b221-1cf38ca81563", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495706, "uuid": "938c9631-c076-497a-bbf7-aec87f559504", "value": "3475420644492346f44e79ed9a4b7c4ff3d9ca3d98b2931ffe436091e9b0b778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5680fc55-9dd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618481657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481657, "uuid": "cba2a910-47f2-478c-9f7f-e80a7fb7a268", "comment": "Malware payload (Dridex)", "value": "90eadb97fb8e9b7ce7767a258470be02", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481657, "uuid": "617539eb-264b-4a2c-974b-2061d12f934b", "comment": "Malware payload (Dridex)", "value": "34b416e085e88654d06e35607ea074fa5e1ac8eeb8731de29d4239acb834bd34", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481657, "uuid": "98af441f-da40-4731-8a5d-a1f00263901f", "comment": "Malware payload (Dridex)", "value": "edda4517b7ec3699f3c7ecb6b8b53ea6404abc05", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481657, "uuid": "b545855a-2e8f-42dc-b555-844e7b6a687b", "comment": "Malware payload (Dridex)", "value": "aa2eeaf07322fda52c446749cd97d078f20f081652570fea45700c1ef59562a05ceb022d76359dfbca3a45ed50ed1fac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481657, "uuid": "4dd82d23-34f2-40d3-b587-180c5cf85cdd", "value": "11249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481657, "uuid": "a8d9ef04-7954-450f-943a-3fd968771f77", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481657, "uuid": "6c545fd9-2ff2-407e-9205-29c7692348f8", "value": "3072:r0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:qpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618481657, "uuid": "9688d183-7827-4d59-89f6-e3608834920f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618481657, "uuid": "f0d157a8-81d5-43c2-b14c-663c07242a9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481657, "uuid": "b733a6dc-1b83-46bf-8f3d-fe488b5476e1", "value": "34b416e085e88654d06e35607ea074fa5e1ac8eeb8731de29d4239acb834bd34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6d118e-9dac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618465028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465028, "uuid": "dc66dee2-08f8-4659-b1f1-e0b34ca8f342", "comment": "Malware payload (Dridex)", "value": "7a117f6b5ac5da76c925f0ac6440ce9b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465028, "uuid": "72e2ed7e-29d1-40ae-bea4-982e65412938", "comment": "Malware payload (Dridex)", "value": "34b92de70805934d4714f1b782346a5c478f547e7e9056846d74d7b218ea030b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465028, "uuid": "088d9a2f-cf04-49e6-b227-11f0bfdcbd50", "comment": "Malware payload (Dridex)", "value": "db8e944ab706f71019abd4db17297c474f4bd335", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465028, "uuid": "b017b7b1-0886-4db7-a2df-9e7f0fb8d6fd", "comment": "Malware payload (Dridex)", "value": "4aa4a153fe303b70cb23eef38d7e71a8ed32f63b6d36201d354f18ac8d9932431882daebac974fb0ed978fdb7d2e195f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465028, "uuid": "bc738523-225d-475b-93ca-06d7eeebdb43", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465028, "uuid": "615ac559-f4fb-4deb-824d-5d55ffc3721d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465028, "uuid": "8da24371-f695-47f7-93d4-1e49a67af0f7", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465028, "uuid": "6360bc0b-0cd7-4bb2-8ed4-8afc26faa76c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465028, "uuid": "721f07a4-733a-44e8-b112-bef174be81f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465028, "uuid": "a6c260b7-dff3-4f29-83a9-c8744b8ec2ad", "value": "34b92de70805934d4714f1b782346a5c478f547e7e9056846d74d7b218ea030b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac936aed-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498982, "uuid": "52df11c3-ff6f-4ecc-b66e-0e7bff7501d0", "comment": "Malware payload (Dridex)", "value": "d08a3bd88eb76f746dbb802d0dba2f17", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498982, "uuid": "826a2d41-1e87-42a9-b605-9e99f15314b6", "comment": "Malware payload (Dridex)", "value": "34c49d39874f18605cac1b90d561b793058be5b53432fb427b5c9b7a1e948e0f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498982, "uuid": "c6c08f20-dd55-4d5d-8d28-878440b32f3d", "comment": "Malware payload (Dridex)", "value": "f4ee9e8cb8d48d7fb55dca7328410850bca27524", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498982, "uuid": "b45acfad-7f42-4a1e-b2e2-1c318e0251d2", "comment": "Malware payload (Dridex)", "value": "a6eb1521d4f7392319dcdc87ee2881e4354f3cb109dd597194ff1f98f27a83f20db3ccd7197b6b960e95d7900beda615", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498982, "uuid": "c21128f9-e520-43f7-b4c9-48b0aed35493", "value": "EBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498982, "uuid": "feaa18bd-e1ec-480f-aed3-c6f5fca6b765", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498982, "uuid": "c128bc26-d331-41ee-9f3a-1dcedc7fb205", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498982, "uuid": "3fa38dbe-3baa-4797-965c-b86a02278649", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498982, "uuid": "f92bcea6-dd99-40e2-8aa4-eb0efbfcad6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498982, "uuid": "98fa2e86-69cb-44f2-bd99-f8ef386c86ec", "value": "34c49d39874f18605cac1b90d561b793058be5b53432fb427b5c9b7a1e948e0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c882a0-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498329, "uuid": "89c6617a-4cae-4d81-8cc0-60d7ded36cf1", "comment": "Malware payload (Dridex)", "value": "202963c9933b803a2b34bac6d82f07a9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498329, "uuid": "dcc1a083-17b5-4a88-acb4-49769cbbfecd", "comment": "Malware payload (Dridex)", "value": "34e3bd487351ca9fa1672390da1850df7aa29dae946e111c2ac8c5e7cbb1864f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498329, "uuid": "062ee02d-733c-4a22-b777-38ec18e5296e", "comment": "Malware payload (Dridex)", "value": "3ff1fd4201a055b8e43ddf6ef02aad46f91ce970", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498329, "uuid": "a0bab56b-9528-47a3-948d-38141df378ff", "comment": "Malware payload (Dridex)", "value": "4cabc874c249cf62a7ba39291cf6ee8d2da0b58e65679da53b5b8af6473a545cfbc045b21ccd80a77a7b21efe6fdad73", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498329, "uuid": "81e2ddf8-521a-45e7-81ed-08ec2c727c7d", "value": "CFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498329, "uuid": "52ab39c5-e54e-46cd-8e57-401018c319a0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498329, "uuid": "065beecb-3516-4fa7-b70a-f8eb8d0f71d7", "value": "3072:+iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:1eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498329, "uuid": "833d1ef6-dbfa-45c6-9b90-491a0d7eb4d9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498329, "uuid": "d8a34b52-533b-4405-9f09-4c23e43566d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498329, "uuid": "e741cba4-e289-430b-8a91-cf804e8eb99d", "value": "34e3bd487351ca9fa1672390da1850df7aa29dae946e111c2ac8c5e7cbb1864f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cf98e7-9e16-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618510305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510305, "uuid": "82a1d94a-ae19-4329-9182-8bc77caf9404", "comment": "Malware payload (AgentTesla)", "value": "c6c1b85fc524e76d14e3ebfd0429bde9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510305, "uuid": "04ac6559-7a0d-4794-8c6c-51012262190b", "comment": "Malware payload (AgentTesla)", "value": "351381f11a5e72b70399481567df8451ca7b72ca2dc3a78b467f71ffc7533bbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510305, "uuid": "700b62b4-0791-44f3-b1ce-5a89fb752f59", "comment": "Malware payload (AgentTesla)", "value": "a69cdee21c9a24d104566469fb4e3880415092ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510305, "uuid": "a1c35f80-933e-43f2-90ed-01e75b1f29b6", "comment": "Malware payload (AgentTesla)", "value": "2d1ce98a91067fd235e62ae51bb4d0c17485b521cede6ab0caf7317f336754409d05deed60ec715be4487f66d856e179", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510305, "uuid": "5a2ec23a-3e41-42c4-9560-159467f269a6", "value": "59057A6232BB9214D7E95F38409D0E540EB5AD026923D70C1AA675DF0BB27C38F1EF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510305, "uuid": "fdc3d3db-4adc-4003-a5be-b8437965ddf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510305, "uuid": "270c547b-f2fb-485f-aa38-1ab4d04569d1", "value": "12288:p/SlxA1z3gpGvqWQWefn16xdIleVGq/E/4kNpfpeH8DlI5GHyQPhaJ5K:p/SUNk4sPfn1Gdj1E/4kPcHAH/Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618510305, "uuid": "0cb784a3-2404-4306-ac7a-4fe0c12a6d2b", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618510305, "uuid": "1b95f311-ff22-4663-a305-7defabacea7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510305, "uuid": "34ef84c7-a3d0-4792-b56f-c3bce3a39cc9", "value": "Wire-transfer_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca8453b-9e0b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618505666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505666, "uuid": "00cc0e6a-0f22-4e28-8591-db504613cf39", "comment": "Malware payload", "value": "beea5745cee5b7365047eda086292201", "object_relation": "md5", "Tag": [ { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505666, "uuid": "2ee46cd0-4a32-4ae5-8a81-bd1f49b9a7fd", "comment": "Malware payload", "value": "353d3f61af8d097528801c93ca9a284429bce7847c959357c7fcd7821a60441e", "object_relation": "sha256", "Tag": [ { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505666, "uuid": "b1ea554f-d853-4cd6-8df5-9908fa0abdbc", "comment": "Malware payload", "value": "738585e5e8046557864b823dc12d9969a3c87be7", "object_relation": "sha1", "Tag": [ { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618505666, "uuid": "80cd14eb-1082-4488-8f8f-23aeb4512d14", "comment": "Malware payload", "value": "0e6042de006482bb44cc6e5d298d5fc404cc722b09370fdacf5e0430a723cdd82f6ee1857f766271684289d0ed4d859b", "object_relation": "sha3-384", "Tag": [ { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505666, "uuid": "8f8900c5-f037-452c-be63-f5b78034d5b3", "value": "B9C633F76B4BC535F13106FA048C9A8F64764722900AFF09B2DB46619D7678F0B26CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505666, "uuid": "a1805b9d-4b22-4bd8-8168-75d0a84bf1d5", "value": "196608:HTh0u5YauxNN4DsVUXXl4syrhIj8ebwTPNWs7ddlv3QnRp00tAC0j3nJPxxKrlZ:iKYZ6seHSsyrhIwa8PNWsqnRp9h0jZr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618505666, "uuid": "4fb5d208-024a-4ef0-bd23-853cca851217", "value": 12424795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618505666, "uuid": "dd241369-b052-4348-aa29-5c6cdfc60aa2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618505666, "uuid": "61b6b6f2-88bc-45dc-b9a0-7673cfd98397", "value": "MifvH.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072ef0d0-9dc6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618475941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475941, "uuid": "f73436ed-f2a2-4271-8565-005eb46c37c1", "comment": "Malware payload (Dridex)", "value": "ae9a524a5a52661bda1b366b58cac384", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475941, "uuid": "c00b9870-1570-465b-9f52-786f4435bd5a", "comment": "Malware payload (Dridex)", "value": "35689291e219c9e2e54224eb69dca66e319fc10e3d3ee44c4f8ef1b6dff68bda", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475941, "uuid": "d8936f63-605a-4b22-b773-d5b379884b3a", "comment": "Malware payload (Dridex)", "value": "dba0401608e77db8fb0d4aa90715a2474696ea49", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475941, "uuid": "32f4fb4a-9af9-4d6f-86e0-9da91fed7e97", "comment": "Malware payload (Dridex)", "value": "2c8f6a0c179417aca1dfff209aa556e4e7d0609b6d43fb91325765f4a75e5b43c7085b3b0d7e46858ba52c2bb5fbfe1c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475941, "uuid": "11437712-f815-4472-a8e9-760473ebe7ac", "value": "23249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475941, "uuid": "e763c422-7236-4da3-8fa9-d1974a0fcb2b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475941, "uuid": "5ce3262f-0ea7-40b1-a9fb-846d300fadd9", "value": "3072:60DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ZpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475941, "uuid": "bbc2e1dc-edec-445b-b803-b212a78412b5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475941, "uuid": "02c535fa-ec7e-47c6-90b8-964be939fe57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475941, "uuid": "644b6ccb-6cca-4ca1-a59c-a3882cb2a11a", "value": "35689291e219c9e2e54224eb69dca66e319fc10e3d3ee44c4f8ef1b6dff68bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac90ee2-9db3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618467813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467813, "uuid": "13b09667-62e2-461f-ba99-7e1c895f9da8", "comment": "Malware payload (AgentTesla)", "value": "c5878bf821f323a64103dbbd1ba6d160", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467813, "uuid": "b8495884-a029-4e79-9dfe-c9bb965dfaa7", "comment": "Malware payload (AgentTesla)", "value": "3586cd60db5be1da2ef7e6b4b9835d7aaab082cc1df0345810562e7f5a88f66d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467813, "uuid": "43c7543b-6adb-46a9-9731-257a67b828da", "comment": "Malware payload (AgentTesla)", "value": "d675a7df423f33d9b806ebd369929b8babfb5368", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467813, "uuid": "96179f3f-5817-46bf-9517-cda95025cb91", "comment": "Malware payload (AgentTesla)", "value": "e9782ec6c99f2590a7e592a56c82bd593413aacf4f1a080e16715a0f99391261f4fb55dfaccd871d4d1927393ece63e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467813, "uuid": "e1428785-2ba7-4856-a80e-821bb8e4fc4b", "value": "3FE43311AB016A374447BD3DFAC86833C53A968D582784FE588EDE10DD4136BDAACD73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467813, "uuid": "5e19242b-2ee5-4960-a5d7-b2209847d425", "value": "12288:WrDpHH31xz3vaHSRtxbnP2E+P2wX2bNC1qkzPmF18OdVUu4KljTefp8s5tB3+X:y1nDz3SHSBjwR+NCtmFOyQQTefpPDB32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618467813, "uuid": "e9f3e740-9942-4fa8-886f-8ef7df584128", "value": 715346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618467813, "uuid": "78cdb561-f091-4d17-ba82-ea81aaa8ce6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467813, "uuid": "d0412f0b-bb7d-403c-9956-2372337f0bbf", "value": "Re ,Request for quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0d9890-9d90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618453082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453082, "uuid": "f5d5df2a-df0d-443f-a665-0dfa7b0d0033", "comment": "Malware payload (Dridex)", "value": "e61b971126e22135392cbaa86f5badb2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453082, "uuid": "ac3560aa-64f8-4d91-9097-bc8fddbf3b94", "comment": "Malware payload (Dridex)", "value": "35fced60bd5808c8e0f861070dfa28e52f8c78fed7f177b66f438617c83e30e3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453082, "uuid": "064e9ff1-bb28-48b9-a7c9-ce6efc691650", "comment": "Malware payload (Dridex)", "value": "854abe82826d6fb76259455390f27f84546f822b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453082, "uuid": "7e10bfe2-ef5a-4140-b727-1f7837092db2", "comment": "Malware payload (Dridex)", "value": "92bd1050d7a6345729532e9ce98684087e9308ae57dda96db4e53d3c37b3d45a3b6a322933172714fc34afd6686876dc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453082, "uuid": "85ccc865-f3ac-46f6-bd3f-47330e7747f1", "value": "71F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453082, "uuid": "ef63fcd5-aa36-4d6e-8905-9ff94db39a8f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453082, "uuid": "565df55d-c078-470a-bf88-ebf2cd4b9d86", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618453082, "uuid": "b3b4568c-8afb-41eb-8183-977a7436f372", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618453082, "uuid": "ab8fa081-8fb0-4865-9b47-74c1c77ba8e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453082, "uuid": "1a0cd3b9-f17b-41d5-9977-91f7e5874aef", "value": "35fced60bd5808c8e0f861070dfa28e52f8c78fed7f177b66f438617c83e30e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc88200-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464195, "uuid": "5a7f52c3-e732-4753-aef6-8622b3f1071d", "comment": "Malware payload (Dridex)", "value": "15e931369ff00fe625e48a689221b898", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464195, "uuid": "586771fd-3f86-48b2-876d-b8ff16fec137", "comment": "Malware payload (Dridex)", "value": "3613ac24ca34d8733027fee57b68a8af32ed46e190b7b48b82242022e47edb6b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464195, "uuid": "38d2ff81-e0ed-4aad-98bc-7dc5bc0e6a5e", "comment": "Malware payload (Dridex)", "value": "84078ad1639036c00fc3ffbf0ad168eec82128fe", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464195, "uuid": "6001556d-a988-45ed-a903-572c06d64186", "comment": "Malware payload (Dridex)", "value": "bf459a75e2f7cddd951acf33effbf896096e7c44d644021073cf2d4a6c29758bdaeff89cd2ed06c3a88ceac150ea0134", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464195, "uuid": "36468a0a-d787-4c4b-9074-45fdc1979a0f", "value": "7BF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464195, "uuid": "b094f376-c917-4274-b3cd-b185d46848e7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464195, "uuid": "c22a820f-e8ab-4849-9e07-8aadf20512b2", "value": "3072:pA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:p3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464195, "uuid": "15f94af4-c490-4c70-b164-b5c1bf9df7fa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464195, "uuid": "f9b5c75c-e611-4f8a-9026-0da650e65d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464195, "uuid": "fda68196-bea0-4298-8525-5cb9685995e5", "value": "3613ac24ca34d8733027fee57b68a8af32ed46e190b7b48b82242022e47edb6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e719d0f-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497186, "uuid": "2ca8b094-c357-498b-876f-7dc644b092a8", "comment": "Malware payload (Dridex)", "value": "d58c8cb1cfb43e6e6661d96f327b1cf3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497186, "uuid": "4a8a75b3-94bf-4a75-9369-3584fadc3d21", "comment": "Malware payload (Dridex)", "value": "364480d9a85e88d6221819682bb38b77856124f9bbed8d0e73d6a40bfd294d81", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497186, "uuid": "b21d9219-5d75-4cea-b718-b78bbc35b193", "comment": "Malware payload (Dridex)", "value": "dbcb6c4a562b2ef49b078f11a5c82ab1a74d0a6e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497186, "uuid": "1bb20feb-c693-49b8-a9ef-2b2dbecfde19", "comment": "Malware payload (Dridex)", "value": "d20f56da5bd14ebe732cafe754fec09bdd0dd3b93cb5be0c9cae61e79487257de170a37af59a93bf7d488fae2d2cbddd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497186, "uuid": "3acb15eb-eeab-4848-a5a0-9b29b17eb953", "value": "F3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497186, "uuid": "54fd8a79-2aa2-4c93-8001-ac5275b4dbdc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497186, "uuid": "01fead42-a254-4e6b-bc01-906620e7b142", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497186, "uuid": "a2fe29c0-c51e-478b-bfdf-2ba88dc43585", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497186, "uuid": "8adcdedf-5160-4efb-9a93-ac1d0b9a88c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497186, "uuid": "08dc7464-75c2-4ed3-aa3c-f6dc5037f256", "value": "364480d9a85e88d6221819682bb38b77856124f9bbed8d0e73d6a40bfd294d81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272306b8-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "de266578-498f-41a1-93cf-95512b580770", "comment": "Malware payload (Dridex)", "value": "69f91ffd8d1238d43ac0ffe9cbc6c6b2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "2298c0e1-4cba-4d0a-9511-cb21a5c9a9c3", "comment": "Malware payload (Dridex)", "value": "3655202b950104dd0c705dc8f251ccea126aedcba7852bae5e3f50474309d201", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "67d36a91-c547-401f-983e-953ae0b15947", "comment": "Malware payload (Dridex)", "value": "97cdc5a6f329feee96af75d60aff323355b7e00a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "45efee4a-4987-41a1-8c5a-8b5c044bf75a", "comment": "Malware payload (Dridex)", "value": "d7c893f2c10fc572909370ffeb93515bb007762fadddb53824cd348f034750dae3fe09b5dab8ce9e8cd1833947fc2648", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "c0d01261-8514-434d-877b-725e77fc2121", "value": "F6F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "bc65a9be-a459-4d08-a754-730c114817c9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "4085ac4d-7ab1-4a26-aa40-da985ebd0d5f", "value": "3072:yA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498328, "uuid": "d8d17cae-c2cf-4028-bf8e-f8605f1cc7c0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498328, "uuid": "02199187-6c35-4843-8d52-7fd0b577aa25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "ddf8ec38-8fc6-4218-bd88-0bcdded7d68d", "value": "3655202b950104dd0c705dc8f251ccea126aedcba7852bae5e3f50474309d201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46d1042-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496096, "uuid": "4a6183ea-8035-4911-bbad-b6b8479cebae", "comment": "Malware payload (Dridex)", "value": "2facaa44c23044b9d8dae4a408929edc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496096, "uuid": "25d3d537-4063-46c4-b225-f78f8c4e035a", "comment": "Malware payload (Dridex)", "value": "365fd039ccf2d0ffd0222bf514710c3354d05a085c20b5d922086f54bbb06984", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496096, "uuid": "9b77fdcf-57a6-420c-94ff-090c0086adf1", "comment": "Malware payload (Dridex)", "value": "e7d6ae3325d2ab96bf4a01f439448e72bb0dab54", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496096, "uuid": "a5a792b1-7f1e-404b-b6bb-e0fe98481ff4", "comment": "Malware payload (Dridex)", "value": "011add2be65c8cb00e14c5b8c939ec26ae3e7d9172061137459e848ad41901618da1acf7c33c54dbfafc4bc6770ec9bb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496096, "uuid": "01a73be4-7342-442b-ba82-eca02914922d", "value": "41F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496096, "uuid": "9a0361c0-27ca-4dfc-aa41-f540a12f1dd7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496096, "uuid": "06aa8377-5aa9-4146-9430-152cf6a1ee24", "value": "3072:EA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:E3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496096, "uuid": "d816f1ff-048e-43f7-b00c-17565fadbfaf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496096, "uuid": "4ed3a5b4-3e5a-46b9-bd07-20c654197350", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496096, "uuid": "9636996e-ec22-4aaf-bb51-e15be0b8f465", "value": "365fd039ccf2d0ffd0222bf514710c3354d05a085c20b5d922086f54bbb06984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce6ff75-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464220, "uuid": "1a124c46-448c-46b8-b33b-e79dc2fb3972", "comment": "Malware payload (Dridex)", "value": "0cee75ffa87b8c7aa0f44ec8e3ef3b04", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464220, "uuid": "f8abdd9c-62c9-4a57-b57d-5d4bc76353cf", "comment": "Malware payload (Dridex)", "value": "3670db4b7f91e26c63855e9418c91f92f79ecf05e02e341ac65de530efc3488f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464220, "uuid": "90b08191-1881-4bbf-9c6f-c2f0d8e81e89", "comment": "Malware payload (Dridex)", "value": "3d5a430bda11b9816d57939dbd20d8722409f813", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464220, "uuid": "be0866dc-386f-4baa-9b64-8812dc8fd202", "comment": "Malware payload (Dridex)", "value": "8eaf3ae5adb76d474691136b1d7ed3d74955b4d285fe4141aae0704e4a02826dbd8cbf669a84095be03dacdf1fdddf84", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464220, "uuid": "f3aa533a-1086-4a7c-b1ec-13f42cdb4ec4", "value": "16F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464220, "uuid": "7e13630c-0b5c-416c-86e4-c2e62cd6005a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464220, "uuid": "fdf395b2-86a6-46eb-93dc-7c200db3e951", "value": "3072:wA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:w3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464220, "uuid": "830316da-545f-42c8-9e55-b452b35a3d6b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464220, "uuid": "6d770178-83da-4b1d-89a2-186ddd1bea71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464220, "uuid": "3aa5b6cf-1760-4af3-b9e3-732584471fa2", "value": "3670db4b7f91e26c63855e9418c91f92f79ecf05e02e341ac65de530efc3488f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fad91f9-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464171, "uuid": "757cb434-b65a-42c6-9d1e-4e97797ebf07", "comment": "Malware payload (Dridex)", "value": "141ebc06a6104d2d81f551d0e19e39cf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464171, "uuid": "21fedcd2-523d-4a30-9e9b-29e81206c0f8", "comment": "Malware payload (Dridex)", "value": "367594758ee44cd3c7e31ee9a99dcc456bd4ce90ffe30085edff6fc45dafc06d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464171, "uuid": "19c51444-3899-49fb-a58a-247ecb72478d", "comment": "Malware payload (Dridex)", "value": "189557deccfe4e3d8815b09c81356f1020d13449", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464171, "uuid": "1b4eee68-0a05-4af7-9e9c-d68cad54c5f1", "comment": "Malware payload (Dridex)", "value": "36b6db26bbea3b318cf96c2691b3376e1d6324caece80ed9620ea29a3bc2bd8cae4c83b7d947ebbe894c45bd89e510ac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464171, "uuid": "ca800e1a-7d00-4da7-bf05-52041d86bcc7", "value": "E7F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464171, "uuid": "8476d0fc-8b29-45be-ad8c-367b87ee4504", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464171, "uuid": "121a0c8d-a009-4142-b057-aa041e70ef8a", "value": "3072:QA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464171, "uuid": "2fbbad3e-6e61-4f7e-99c9-7683eb8affa5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464171, "uuid": "e600e88e-fee9-4a7a-b13e-5114b629814a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464171, "uuid": "60ca29e1-5ba5-4e77-976b-40f8a63d9756", "value": "367594758ee44cd3c7e31ee9a99dcc456bd4ce90ffe30085edff6fc45dafc06d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58aef8c-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1618498970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498970, "uuid": "67279de4-a791-4cb2-b5ec-9d77b1d19ac1", "comment": "Malware payload (DanaBot)", "value": "5c30bed6985b8603b6c797f141abfa85", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498970, "uuid": "0df54bde-763f-4144-b005-70d17d86e2d6", "comment": "Malware payload (DanaBot)", "value": "3688577e500b07cc1818d4c994651f791659efbf8ef3ff88329f25c4f65aba24", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498970, "uuid": "650897f8-d3f0-41df-b95b-7fa17d1f3576", "comment": "Malware payload (DanaBot)", "value": "670a3c1243aec4701d036cb3bace2761f8768f13", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498970, "uuid": "136d2eaa-beb6-4999-8db9-eb31ef9f69fb", "comment": "Malware payload (DanaBot)", "value": "b065ee3cabca2d94f5c5ada0d46e07078b546f49ffd89e32f489d6c28acc35602594f8674279d6de7739a4bc4952e833", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498970, "uuid": "5cbca494-0bd4-450d-bc39-32a48409e9a9", "value": "B7552367AB14D7B5C5B50F316A72CA632B34787519718A2B7AB37E6C2930400DD3E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498970, "uuid": "d39afa79-9628-4d9d-b06a-8248c8929846", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498970, "uuid": "dd3d7621-a06c-4703-87a8-228f1ac82c9e", "value": "24576:yvC0Wl1X52VhXyNdskGLqmqdol2496cme8NndBFOimmMVMWoeuW7TczTb1oqU:YC0Wl1MV6akFcvUcDiDDm7MneuW0zHVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498970, "uuid": "d39f4748-c507-4564-9b17-520d971a1a83", "value": 1285186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498970, "uuid": "17bb9f81-a166-454e-9cda-5cb790f00f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498970, "uuid": "3e1ac370-8d85-4256-8af0-dbf42a5fc5bb", "value": "5c30bed6985b8603b6c797f141abfa85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e4d5f1-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "5943029a-dc3a-46dc-841f-584eaba40eed", "comment": "Malware payload (Dridex)", "value": "97769c2733c0debc572ac021b64878d0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "8e2518e4-09ee-469c-8cc5-170c1ef25d3a", "comment": "Malware payload (Dridex)", "value": "369b53c8398e840371387eda329eafd8cb85dbca53c38d73724977db6e43d9af", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "0f5240cf-22b9-4348-9f40-aca3c753500a", "comment": "Malware payload (Dridex)", "value": "e4b640d21db0f0e8cd82d3283937aa5a434f79e0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480772, "uuid": "6d4715d4-ef93-4eab-8db0-1f5787fcb04d", "comment": "Malware payload (Dridex)", "value": "87a6cfef7f9c9fed291508e14f5caff252cea725138ab53cbe0d69fd7dff84c1ad05e2006f6d6c3600c0bc84ddb6c4c0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "bba71715-c42c-4a7b-a3a1-e581f55ae39a", "value": "FFF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "f24bb488-01f9-4777-a0b7-4dc0f5bc6822", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "30c2aa0d-1f61-4113-9ca4-b1fe8b2a0d69", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480772, "uuid": "07b6fda6-51be-4028-af00-2fab0cc8f55f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480772, "uuid": "8d3e0b59-7d97-4c3e-88e4-e5de2b157638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480772, "uuid": "dae7a916-18bd-4df1-b5a1-6bee8c38c854", "value": "369b53c8398e840371387eda329eafd8cb85dbca53c38d73724977db6e43d9af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832a05e7-9de7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618490322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490322, "uuid": "34202e32-bfee-4737-ac20-c333f564a1ff", "comment": "Malware payload (AgentTesla)", "value": "861e4c1e63531e7eb31d3cc748705d6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490322, "uuid": "f6e48246-9861-4d21-8204-9c35f663a593", "comment": "Malware payload (AgentTesla)", "value": "36c0082532323d3fcac1f8794875602052fa5089e36eac9b6ffecd0cff37c41b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490322, "uuid": "dd7bfb73-4088-4840-94c7-92d3ec091488", "comment": "Malware payload (AgentTesla)", "value": "88db3e68831797605b44b9a5bb3d030daabdc908", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490322, "uuid": "76e95848-507e-4df4-a04d-27ef8689193c", "comment": "Malware payload (AgentTesla)", "value": "f306e0d2b0783433a3545b9d7cf565a5013e67d0b0f92b75277a66fb89013cbe77c29ef28ba6b79875589b65026c028d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490322, "uuid": "38e377f0-53ae-4777-a38b-7fb64c503c12", "value": "64B533216CEADF10CA1A6BBC6B4E4169C1658C615F28F22DB35DF539B23377036E128D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490322, "uuid": "b4b41b02-e35e-439b-be36-f42c3b437e35", "value": "49152:qfSqNB9x5zzDFcnQiXuErP1ju5afFQKP3YqJMLRQ6O3vYwj09Xb/o:qfSw/5ztGQiXuEr9q5afFQi3YqJMC6OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618490322, "uuid": "49827456-a50e-4009-85f8-04636ff673ef", "value": 2438656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618490322, "uuid": "c4de6abf-043f-4376-830c-3185f8fcac3c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490322, "uuid": "2d19067d-f907-4507-9064-bde49aa77e45", "value": "Request for Courtesy Call.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37be3fd4-9d82-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618446817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446817, "uuid": "396999d0-b008-4025-9638-39d8739734df", "comment": "Malware payload (Dridex)", "value": "b8fbde24ba289dc5ce62a96080dade6a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446817, "uuid": "15a1271a-809a-4e19-833a-2dee8ae36ba7", "comment": "Malware payload (Dridex)", "value": "36ec4ff014348351d84e374c4b80294032d55a00562f29bc86e3ee775e4e052e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446817, "uuid": "0d1e6b62-f906-4e7b-aeb2-f9888f078600", "comment": "Malware payload (Dridex)", "value": "229156af7957287a08d4bd534a6ad295064a9fc0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446817, "uuid": "04d7b871-2130-4dce-b3fe-550bb7721dbb", "comment": "Malware payload (Dridex)", "value": "d50b69a5fcf2e64471a3d125d5e0d8fe552739f8748265c44b37fcbda88d8dc34cdc03a4cf655c939702734f8de172be", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446817, "uuid": "de5df249-88dc-49ec-a791-2ecf449b65c0", "value": "00F3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446817, "uuid": "7bf134c8-6c06-4abf-8e49-907e0028ff91", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446817, "uuid": "49d5b0dd-df5f-42c8-9db7-7a4ebcfd6d10", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618446817, "uuid": "1793c142-70a2-463c-81c3-4ac113fcbbbe", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618446817, "uuid": "aba97569-944f-4c90-9ff9-90a8218962fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446817, "uuid": "ec233331-d669-4a12-9333-3253055faa1d", "value": "36ec4ff014348351d84e374c4b80294032d55a00562f29bc86e3ee775e4e052e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304f72ae-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "8594588f-5b38-446d-8d69-830c0704063a", "comment": "Malware payload (Dridex)", "value": "71965786f64c14e9c1503dab94853e62", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "3751a07b-d693-4b6b-b2cc-e652ca559605", "comment": "Malware payload (Dridex)", "value": "37213cf36347f9d2d0c2907b3fb11961689f27bb7518cb4dda06e44ff127bf4b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "0b3b277e-85e1-4a6e-b708-f8f426e4c6c8", "comment": "Malware payload (Dridex)", "value": "fa044be790c74b68839bded2448167eafb0bc4d7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "4b469037-8ca8-4f20-9820-59876abb3ac2", "comment": "Malware payload (Dridex)", "value": "c5e486147655325c30b3dc5d3ddb46c120edf87b52a4581f6a7dcc675c43994db5ee55544503d02efe97352e5ccd434c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "0c7f2401-9f86-4de1-b359-d04bd320a437", "value": "F5F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "56b49729-c34e-4ecb-bacc-5e89c0a5e517", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "d05ee1d0-b504-4616-91ce-d5f63dda61e3", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515953, "uuid": "e4cf5355-d8c7-4c8e-9ed7-1b2d30a373d4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515953, "uuid": "c938fbd7-b351-436c-beff-86565e0740f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "31e2a347-0741-404e-9eab-73595b6c50fd", "value": "37213cf36347f9d2d0c2907b3fb11961689f27bb7518cb4dda06e44ff127bf4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2793aac-9d8e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618452203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452203, "uuid": "ed98abe5-2dd4-4acc-833c-86a9cb06e435", "comment": "Malware payload (Dridex)", "value": "04f294d4fa6d0f8be5a09c43afae0c7f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452203, "uuid": "e98f3d37-a137-4ffe-a950-5a9b36325256", "comment": "Malware payload (Dridex)", "value": "3775bcc9474b69ce89930d91d4a6e0647bd74de1de5f1f91e7a3981753fc9ec7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452203, "uuid": "dea7a5e4-6bd6-4904-a208-0572f2e1e4bc", "comment": "Malware payload (Dridex)", "value": "f034e28a9c3ea8e4a686254d387c3272c7a11c01", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452203, "uuid": "cf3f0135-4ad9-4d46-8555-265d6eea6222", "comment": "Malware payload (Dridex)", "value": "823d7db33e8ae9740bfe10f2a2ee99a57d5f0ea8916f96f66bcdb9fb46828caa01b6a1b1a18aef4ea716fd9f84369784", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452203, "uuid": "511380eb-68f1-4d08-9962-8d490947adb5", "value": "68249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452203, "uuid": "94eee1d5-561f-4ff4-8a2d-91ff3d172c40", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452203, "uuid": "4ddcb51c-9b45-48f2-9440-9eaa52ed26f5", "value": "3072:50DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:MpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618452203, "uuid": "ff0a06c5-acd2-4d0b-927e-745fe07426f2", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618452203, "uuid": "3d875a00-85da-46bc-8a4b-f13ee9a27b44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452203, "uuid": "0252c16e-a3d7-4825-a57d-6ab65fdc9c82", "value": "3775bcc9474b69ce89930d91d4a6e0647bd74de1de5f1f91e7a3981753fc9ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0534c71f-9e2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618521035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521035, "uuid": "15e9f298-c6d5-49f9-9e1d-9ef8d0782250", "comment": "Malware payload (Dridex)", "value": "c64e9cbe8f4c6c21cebe7b29d97f35ef", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521035, "uuid": "c1124fc0-b8e2-4c92-8c61-0d270e52b72b", "comment": "Malware payload (Dridex)", "value": "379d434427e1f363cfd37b8a4ab1dadae165f03b0100ab542cf626058baf5a72", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521035, "uuid": "1d032364-a7dd-4345-897e-ef8b3407e782", "comment": "Malware payload (Dridex)", "value": "e415d5d7e6f534e20b8d0ba75207626d8845f8cb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521035, "uuid": "de792156-ca0e-441c-91cf-d164abcad2c0", "comment": "Malware payload (Dridex)", "value": "0a823f31e863de6af9ac7b8fe35b83482940e174269043dd143862785baf4a69982aeca119e98ad1fab0b302dc20039f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521035, "uuid": "c3790981-ef13-40a7-9833-0e0202f7d4a0", "value": "03F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521035, "uuid": "902d587a-1374-4a87-8535-07d569fb426c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521035, "uuid": "400b49b1-1534-4ca5-8aae-958e8bd3f2b3", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618521035, "uuid": "009c8b0e-c681-457f-b628-7b5a859ca265", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618521035, "uuid": "8e8fb774-41f7-45e7-8285-c68817f1ea6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521035, "uuid": "bd226d73-3ef3-481e-90e6-132fbf611596", "value": "379d434427e1f363cfd37b8a4ab1dadae165f03b0100ab542cf626058baf5a72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c189c3-9db2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618467372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467372, "uuid": "a1d6946d-b72f-4721-bfba-08fef9e79306", "comment": "Malware payload (Dridex)", "value": "35a0c34b5a60ca9eec2d3ee00312d0b8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467372, "uuid": "37f01055-7ef0-45b5-b7c8-ec5558ff0578", "comment": "Malware payload (Dridex)", "value": "37b53e6ba35ab2f98cd86002fa393935e081860837dbd20211dfc4db83de3ce8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467372, "uuid": "636b684b-a659-4fde-aa66-8ef682ecb080", "comment": "Malware payload (Dridex)", "value": "3edb89a6863e294448d5d43e66b1c44028825669", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467372, "uuid": "d1563ad0-e846-4353-a0a5-d6f7d88ca693", "comment": "Malware payload (Dridex)", "value": "de05d59e9f7c80d25bfd03b13c11b9a9b2fd2a82ed340a2a1f4e76cb170f10f6abacbdb81d82e414e49b8041cb759158", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467372, "uuid": "12590ab4-f45a-470f-b9f9-c90c726d75fa", "value": "7A249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467372, "uuid": "88c0ee7e-c5ff-4f34-8468-ce1706682352", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467372, "uuid": "2ee796a4-44d0-42d0-a6bc-a42fa51596c4", "value": "3072:U0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:fpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618467372, "uuid": "71b367b9-56d0-49b7-8b03-8ebf0d4fde74", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618467372, "uuid": "7ab7da5a-7f67-4c40-b369-1e0078625f46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467372, "uuid": "9fea7aa5-0400-40ca-98f9-35fd5e8dda2a", "value": "37b53e6ba35ab2f98cd86002fa393935e081860837dbd20211dfc4db83de3ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77892417-9e43-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618529817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529817, "uuid": "ddb5d309-7a98-455e-9dd6-538ef1bbaa65", "comment": "Malware payload (Dridex)", "value": "57a5af57410afd0c292b1b22d262a618", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529817, "uuid": "5f2a02a5-9624-4c5c-8f19-54ccda9f702b", "comment": "Malware payload (Dridex)", "value": "37c00f319cf61cb0464e68328beadb7efc9cd1494c84e9b5d0db813ccf73391d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529817, "uuid": "1eb078c7-83a2-48a0-882c-5e9c113d4b2c", "comment": "Malware payload (Dridex)", "value": "3376c8ddb800c5b5e4281d7ed80cd8227eb7ef27", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529817, "uuid": "6603558e-cc90-472d-ac39-744908d52d9a", "comment": "Malware payload (Dridex)", "value": "d6dd5069973ddec3e2800fbe1aa7fe15605fdbed40cabef9154c3c74c9072ec5b2f5ff2a7e46636df22961f2fb920682", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529817, "uuid": "fe0e3949-7cf0-4afe-8b92-6f05b2ec0f63", "value": "86F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529817, "uuid": "eb3aa88d-880c-445c-8bf5-a24118345e97", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529817, "uuid": "3daf0d30-e0af-433f-b214-f592c1e97120", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618529817, "uuid": "2c7f306c-be63-4217-a02d-cd4f05479b9c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618529817, "uuid": "1efca97b-88a9-4139-a24b-1296d0126130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529817, "uuid": "50a7d6de-6051-4e22-951f-0ec4a6c56351", "value": "37c00f319cf61cb0464e68328beadb7efc9cd1494c84e9b5d0db813ccf73391d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36901b85-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496636, "uuid": "77f5cf5e-212f-47f2-a4ca-46d3271d493c", "comment": "Malware payload (Dridex)", "value": "a3c8853e3811faa0c2bdaf8e78156b0f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496636, "uuid": "f66d5a82-a07b-4d48-ba4e-e207a612c1a8", "comment": "Malware payload (Dridex)", "value": "37e15c1c5ec863b78e25a1b2426b0e52995489adaf9a4b2101f805432508a4ee", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496636, "uuid": "b616cf9d-7c32-45a5-9243-fbc4c8725f1c", "comment": "Malware payload (Dridex)", "value": "e2c3f10f42762e5d518f6002ebbd63cf1b00b0cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496636, "uuid": "f83f47bc-c666-4d25-8d8c-dba22aa9b98f", "comment": "Malware payload (Dridex)", "value": "092747994994331f329491b2a3255bffd074f8db34a374192cc7bcdc31ddb9bb5db894666b6a99bacbe4916ffd9d3e85", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496636, "uuid": "b12ba7b6-8c44-4cb6-b9df-a4d69ce26f09", "value": "90F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496636, "uuid": "a0a747f9-03a6-44e0-8335-e0b7bea4f67a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496636, "uuid": "52375b36-8e41-46a8-b397-fac9c016be4a", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496636, "uuid": "de914511-256f-4bd4-bb40-98d3846bcf71", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496636, "uuid": "c96e3508-14b8-4dfe-9bfa-909894718032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496636, "uuid": "c786473b-e6c2-4a92-a016-8c6646ef0b8f", "value": "37e15c1c5ec863b78e25a1b2426b0e52995489adaf9a4b2101f805432508a4ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a22ade1-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618494065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494065, "uuid": "538d5dc5-4091-442a-9eaa-289b533b433e", "comment": "Malware payload (Loki)", "value": "930b4f1a7477d8bc0bb048593da725c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494065, "uuid": "9ef21e51-22df-42b0-ba6f-f114b3f6b732", "comment": "Malware payload (Loki)", "value": "37ff29b98644258627ebff25a099f9bea0965a5e6d41ce8506bf08d86668da3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494065, "uuid": "61e6538e-f6d1-4168-9935-1867ded0acbc", "comment": "Malware payload (Loki)", "value": "e7d53bc9ea8a6b7ed4f1611f39ee98a6a35d6968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494065, "uuid": "17b0a3c2-ed8b-4a21-9dcc-ba2b54a94699", "comment": "Malware payload (Loki)", "value": "0dc3f6bcd106c58083fe4c913735fd5448e7ef9c59f33fa1b082321a787eb98ddb3d4b3cc0298267bbd37fa3be0e1f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494065, "uuid": "0db118eb-01e4-4e34-b9de-ae7f83ef7c40", "value": "00F4F1109A8CFBCAD86E47B9C4A09A7603735623D359D71FE84D30C859B1782F92D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494065, "uuid": "2a143d85-d4a8-43a3-9981-f36ee20b3f88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494065, "uuid": "e98c3ee4-2005-439a-ad34-a54add8db276", "value": "12288:A2u/wDE5cplWAND1hUQ3jqg6p/yW8sLb8280f1BHx7EgoYCUWefkFIq:A2PDEWzRND1hUuP6RyWfsN4HVEgoYCUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494065, "uuid": "d7f8e243-6a47-4fee-a66b-b0e20adb33bc", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494065, "uuid": "a563eb6e-6be2-4131-a2a2-1b6e61368c92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494065, "uuid": "c998634e-d8d7-46b9-ad5a-61285092d0a4", "value": "PO-414707_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7012df22-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495874, "uuid": "2376ce3d-d08a-4b6e-ba5c-b7b5340bad24", "comment": "Malware payload (Dridex)", "value": "35601c2e457793d77d1a0f75b971ae33", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495874, "uuid": "6a344753-adea-462c-94cd-629aa9258457", "comment": "Malware payload (Dridex)", "value": "380833deff6fa52cf8cdce5cfff90c030e9872d5edbd3b65d34e9b22b1d6541f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495874, "uuid": "6fb347ed-c74e-46b7-801b-a3c761541d00", "comment": "Malware payload (Dridex)", "value": "ba0ce9a2c529c9560caff5a647a0608640b4e5a8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495874, "uuid": "9a89d81e-3c5d-4e0e-baaf-083be5057275", "comment": "Malware payload (Dridex)", "value": "f79bbef8b5836ed1fe3ef79f854605b8d206fc5e767449b53278edb6d93cbfbe1c8db9af6a9dfe187b935e9321746fa9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495874, "uuid": "a0e57a5c-e44d-4a8a-ac00-aa32dea6a06d", "value": "F8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495874, "uuid": "b1f16655-ee86-435c-9897-81a762ad7063", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495874, "uuid": "91cc8115-f701-4f73-ade7-c89cc2e9a92b", "value": "3072:JA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:J3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495874, "uuid": "bf0fd6eb-f8d7-42d7-8cf9-b3801530abb9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495874, "uuid": "44e9a4e6-ed90-4634-a13d-892fc3e2fe43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495874, "uuid": "3493a479-cbfd-4d4a-8c1e-19d1313e83e8", "value": "380833deff6fa52cf8cdce5cfff90c030e9872d5edbd3b65d34e9b22b1d6541f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d32820-9dc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618476531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476531, "uuid": "6ea8ec6b-fe09-4e1d-ab6f-01d1da7dfa39", "comment": "Malware payload (Dridex)", "value": "7ed3571740d806b8224a6fdc017f3a61", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476531, "uuid": "105bd6ad-7be9-42fd-8f0a-32cfdf2fb8b7", "comment": "Malware payload (Dridex)", "value": "38269bdba220519ae112c78a8f46ab9c7d61bbc7d065215ae4c5d04a08f09f04", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476531, "uuid": "18414c24-d272-40bc-b957-2e587dae4c17", "comment": "Malware payload (Dridex)", "value": "00947fbc2a108e2ad37018488e11f80f06772347", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476531, "uuid": "51185ca8-91a2-48f1-8aa3-f4f678714d14", "comment": "Malware payload (Dridex)", "value": "cd5b3f541065ec64456c07792547bb8c115240d19abb5ee088e033f708514219f837ce100e3b2ea615e6debe713ac8c9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476531, "uuid": "f075e026-65e5-471f-8322-6b1bd139c8bf", "value": "41F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476531, "uuid": "35177720-a6a3-478e-851f-7777753e52bf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476531, "uuid": "dda659c7-eebd-4b2d-9e97-69a9ac3e12f6", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476531, "uuid": "f3bcfac9-7e8b-4973-ba67-50d7d039742c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476531, "uuid": "ffc62113-0d90-4261-af8b-070aa5051960", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476531, "uuid": "de010142-9fac-489a-9374-6df401bc3cd3", "value": "38269bdba220519ae112c78a8f46ab9c7d61bbc7d065215ae4c5d04a08f09f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d98466-9dbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618471382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471382, "uuid": "701a5ea2-a702-4e74-9a9d-daa360bc771b", "comment": "Malware payload (Dridex)", "value": "2c90c173de9ea4bac5ff7c39a031e657", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471382, "uuid": "a3dfde70-7c4c-477a-89e2-dde79e5ab67d", "comment": "Malware payload (Dridex)", "value": "3835cac77fdbfe680a115177fbabb7589b4221b5aa74347f41cda4b979c1150b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471382, "uuid": "c88587c4-4e4b-49ce-9a5e-0760f26f1e93", "comment": "Malware payload (Dridex)", "value": "41c5c506207c8c03cd86505d5f34638a0ebd1ec9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471382, "uuid": "f0448bd7-e095-49bd-8de7-b1346f0ff8dd", "comment": "Malware payload (Dridex)", "value": "f58c994b0bac05ff0e0372fa99617f667a461ad32885180bd747bb6d84ed79a636b0c6c41bba67fedd1646a46baf6c8d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471382, "uuid": "2cdf942c-0bc3-4983-bb2a-062e9075134b", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471382, "uuid": "406e3d30-b527-4a74-a06e-0d656786a58e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471382, "uuid": "8e21858c-7ca1-4e00-b23c-7b09743ab561", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618471382, "uuid": "b6fe55d6-7da8-4eae-bc69-450fbc5fcfae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618471382, "uuid": "8f3f50ee-42d9-42e6-aeb5-20891e1713dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471382, "uuid": "55f59faa-d90a-4f0e-9cb4-4790697f3b93", "value": "3835cac77fdbfe680a115177fbabb7589b4221b5aa74347f41cda4b979c1150b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6493b0-9daf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618466264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466264, "uuid": "423a505d-20bc-4796-af03-273508fd6170", "comment": "Malware payload (Dridex)", "value": "1e37b9f85657cfd6a93615fbed2ab03b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466264, "uuid": "08946267-0c96-46ac-91b7-2d44b3b088c8", "comment": "Malware payload (Dridex)", "value": "38692a98a7e1ffd26b5586b0428182aa1a3421e82a0e43e8bb29a94a37c47e3b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466264, "uuid": "f977fd34-de87-4224-9866-eaf6b1d5cf3a", "comment": "Malware payload (Dridex)", "value": "de5df9414e5e10fb86eec43d22ff67cd50985a6b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466264, "uuid": "042af8cc-acbe-40a4-b963-c6b12984c41f", "comment": "Malware payload (Dridex)", "value": "dc2e4f877f0c099673a67830f5ce01457a6ead7073158c5626e56c4fdd449d5999fcb7bcc3a440dcfe0165bcf23f8d09", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466264, "uuid": "64a56919-dfb9-407d-819a-f6e77c6cf4cf", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466264, "uuid": "d10abe9e-2bb2-4c59-96af-2decfc8184af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466264, "uuid": "4fb0c39d-16c7-4fab-9145-c1f3fdb9bbdd", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466264, "uuid": "38e668b2-31ec-48e9-941b-2d38e7127193", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466264, "uuid": "76b2a02d-64ae-4a3d-bc26-98e9b1b16873", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466264, "uuid": "a1fc614d-3281-4b74-a3cf-c806a71a0280", "value": "38692a98a7e1ffd26b5586b0428182aa1a3421e82a0e43e8bb29a94a37c47e3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24353d2c-9d7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618445495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445495, "uuid": "b487c482-c4b7-489f-b7da-99168c329926", "comment": "Malware payload (Dridex)", "value": "4c3d1b3a17ee574093e43bc359b3419a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445495, "uuid": "5fa6198b-ee4f-4d97-b675-9b4109e77e7d", "comment": "Malware payload (Dridex)", "value": "38e5b7c3bf96af714fd113c5934d61bdd665c9a2df0d7f225ad66126e2083d90", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445495, "uuid": "4e29c69e-fbd0-4a60-bd0c-01563009e540", "comment": "Malware payload (Dridex)", "value": "fac75d3d294a5d89508668dfa98c79dd0381d6f7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445495, "uuid": "bdf4f937-cf63-4411-9d49-3090270d4e73", "comment": "Malware payload (Dridex)", "value": "4b6e006d569aded1db8bfe57e3bb32a8cbbde92793633c1f7242f93816f8b24f28289dbc389fce6edf80ad2fa5679cd5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445495, "uuid": "33fb5378-494a-40c0-a9d9-053517c54feb", "value": "34249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445495, "uuid": "cfa1cedf-b42d-45ae-a1e8-030b829794ab", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445495, "uuid": "e29e00c6-d344-41cd-85a3-517296ff6be4", "value": "3072:U0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:fpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618445495, "uuid": "a9c86a54-8cfa-4c7b-b625-e780278ef60b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618445495, "uuid": "ca9f93f8-896a-40ac-b11a-133bd88b1448", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445495, "uuid": "9751a810-d6fa-4a10-8405-ee861c9449aa", "value": "38e5b7c3bf96af714fd113c5934d61bdd665c9a2df0d7f225ad66126e2083d90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dedad1-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497008, "uuid": "646cf296-3645-41f0-8e59-24775051f0c7", "comment": "Malware payload (Dridex)", "value": "3d1b4e55864f2bc84a5e2469bc327de8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497008, "uuid": "5fe29edb-8271-4c69-a3c9-518e432c6398", "comment": "Malware payload (Dridex)", "value": "39499058348debb4c4eb357001a1203539192e848d3c1f9d38843fb6a0dc27cd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497008, "uuid": "259d8dbd-8f86-4b5c-a909-6d11e5b50826", "comment": "Malware payload (Dridex)", "value": "7d6919237cf00cb49f749aa074542b20e2550f1f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497008, "uuid": "fe432f64-1b08-4b3b-9f56-9950a1a4d599", "comment": "Malware payload (Dridex)", "value": "118c580fb5690f77ef2b80c82a5e49f301c0f726b0123b496f94cf47f1bfb34cae015fc4c8565f13f32c724ed05335dd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497008, "uuid": "c52dd146-fe75-411c-b876-aabc8b5c5ac3", "value": "53F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497008, "uuid": "cd86c57e-45b9-4c63-9bf7-642f46955b00", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497008, "uuid": "901c8f47-8ec4-40ce-b278-7835abf7a433", "value": "3072:tA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:t3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497008, "uuid": "84f6f04d-af6c-4a49-b2b1-8cc5a45cc7f6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497008, "uuid": "99130faa-90e7-4d06-9114-6fa4a0ce8a21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497008, "uuid": "abeb1841-c43f-44f8-b1c0-bfeac15be857", "value": "39499058348debb4c4eb357001a1203539192e848d3c1f9d38843fb6a0dc27cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b54a672-9d95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618455090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455090, "uuid": "c20d5580-942d-45d5-8d16-5d90017da3cd", "comment": "Malware payload (Dridex)", "value": "eb88805df37a7c4fa2256710fe6b6207", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455090, "uuid": "8a8b0f59-3e73-46dc-aa97-0259e8020e2b", "comment": "Malware payload (Dridex)", "value": "394d4a32a54e654bd6bc4805e789cd4a9db6c1a5b91ae27b068479e08ef165ce", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455090, "uuid": "66ce740d-2856-44d1-88ed-08d47c3be16e", "comment": "Malware payload (Dridex)", "value": "ddfd06d875524e7594275f230b12e030ff4e0cda", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455090, "uuid": "4b36b73e-45a6-4aed-a7e8-045f5b006075", "comment": "Malware payload (Dridex)", "value": "c60587dd4320c887b6102489fc9af90f18664139a22e6551fca9f35f185053a82e9f41f1cc92f9e63fbb3daa5b7c26aa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455090, "uuid": "2a5cd690-82ed-4709-a0ea-a896c421026a", "value": "6B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455090, "uuid": "ddda9068-5355-4d64-8929-a1192a8203e4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455090, "uuid": "4a310ec9-b622-4245-90f1-d044a62bdcd0", "value": "3072:Q0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:rpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618455090, "uuid": "76f8e8a6-d670-4945-af46-4aa5945b09ea", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618455090, "uuid": "529fc7ce-b4c0-4c5b-adb0-ed88f438bd56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455090, "uuid": "6c0844be-a968-46e4-9ba7-ae2070035040", "value": "394d4a32a54e654bd6bc4805e789cd4a9db6c1a5b91ae27b068479e08ef165ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2237addf-9dae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618465678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465678, "uuid": "e642d792-9e77-4291-bbde-e6443a3f98b6", "comment": "Malware payload (Dridex)", "value": "79832a3502994b298321858a3df5cea3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465678, "uuid": "2ec86ac4-3281-41ff-9b23-96756f95b363", "comment": "Malware payload (Dridex)", "value": "3976941da04d6b3173ef79d244e99a39d39ad0c6a0a8ddf863c54683985e64d7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465678, "uuid": "22020bc4-ec96-46ca-af6d-9e0a92ee474b", "comment": "Malware payload (Dridex)", "value": "11848209f03d4a566db5cdd1a65a32b1a839ae28", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465678, "uuid": "3ba9d484-b90e-4c48-b905-51d64aadf918", "comment": "Malware payload (Dridex)", "value": "fb6bd9b2459c56bb41a8cdd7a830cdb9e90257cc4ec86ed7bfe1c8d0c1657de2a06f5a5a0b1f414d2c1332a8363cdcf4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465678, "uuid": "df3dc463-3fd7-492a-8691-a65f0a8ff7e1", "value": "4A249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465678, "uuid": "d62278a0-93e8-443b-bdb3-69841d7ca177", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465678, "uuid": "c9de9937-bc14-489e-af66-708edcc66566", "value": "3072:b0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:6pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465678, "uuid": "b8cc8a87-b61b-4a0a-abdf-e08c9dac94fd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465678, "uuid": "a11c8a98-cbdc-4b90-bc06-9e1314dfcde9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465678, "uuid": "b10d6aff-428f-43b1-bab7-a5bb2d82a4bd", "value": "3976941da04d6b3173ef79d244e99a39d39ad0c6a0a8ddf863c54683985e64d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da306660-9dad-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618465558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465558, "uuid": "b957019e-924a-447f-bef0-bf6944cfd0d6", "comment": "Malware payload (Dridex)", "value": "937834c4e6a758378ca32083f48c2f50", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465558, "uuid": "3ed7b5df-ca5d-43a2-a0ec-a17365ad41d5", "comment": "Malware payload (Dridex)", "value": "39897e591c7e1e79ca3f87afbfe5a76d890bfc8e325ee38c1fd8d92eb78cbea0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465558, "uuid": "5d5a6dc5-5b70-4bbf-b89c-b2570047c424", "comment": "Malware payload (Dridex)", "value": "94d3beb27e5abd821f12dbaa40b83d978c960fb3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465558, "uuid": "75e0b4f4-53a5-4659-a282-f95efa39f43a", "comment": "Malware payload (Dridex)", "value": "05757630482e70cded916a6b0a04d759033fd751887a2a07ffea440c17359f0b58278eacf840c6e6444971c9af418445", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465558, "uuid": "cd112e2d-d76f-42dd-8082-1842fa8c3220", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465558, "uuid": "c96c56b2-81cf-4f9b-bc12-f067fdbced5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465558, "uuid": "337667d0-045e-49d6-bb84-b4e20e96ea1e", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465558, "uuid": "2cc9d899-ccc4-4c16-b225-64d8968368ef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465558, "uuid": "e774b56e-b643-4cba-b432-16802ca4cf90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465558, "uuid": "727499a2-f9f1-452d-a2c1-c63d13e38c2b", "value": "39897e591c7e1e79ca3f87afbfe5a76d890bfc8e325ee38c1fd8d92eb78cbea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2defda0-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496818, "uuid": "c63bf1cb-4813-4bf0-b90a-fba6607aecff", "comment": "Malware payload (Dridex)", "value": "08da5d5a0d20acf15ab2bd74fd55ba9a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496818, "uuid": "6264e51e-445f-4d67-bbe4-45584eaa943b", "comment": "Malware payload (Dridex)", "value": "3991a129b534559d689a841e71cf305f44b8c1ad79ef8dc6e7c5d655fc976481", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496818, "uuid": "84aa7aee-cfb6-40b6-9c52-af9bff36383e", "comment": "Malware payload (Dridex)", "value": "1b4c2cc33d0f5864cfffd62a4a3c761e621fbd11", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496818, "uuid": "9d0341bc-d80d-474a-a4df-04cb0970154f", "comment": "Malware payload (Dridex)", "value": "4ed52afbbc61dca046eb29191b78064ecfc614194035e1e6806c3ae3843aa9f63a7ee426af67af96e936ab3c5f27d2a1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496818, "uuid": "d0b0b5af-04ac-4841-8c24-b39c957d174a", "value": "64F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496818, "uuid": "3b6a1469-19d5-446d-b63b-ce8b6b4c0804", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496818, "uuid": "e40759a9-6f41-4276-834a-a32d7d2909fc", "value": "3072:6A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:63J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496818, "uuid": "6d5f5649-6abe-486b-855e-9ff58ef6699e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496818, "uuid": "b47be664-5995-41dd-85d3-c80260c7cd37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496818, "uuid": "7a748dd0-fe3a-460b-ae5b-412eb4ebef2e", "value": "3991a129b534559d689a841e71cf305f44b8c1ad79ef8dc6e7c5d655fc976481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d86b007-9dc5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618475737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475737, "uuid": "dd9526b2-758c-4d17-8761-64e92b261bd9", "comment": "Malware payload (AgentTesla)", "value": "a9f977f4474232ad2c32e4369970e595", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475737, "uuid": "0897e1e6-c4cf-4e07-b61f-3f19ea870659", "comment": "Malware payload (AgentTesla)", "value": "39a5450bdeb2c452154a44f55dadd28da051f3639e65afc256bcd23b1550e7a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475737, "uuid": "843419d2-be42-4487-85da-760f3bce6d05", "comment": "Malware payload (AgentTesla)", "value": "e893e96c200b0c25466c8d5d50dcaca886925541", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475737, "uuid": "95cc6bdd-c703-4bed-9a7b-983753c45898", "comment": "Malware payload (AgentTesla)", "value": "b99ecc6cf5c4854ef8c3cdb8f6cc1525aed3a8dfff7a6b63ee883697666440daecc0c38405d4cf9e4f839b1541c6cb5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475737, "uuid": "9cd180fd-6812-4497-956a-49e38432ef57", "value": "15D423AF2CF368EE1769135F087B21E092D4911EB358AC5E31FD429D91BB8E9C59C027", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475737, "uuid": "0afcae9f-ed9d-4910-9570-11a6cd0292f3", "value": "12288:wWqD8JKRo/sx6d7mbe16iMMviyoNI4TpNtWjj55uxNQFpNk2w5TpIrLQv:wWqD85/5KLFbI4tqtIKK5F46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475737, "uuid": "ebb004b9-ac01-49f6-9e35-a363c98e164e", "value": 616540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475737, "uuid": "5d397a07-e341-422d-af1a-98f2d44503c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475737, "uuid": "b91d209f-9c9f-4882-9894-4cd6d949238c", "value": "HL-88352588 DOCAU BC ORIGINAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1804db-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496025, "uuid": "2dadf339-de71-49b1-8ea5-60b3682eda73", "comment": "Malware payload (Dridex)", "value": "46d22002b9ab8dd62a89b9921951287d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496025, "uuid": "8d653d71-1f28-40ef-92d4-cef284569a7a", "comment": "Malware payload (Dridex)", "value": "39cfe836685174fb018bef12d1f4c35bbfccdc7618292c91520d638df9d2a344", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496025, "uuid": "844e4d23-addf-413d-956c-58ed94375115", "comment": "Malware payload (Dridex)", "value": "8f7298576f51b1631491069a978f0df583995607", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496025, "uuid": "71e145b3-e393-41fc-a477-1f62a1ab7241", "comment": "Malware payload (Dridex)", "value": "82f62a2ec3213d21bf7e6c32fde687410a6a194403ea37c8cca9120f58054f3eb602f69e6a01bf3918ec52d9abe32b03", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496025, "uuid": "a0b6c5b2-191f-489f-8466-dc325171ada3", "value": "7FF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496025, "uuid": "faddf1be-6166-4e1e-8856-caf9e8e6ea83", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496025, "uuid": "8903a9e9-0ca4-4803-9c25-9d07ef9f67ea", "value": "3072:EA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:E3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496025, "uuid": "50fd40b0-6559-4769-a5c6-22da8b986151", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496025, "uuid": "9476c867-6491-4439-8c89-927efc308b9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496025, "uuid": "a4a696d1-ad80-4236-93ad-f73b85a34e96", "value": "39cfe836685174fb018bef12d1f4c35bbfccdc7618292c91520d638df9d2a344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd2f036-9dc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618477237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477237, "uuid": "965b3c1a-2bce-4715-9e0a-e28ea6899ee0", "comment": "Malware payload (Dridex)", "value": "b8ba10e809c60a6d9d13919514b1e887", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477237, "uuid": "6dff33df-3d1d-4bd7-adae-4b1fe473dda6", "comment": "Malware payload (Dridex)", "value": "39d1adde81a7c3bec35b75fd7649fde82ea81716f3222094d1213423e749ba84", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477237, "uuid": "0d6686c9-3103-4632-a96e-1d44cc5fd5fc", "comment": "Malware payload (Dridex)", "value": "36e1dc91334147fc905ad7921c1025a974091590", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477237, "uuid": "fd41e5c6-e374-4c97-8227-becdc87c7e19", "comment": "Malware payload (Dridex)", "value": "14d5cf15424bea2f49b73df781591a56494b7c47c8508289178e0b964bfedca9292b5e9af4725c3f7d605acb65c73c90", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477237, "uuid": "05ce6f21-689d-4380-8747-37e04b790811", "value": "33F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477237, "uuid": "2bd656ab-c492-4ceb-896f-6d98cccc0235", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477237, "uuid": "2744ef9d-9624-4f2c-ad3d-e36756bf717b", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477237, "uuid": "b4238be5-b56a-49f0-9337-468e370add86", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477237, "uuid": "bfc85152-b569-48d7-bf31-495efb3f7e66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477237, "uuid": "135e25db-8f3e-495d-b6fb-257e396e78be", "value": "39d1adde81a7c3bec35b75fd7649fde82ea81716f3222094d1213423e749ba84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304b1026-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "1d046b45-3601-4744-bd14-3dd26eedb8f8", "comment": "Malware payload (Dridex)", "value": "817095b28ca2b7169924d0c7e7e59a3e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "597027ae-8451-4137-abda-8ed1787ecd09", "comment": "Malware payload (Dridex)", "value": "39d793eb44a6ccb59b49029e4b5a617482e481fd6778d2af425fc613f87bf273", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "5c35bce3-f9ae-4599-9d7c-ade1f9e150ef", "comment": "Malware payload (Dridex)", "value": "a98e52a323f1014dbcb46eef3d0bf4acbccec94f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515953, "uuid": "6ed5d5a9-3630-49b3-ad5e-0468b74781fe", "comment": "Malware payload (Dridex)", "value": "48b4638ddd29d986024755cfba7d6af0d5b172dce12bb952b6034151be11789d18188f38ff640ad7dda12814a730333a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "40c5dde0-bf2c-4fc7-947a-e6cac2b91386", "value": "13F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "84198821-8b3e-4c94-bd8b-9a29854872c8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "1d95a8fc-8225-49c8-bae1-0196a126de61", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515953, "uuid": "a5133f8b-b1f1-44cc-a994-3809e8d64dcb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515953, "uuid": "707a46ea-a25e-4ee9-a4a3-84a8ca2be4c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515953, "uuid": "1140b071-7469-449f-8612-7ab08927ae12", "value": "39d793eb44a6ccb59b49029e4b5a617482e481fd6778d2af425fc613f87bf273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bfe7a5-9db7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618469635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469635, "uuid": "f831779a-d3d6-425b-ba90-e674fea5c314", "comment": "Malware payload (Dridex)", "value": "cb58bb13a694496ec5733778bf265ed0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469635, "uuid": "d698cd95-57d5-42fd-bfd6-d0d425fa1459", "comment": "Malware payload (Dridex)", "value": "39db3f8a55f429a6f384941c744b36cc62596ab03870ee8fb701ae7ed46618a5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469635, "uuid": "46279367-adee-42a2-bce2-1d088212bacd", "comment": "Malware payload (Dridex)", "value": "5fcc76c43ad6ec5bb5a46f5466375b22a0c67176", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469635, "uuid": "6b21fb82-500c-49a4-836e-84b05b46b177", "comment": "Malware payload (Dridex)", "value": "36bdf577e480f3ba0101be8835b1aef652d263a93cff1fe39404ee8d86c79d79da49e72b76fd80de84f090cee5710c31", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469635, "uuid": "450b5007-ef14-4dd0-9f54-25d2725c08a6", "value": "08249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469635, "uuid": "d9acb250-d487-47be-b1fb-2580317d512b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469635, "uuid": "768cb1d8-5bc8-43c0-ac6d-fe1b8eadff64", "value": "3072:b0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:6pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618469635, "uuid": "83cb50a2-f4eb-458f-abb7-09426e35c3f7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618469635, "uuid": "fe7efb6e-6c63-4b12-806e-eed618ded509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469635, "uuid": "fa845f6b-193f-4898-9e67-32670f5095b9", "value": "39db3f8a55f429a6f384941c744b36cc62596ab03870ee8fb701ae7ed46618a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c566418-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618514255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514255, "uuid": "c6dcd4ba-accc-4cda-b257-669f17f01239", "comment": "Malware payload", "value": "00fb503aa82eb94e6d14b96bea1bf5b2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514255, "uuid": "37544cd0-fc13-47f5-9257-e4581b679362", "comment": "Malware payload", "value": "3a28c26fbb1e89ff548e48cfc5531339f71970c0df08b63ed014049e602ef3ea", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514255, "uuid": "2188843a-7a3d-46cd-899e-3b1011fedfbd", "comment": "Malware payload", "value": "4d8d834a10e9836e6c45d37821dce77884b3ad4a", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514255, "uuid": "da6bb49e-9e61-420d-9b97-19b66da05889", "comment": "Malware payload", "value": "ba6f617d5a1175bce476d55262fb7ff3f46b214203cd8c6236815d8136ef528e3e74900e5a134c829d088b719f813248", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514255, "uuid": "91259be9-10a8-44b1-a16b-c6bb5ce36090", "value": "82A2BF3CD270DE1CC63A843DD02800F0AB5F9215D9637458B981F25F7B41AE76B8FAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514255, "uuid": "d40de900-86c3-47ff-b8d2-e66fb0caa5d5", "value": "384:TLtAJ+327vMvENAP+PorHaxWUARvBIbAj/0EUlM9ziubq8SXa0c:Tx8+327vMSAP+QJUA1hj/Jx2ubq8SXTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514255, "uuid": "e91109eb-1e40-4f1b-bac1-df563c1d4181", "value": 22578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514255, "uuid": "435a4fc1-75a5-40ee-9bcd-5b30fdaac3a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514255, "uuid": "5fa01b00-b269-438a-93af-620634194ee8", "value": "document.3373.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f90d8a-9e03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618502277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502277, "uuid": "26f8a81c-0e4a-438d-87ec-3254e8b7fdce", "comment": "Malware payload (Formbook)", "value": "a9deb2ec9954233d8ff397c46cc7c33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502277, "uuid": "7b710083-2448-4971-9dd0-c449b787bb42", "comment": "Malware payload (Formbook)", "value": "3a7994df6e69118ca5778366f7dbf26e37430d3b9d20a163ace830e5a1971ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502277, "uuid": "6238d0b9-0d26-49df-9c2b-75de69d99114", "comment": "Malware payload (Formbook)", "value": "6132ace675ab07976d8711aa05c9dda82436eea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502277, "uuid": "9d0d9d7b-5203-4e29-8c06-1ca9734a2b5c", "comment": "Malware payload (Formbook)", "value": "f55d89e7baf93d1e73b4a249097b5602bf3b0b9fe3dd22a2116aba9714d5408bfe34d1af561a0dc8905c915af9988aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502277, "uuid": "c2c4654e-0c64-4437-9981-1d2744947864", "value": "1915012237946B53E13E623854B5019102F1FE217AB7DA5F7CE4758E36B2B428722B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502277, "uuid": "db1e2c01-edf2-4487-950b-9cc758f50857", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502277, "uuid": "c2863019-0dbc-43f0-99b6-1197e06e5080", "value": "24576:hLo5haHuih98fSJ2Tl/mf4bXTP65kyycaCco5hr4R57V:hZ8aUTl+f4bXo8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618502277, "uuid": "b80f4648-2696-4591-9223-a6d2538da18a", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618502277, "uuid": "5936ee60-931a-43f1-857a-b58f366747f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502277, "uuid": "afe35d97-15bd-4c4f-8524-d48993ff7fb5", "value": "a9deb2ec9954233d8ff397c46cc7c33a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cbe0a7-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497002, "uuid": "2004f60d-b237-4339-b85e-b6793307f32a", "comment": "Malware payload (Dridex)", "value": "a334b7774e04cc380bf73b43be1e1919", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497002, "uuid": "8c1aeb72-2b6b-4a46-a0ec-6cf3ac831062", "comment": "Malware payload (Dridex)", "value": "3abeb5f860048927e66aebb50541f360c19aa121c66f6096799f6ff2f9be1532", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497002, "uuid": "e8b6c224-6822-48d0-85be-959216720b62", "comment": "Malware payload (Dridex)", "value": "200ff1488ab4864834408a488a8416e28b6fb21a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497002, "uuid": "54b9dc0e-f34f-4c4d-bdd8-9c3f5482e8e0", "comment": "Malware payload (Dridex)", "value": "95bd97c8888926e401dfff61ac5ce887f42a5f11339590bb8e1b27c7a230968bc9cb7bd7d7f209900904a97d264e6bee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497002, "uuid": "acc1527f-5a66-4708-9672-292529f43f41", "value": "31F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497002, "uuid": "b44f111b-c6d9-4695-99d4-4e701ca83e59", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497002, "uuid": "5f02ac26-3fd0-463a-ab99-554773ddb853", "value": "3072:2A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:23J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497002, "uuid": "3903bb71-5113-4d82-bcb2-f3f5088f2633", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497002, "uuid": "1f823b25-b6c8-4bfb-986e-4a400bac2a0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497002, "uuid": "0efa8172-48cf-4977-a766-1834372fed35", "value": "3abeb5f860048927e66aebb50541f360c19aa121c66f6096799f6ff2f9be1532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ca9cda-9d80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618445976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445976, "uuid": "50bb012d-0ee6-49f2-9d5d-4b8565dccb19", "comment": "Malware payload (Dridex)", "value": "0457ae4ad35eda231742e0c7ca9712b1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445976, "uuid": "fa38931c-6c25-4680-88e1-1712dc256933", "comment": "Malware payload (Dridex)", "value": "3b745550bf6918d879d573bf1e2e303eca922efa962fd3fff6032909e2a7dd0f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445976, "uuid": "62d946bf-8d1a-4327-af50-a000545e0758", "comment": "Malware payload (Dridex)", "value": "534a5b1bf44c0f3a6fa5470ed3243a975c4d26b6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445976, "uuid": "897e4a0f-5f33-4d6c-ab42-4cfd03925b44", "comment": "Malware payload (Dridex)", "value": "d87955f31d996a296664e105b25a1746d4a69761ebe23da68c142b06c3154ce2a00becad928cf1600369eb64a4557941", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445976, "uuid": "96d5dcb7-9221-477f-b181-cd9a223db820", "value": "F8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445976, "uuid": "5b475ddc-f190-4e64-85fa-ba7208665a1e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445976, "uuid": "8afef940-54c9-4c68-acc3-c6d795f80070", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618445976, "uuid": "878377cf-2595-4f7b-bf84-8eccf2ef309c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618445976, "uuid": "cfe82e72-9599-49ed-ab33-de872d553fe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445976, "uuid": "f46171e5-8c2c-4330-b59f-4d9458f4731d", "value": "3b745550bf6918d879d573bf1e2e303eca922efa962fd3fff6032909e2a7dd0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faeab18-9e43-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618529723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529723, "uuid": "c8ae9d7c-73c9-4445-b87d-bc766155315e", "comment": "Malware payload (Dridex)", "value": "a60814ca9e01dbf7f5ffd9b79846da90", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529723, "uuid": "756ff504-9637-4378-9a46-812079258689", "comment": "Malware payload (Dridex)", "value": "3b836d95a8b5f9181f9421e1e0a4a77a499e4d7f27997aab570778d9fe7ccb46", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529723, "uuid": "10d3c3c9-0c11-4ee4-b818-1816df30a402", "comment": "Malware payload (Dridex)", "value": "f9f430196079b833e797591adda7d901ff9e20e7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618529723, "uuid": "9221012a-a3e8-4adf-97aa-6fde9e74f61c", "comment": "Malware payload (Dridex)", "value": "e312bf39b9ccdd3c56484269dfe4de8b93e0315e05bfb1edd3652df05686bea990c2eb608ec534ca5946fb59801e9399", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529723, "uuid": "a297ce5f-22d8-44ac-97ea-b37540f85733", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529723, "uuid": "8e3963c7-1240-479e-83c0-ecaf87514e92", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529723, "uuid": "90962cb5-589a-4c73-bac4-81f812a034bf", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618529723, "uuid": "3c49ffed-36db-4be5-b9af-4047342e9f3d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618529723, "uuid": "5ce1ced0-c7c4-4e91-965a-02f5947a8d02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618529723, "uuid": "525142b2-6393-4103-b736-88bd4aba75a7", "value": "3b836d95a8b5f9181f9421e1e0a4a77a499e4d7f27997aab570778d9fe7ccb46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241705c5-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464393, "uuid": "59900320-cb8c-4795-9443-40c2f2836aa9", "comment": "Malware payload (Dridex)", "value": "a58addbe7e44f955156f4eed9e045289", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464393, "uuid": "7178ea48-0498-468f-b78a-b07b768f3c00", "comment": "Malware payload (Dridex)", "value": "3b859bac4403a03f569bb80bfd44cddfe8f462631a59175d09b2ae6fe98bb1e5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464393, "uuid": "0daa7a38-7033-474c-abe3-d0a9d8640d7f", "comment": "Malware payload (Dridex)", "value": "ac7fc5cc7733da368773c6b2aa7b7d2892acbeac", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464393, "uuid": "091d0711-883d-4854-81a7-001e0901c425", "comment": "Malware payload (Dridex)", "value": "311b417e1b7b6561a93fb565bc5bd3e4c2e2a8ba905bae0c99d5608998aba0e95e4f0a04a5e93a5375b70baf07f2d54a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464393, "uuid": "4a3f94af-1d97-409d-bda6-a8ef6c72d0f8", "value": "85F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464393, "uuid": "78fc6dae-8208-4d2e-b9fd-4fdb0465bf9b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464393, "uuid": "a6038268-5bc4-4117-b29f-6e3c99eda844", "value": "3072:yA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464393, "uuid": "c2162a3c-3a85-4afa-8db0-19cdd9f64acc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464393, "uuid": "8ad28c36-5338-44c8-af40-03cd5fbe1118", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464393, "uuid": "6a33ff85-e9a5-4095-9f82-ce562cc70608", "value": "3b859bac4403a03f569bb80bfd44cddfe8f462631a59175d09b2ae6fe98bb1e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e4cee9-9e0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618507337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507337, "uuid": "63c7ad40-ed37-4c16-a7f9-cba60adf4a98", "comment": "Malware payload (Dridex)", "value": "8364332b68a4237230fba78a0d246c9c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507337, "uuid": "43095e46-e361-4ccf-bdd4-c93c558eaf49", "comment": "Malware payload (Dridex)", "value": "3bc6ae015ae84e7a7e5108f4ed6f3c7fc1df07df4e6b06190d80c2a236d7fd40", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507337, "uuid": "713c03a2-6660-4959-ad86-909986fe1656", "comment": "Malware payload (Dridex)", "value": "37bf4f83b5e1d6a433a0035f6b05e889f064ff74", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507337, "uuid": "b9ba1b7f-253d-4792-9f66-6803d32780f1", "comment": "Malware payload (Dridex)", "value": "cbd9f2dc7394d172d8f4bb4fb6e07d84a5c2a1b75a48889f07521f3185da5ea4b5f42c7c414a7bbf65ad80bd0fc0d4e4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507337, "uuid": "847fdf78-37cf-4943-aedd-85f33cede5fe", "value": "FBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507337, "uuid": "f0383515-2466-4ee0-b495-889d37b6facf", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507337, "uuid": "7572941c-fee6-4188-8c24-db674ed80d99", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507337, "uuid": "64b4d0ba-467c-4d8b-a2e8-7452b3201fab", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507337, "uuid": "2b0ebb52-fc53-4efe-bcc1-bd1de343eb48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507337, "uuid": "bf0afcf0-f67d-4214-a5d3-4a6150a2c171", "value": "3bc6ae015ae84e7a7e5108f4ed6f3c7fc1df07df4e6b06190d80c2a236d7fd40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e000e9-9d8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618451776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451776, "uuid": "845d2813-a312-4dd6-986b-ec5a98620eed", "comment": "Malware payload (Dridex)", "value": "71ef73f3fdb8d0c977a8f617ba66337e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451776, "uuid": "bf2211fb-5fe4-4a16-9ddc-c4f0b77266cc", "comment": "Malware payload (Dridex)", "value": "3c06858813b9babd79a9a8af307e6019da6bd9b53e481ecd85cf81050d042a0a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451776, "uuid": "c121bcd9-31c3-4849-9b07-0090aff04e8e", "comment": "Malware payload (Dridex)", "value": "2207ddca4f13ef59358988b3b7a736e79e51a08a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451776, "uuid": "4a263c20-99a2-45e3-b2b1-f4e697572a84", "comment": "Malware payload (Dridex)", "value": "332262e084e811162ab7dd889ede61dce94b5e6720dc610124335d6e738d5ecec5af5d25bb7859673ee41a56d9ab25f8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451776, "uuid": "ab6472c1-4052-4384-b7cd-f0e25c398f09", "value": "BB249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451776, "uuid": "98638435-a6ee-4586-9ee9-60816bdd0505", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451776, "uuid": "e526183b-679b-404d-99dc-8e27f8483e6a", "value": "3072:D0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ipepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618451776, "uuid": "4b8f8610-82ec-4dcc-ad92-2acde025f173", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618451776, "uuid": "c0ec8b79-d5d3-48c8-9d35-a543981bb63c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451776, "uuid": "dd435963-d568-4de2-977c-1222e6bd0e77", "value": "3c06858813b9babd79a9a8af307e6019da6bd9b53e481ecd85cf81050d042a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ec1493-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496310, "uuid": "09a099ec-cc93-4389-9f42-b695bc1e452b", "comment": "Malware payload (Dridex)", "value": "6ae6da2eed94ac21569e83e8c417afee", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496310, "uuid": "f18143b1-f8fc-4d2e-a66d-f07521e990ad", "comment": "Malware payload (Dridex)", "value": "3c87765ec7b528f320a168af01d79d1e0cbe1a96bd228fa6492f7f4c2ce6457c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496310, "uuid": "55bc9a52-b310-4f1c-9b8f-dad9cccf2227", "comment": "Malware payload (Dridex)", "value": "7633b40a92fbc9ccb90db957708c2a4c8b38ecfc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496310, "uuid": "a78845ca-e2eb-46af-b204-529493675ffa", "comment": "Malware payload (Dridex)", "value": "65d746a3edcb501deefc55ccfaa5f4ed4369137357b906019054f11813ba1b197337192f59d9e120539c2ee6e4b6a0e9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496310, "uuid": "03afe36d-78ad-4697-995b-6bbf3f763401", "value": "A3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496310, "uuid": "dea14349-7377-48e5-9da7-d79f5fe57a32", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496310, "uuid": "9b3df482-d782-4805-9507-d0a5169ddd86", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496310, "uuid": "5c29d875-34af-414a-9537-6c2309bead33", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496310, "uuid": "19a69c51-5c13-4905-b1e5-335fb0ddc30e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496310, "uuid": "424f2b9d-cafd-4478-a0c4-edf59d3d9368", "value": "3c87765ec7b528f320a168af01d79d1e0cbe1a96bd228fa6492f7f4c2ce6457c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0795bb-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496114, "uuid": "77de2fce-73eb-446f-8f76-b1950a8ddfeb", "comment": "Malware payload (Dridex)", "value": "0d00b5ccce253a393e52da177b6e2565", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496114, "uuid": "50057821-448f-4ace-b2ab-424d78f715f7", "comment": "Malware payload (Dridex)", "value": "3cc5a27d198dd4afade213133eb80ec71f6fe859f1090f4ab28221ab29569162", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496114, "uuid": "d7b00287-dcda-496f-9a7f-7aca5695252b", "comment": "Malware payload (Dridex)", "value": "b9208d5073e43d504b6ba249a86d0b03cfc6f6d5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496114, "uuid": "838b909e-dfb1-4981-ba20-ed4486fc6492", "comment": "Malware payload (Dridex)", "value": "e2c0bc00e92642d3b2ff7485bfcfeb652a0d1dfe900b06f4428df2cf0c08064247792d97ed5dad1f2a93ce51e0fb7f70", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496114, "uuid": "c043b473-100d-4a81-a288-510de26cec62", "value": "D0F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496114, "uuid": "0973cbae-aee2-46ee-b52b-83531936654e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496114, "uuid": "2bc87b31-f952-4095-9841-b8dfc68f5606", "value": "3072:fA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:f3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496114, "uuid": "9f82dd4b-52fa-4f93-a4bd-e9b22fd9ea3a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496114, "uuid": "37bc9ce8-27d9-4776-8158-d689e5c61892", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496114, "uuid": "b9fd5a4f-9ff3-4532-bef9-201a6c754a7a", "value": "3cc5a27d198dd4afade213133eb80ec71f6fe859f1090f4ab28221ab29569162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23722e88-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496604, "uuid": "00affd03-3b2a-4da2-bcfb-ccb7003f42cb", "comment": "Malware payload (Dridex)", "value": "831c07c3a7f3628df8333341758db230", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496604, "uuid": "ec89365f-a547-421e-8651-20e411fd6be8", "comment": "Malware payload (Dridex)", "value": "3cdd2c351d0763f5f7033e6dd88c44386a3048b3022d5d6d3a721cc9c24ad1be", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496604, "uuid": "f401bb81-e3d8-4693-8612-a17b440bacc9", "comment": "Malware payload (Dridex)", "value": "264aee521306a0f3bdaea881f6b770ea24db95bc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496604, "uuid": "4aec9eea-c67e-4b18-8770-d5389057d26c", "comment": "Malware payload (Dridex)", "value": "2d7673f2ee627a53f7b82e16fd478782df48aea23fb7f46be7d8273c86d4762882ae7282d173301252f978ec653f29ae", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496604, "uuid": "b201d32b-eb66-4055-833d-276105784f4a", "value": "31F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496604, "uuid": "e4a5f4ff-8bbd-458a-8804-a02546e3f0c9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496604, "uuid": "ca14cb77-8847-42c8-992b-0a791bebd90a", "value": "3072:iA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:i3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496604, "uuid": "c0b7095b-4d87-49a9-be0b-cdb7f1535124", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496604, "uuid": "6bb777e4-7b57-4e22-8f3a-f74b0fdb7422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496604, "uuid": "fec00d5a-c549-4489-ad44-e4723c08c955", "value": "3cdd2c351d0763f5f7033e6dd88c44386a3048b3022d5d6d3a721cc9c24ad1be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febc8168-9e36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524460, "uuid": "e1f3a4bd-40d2-4303-a7bf-1c64a4a257f3", "comment": "Malware payload (Dridex)", "value": "1b5d96239e875e51c2c9d9a15e1050f3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524460, "uuid": "a0970585-3738-4d2d-9810-92b6b1b0cfba", "comment": "Malware payload (Dridex)", "value": "3cffbde25c8ad10d6a5d75439d8836e57202c545db93829b7ff817e0cc4b50cb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524460, "uuid": "5ac35639-b6a5-4b38-9dc4-cfd87c5f3edb", "comment": "Malware payload (Dridex)", "value": "fd94356def1643174b788cea74f56f4b910a725f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524460, "uuid": "3768c81e-f3df-4bcf-a51b-b93d76f74430", "comment": "Malware payload (Dridex)", "value": "d6e1918f34dec354558ebd525be322ecda2c463a38b3fe282e2f92a965620c3df1775e3b2e98f792b8bd6aae62bc453e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524460, "uuid": "8fbf99d9-3ee3-4109-8629-90b8406bbd16", "value": "E8F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524460, "uuid": "375be2f3-3751-4851-bc08-b168f1ab47e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524460, "uuid": "6b3adca4-9d47-4d8e-9892-d98c85af0e57", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524460, "uuid": "dddd1a40-93f0-4ad5-8068-5dbc713cbe8e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524460, "uuid": "9f7feb03-c54c-4dc4-aadd-17fce76ed3c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524460, "uuid": "5c7ea058-b598-4e3b-a811-2222ef4d0a7f", "value": "3cffbde25c8ad10d6a5d75439d8836e57202c545db93829b7ff817e0cc4b50cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e0688f-9e2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520424, "uuid": "3c66b9fa-a65a-43da-b39f-52dadbdb85a8", "comment": "Malware payload (Dridex)", "value": "0e3bc2e389d907229011e8b74131b14f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520424, "uuid": "20873110-1c37-46b9-b38b-3cef010a326b", "comment": "Malware payload (Dridex)", "value": "3d035c5fe2d134af452bda819287c943386e55aa7d8b0991fd7893ddae3439da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520424, "uuid": "865cea33-308f-463b-88e8-8b7f8c6ba92c", "comment": "Malware payload (Dridex)", "value": "96a514cac0f22a0410c45f994a822c3962c0bbca", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520424, "uuid": "b606740e-94fc-47e1-a15f-c0dc9b296daf", "comment": "Malware payload (Dridex)", "value": "c66a19d03b6b62d94af73a4787f903c169183e95bad5831637565c46cb3f7c51b166609afcaa8b9e65978ca714cb8aed", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520424, "uuid": "df73952c-6a7f-4299-9d81-cc3f4c159dcb", "value": "06F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520424, "uuid": "f1b4c21f-2f90-4707-9f26-9c8d85f627b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520424, "uuid": "c3c5ee43-10c2-451b-9ee9-27389a6d1012", "value": "3072:gVmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:g0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520424, "uuid": "fffb3f4a-1b8c-4b37-969b-d004a64e999a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520424, "uuid": "6c07da25-8a4a-4635-9600-6577659d68dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520424, "uuid": "6add2f4f-58b4-4ea0-843f-4ea18f9d8098", "value": "3d035c5fe2d134af452bda819287c943386e55aa7d8b0991fd7893ddae3439da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af6882a-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480699, "uuid": "3b65d872-fd00-40ad-bf39-c5ce325f23be", "comment": "Malware payload (Dridex)", "value": "33def64f2b6cd258d1b15835d65be333", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480699, "uuid": "c3012f13-e59b-4beb-a232-dbd16ee6b593", "comment": "Malware payload (Dridex)", "value": "3db722c1d7bfe52198195cee258b042f714561c395805e7e5853b59be2dd16e0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480699, "uuid": "6802c7dd-30f2-4b67-b060-b0457b443323", "comment": "Malware payload (Dridex)", "value": "310eb0c7802658fea1fa4a32aba40409bb9f5c78", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480699, "uuid": "a5312538-e9b3-485e-81fe-e4f783a6b74b", "comment": "Malware payload (Dridex)", "value": "02139e819f49816314ed102cb64e0e3ebe9ee65610925f1bdecfbaa0965643b6702634b0d6fb9c6d777fe99c884ebb03", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480699, "uuid": "be3d81d8-6320-4ef2-b589-308c2f6b8103", "value": "87F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480699, "uuid": "fa9f6d26-9cfe-44db-b7cf-b023c7bef782", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480699, "uuid": "145e0d4a-1733-4859-8660-8dc6093d3a7e", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480699, "uuid": "d8b5ba80-289c-4956-942e-a097085216be", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480699, "uuid": "a0562a87-6a4e-465b-87ba-d9a9c159e445", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480699, "uuid": "4cbdc5cd-a69c-4ef8-91b0-a07e31d16b4f", "value": "3db722c1d7bfe52198195cee258b042f714561c395805e7e5853b59be2dd16e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dda8217-9d9b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618457564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457564, "uuid": "0de79ac7-cecb-4160-88a9-6fe61e0fc2c4", "comment": "Malware payload (Dridex)", "value": "4349b08970afa25cd08fba82d789fbc1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457564, "uuid": "bbb53769-f4aa-4ecc-a56b-9d661c776d48", "comment": "Malware payload (Dridex)", "value": "3e10fa2841d6764464fac53a2bcdbda27deced25638fc82e0c571e940d33eae4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457564, "uuid": "1ad9f936-2b2e-42db-ae7c-04e07063b938", "comment": "Malware payload (Dridex)", "value": "204ab1f727f0c268040217afb005d8a9beec2ce1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457564, "uuid": "326e6bb7-4b47-4756-9121-e5078e04bc19", "comment": "Malware payload (Dridex)", "value": "e51564fb1dd2b9eb807d3120300d40f19c963342bd8f9c17d4123cc5358dcef12e0720f2491e16c35c0639f695a100d8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457564, "uuid": "bc628a8f-bc00-4ede-9949-a2b860ccf48a", "value": "03F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457564, "uuid": "05c0af58-df82-4661-a794-7ae538043279", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457564, "uuid": "767b52c3-5f92-4b53-8785-93ce7e563937", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618457564, "uuid": "82326fa4-f9bb-4ffb-ab4a-73bde195fb75", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618457564, "uuid": "bbe456be-9180-4e2f-83bb-ee43d2a5d1bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457564, "uuid": "b1f76f33-f3e7-4e1d-b1d9-14546d900352", "value": "3e10fa2841d6764464fac53a2bcdbda27deced25638fc82e0c571e940d33eae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dcbda1-9d9b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618457796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457796, "uuid": "d86ec8cb-8c5a-44cd-ad0f-3133b082aa9a", "comment": "Malware payload (Dridex)", "value": "5c66f772f8a22c486d95ce8d07bc27e2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457796, "uuid": "3e695293-ac1d-4d04-9b99-20c04e8367cc", "comment": "Malware payload (Dridex)", "value": "3e1f6d5541c8be18e35f89e0fce9266d80ffb718a9856871f9699fc0512b2ef9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457796, "uuid": "bf1cbc9d-6448-47e6-92a6-c288277f4330", "comment": "Malware payload (Dridex)", "value": "59559f985fc7820f10ed5433c02fecf4238cb663", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618457796, "uuid": "ec42b460-21dc-49bb-8b39-d6ac788aa222", "comment": "Malware payload (Dridex)", "value": "d36543fcb14ef8db471b0ccc5b24f2df7d279822773a1519fc8025a2765588a2cd3232e2336fa947ce554f422adc707f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457796, "uuid": "61689f0b-9d3a-4680-9fcc-aabd11c360c2", "value": "2E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457796, "uuid": "30a309b2-4f29-48ff-84a2-5c4076719cda", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457796, "uuid": "b77fbb0d-5e2f-4ea1-b219-da286291578a", "value": "3072:e0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:9pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618457796, "uuid": "4784ef4d-e8dc-4d61-b8eb-1485dc6eae1d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618457796, "uuid": "62f6284b-17f0-434f-b15c-4f77c1c23e69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618457796, "uuid": "d0b5c3dd-2323-4bac-ad32-b38445d826ee", "value": "3e1f6d5541c8be18e35f89e0fce9266d80ffb718a9856871f9699fc0512b2ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d22a78-9d88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618449639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449639, "uuid": "90790615-2a38-40e3-9540-87eddb66bd18", "comment": "Malware payload (Dridex)", "value": "d526db6e44cbde8d1da3544a2a316387", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449639, "uuid": "0a710a36-f7a2-4e56-8115-07f3a4cd21c1", "comment": "Malware payload (Dridex)", "value": "3e29151f405a6788d19987406da6e76e890b38065b3178ee59e9e66026fcf905", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449639, "uuid": "7836fd42-df5c-4fb7-aa33-2fef7db75d05", "comment": "Malware payload (Dridex)", "value": "5710a0324f6dbf82cb278b4a1006f36f00e87d13", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449639, "uuid": "7c36a735-72cd-44a3-af02-859e02386800", "comment": "Malware payload (Dridex)", "value": "90e8a8e7c93468942dc269f67a174a08fe374e3daca52926f4de0afc0086a3b49b518611ef959aadb8f1f941f1676734", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449639, "uuid": "33e1f5bc-36c9-476b-af3d-1b26093bd008", "value": "1B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449639, "uuid": "e4b1eb54-61c9-459d-834b-6ba499aacbba", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449639, "uuid": "bc06da89-31a2-4998-8093-fe3874f90c3b", "value": "3072:H0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:mpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618449639, "uuid": "32b2f061-699c-44ed-9a4f-726e179aaeee", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618449639, "uuid": "f72eab7b-9d4d-4c78-84fa-0c45f6afca17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449639, "uuid": "64fcaf78-6261-4c98-92cf-7e7a136c4bbc", "value": "3e29151f405a6788d19987406da6e76e890b38065b3178ee59e9e66026fcf905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab912b8b-9d99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618456889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456889, "uuid": "7f40f6cb-b03e-48f4-967a-011127a72812", "comment": "Malware payload (Dridex)", "value": "700c026cabb27b6ad76e5d15c75b1d45", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456889, "uuid": "dc19ffa2-e6c2-4aa3-ac5a-13fc987b6d77", "comment": "Malware payload (Dridex)", "value": "3e4d4a337d8f2747db59476461df54fd60478cf8c60a36f83f1d70aee73de6d0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456889, "uuid": "85617a03-d228-471f-9b69-d7d4a2983737", "comment": "Malware payload (Dridex)", "value": "16d91babba1241b4ff5a64fc7a2e23273a56c164", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456889, "uuid": "06fb6a9f-6aea-4ae0-b101-59430a9d87dd", "comment": "Malware payload (Dridex)", "value": "70b7946465f7f910f8c8eaaf44cbba4d13d5728a38aa6d83b4ea2b791b4ad5e77c9d91c814ea901597a6e321a460f5cd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456889, "uuid": "ca0397e5-94ca-4060-ba3b-a6452b53ad08", "value": "F6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456889, "uuid": "05f1fcd0-4c8d-4f44-a03f-13271f41eb21", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456889, "uuid": "44a4883b-d826-4bd7-8359-368161d11db1", "value": "3072:2lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:2lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618456889, "uuid": "221f060b-c905-486a-bd7a-718d0d9bf205", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618456889, "uuid": "bb3b9c92-7e76-4b76-b2df-673368ff7b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456889, "uuid": "fe41fa1c-48f7-493d-8913-749cabc6bd1c", "value": "3e4d4a337d8f2747db59476461df54fd60478cf8c60a36f83f1d70aee73de6d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f1364c-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618464581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464581, "uuid": "6dd31ce3-d114-4121-b239-b63ea7b411a2", "comment": "Malware payload (Formbook)", "value": "60ded2064de4ee38414112d323512921", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464581, "uuid": "bf8b1ac0-a34f-46f2-9977-de65a6f72056", "comment": "Malware payload (Formbook)", "value": "3e4ec290ff4d23c641462e517c60eddf9d80c336eda9ed581503cecea2b5cd70", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464581, "uuid": "98629ef2-7823-4634-9d5f-ca2129059c45", "comment": "Malware payload (Formbook)", "value": "b086822c667e2c6ad3329bb7db9bccc79d0d631e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464581, "uuid": "6a96ddf0-c4c7-45ec-a46f-bc3d4594421a", "comment": "Malware payload (Formbook)", "value": "b9156ee37858ed82571bbfe3cd810fe72df12aa2ba882caf8eccacec53cdbd516e057c502f0ba5354f12224fcf49537f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464581, "uuid": "ff49399c-0d13-4aaa-922f-5cccb3589dfa", "value": "362423DD91C1479123586FBC20EE6764EE9ACDCFBA1F0D146C3D08BA5145A3653ABB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464581, "uuid": "24eb63dc-79b6-4029-8ad1-25cf0afe6997", "value": "6144:UE2hIj9t5tGj0Q9Zs9Kp4rl9CZRqfbvolplrHZ:UE2hIjEH9ZT4bMr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464581, "uuid": "cedaff52-8369-4a8f-a95b-36f7001a34c3", "value": 218388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464581, "uuid": "2f79549a-4b82-4fc2-8b32-b710fbf4af8a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464581, "uuid": "d0e16d45-ec75-462f-bfbc-c912de97bdf0", "value": "PAYMENT CONFIRMATION.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35279116-9e13-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1618509089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509089, "uuid": "5b49efdd-f4ad-4a3b-82c0-e1d719dd5374", "comment": "Malware payload (NetWire)", "value": "b35d922e2b7bc16e00f41f1f3a8ce6b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509089, "uuid": "fa0f9385-87c9-4be4-b154-d244e7047b79", "comment": "Malware payload (NetWire)", "value": "3e6a71d8ee8d92d8421ea97db9c658b657c8c4428c4670c9c491a3a7125c5bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509089, "uuid": "d7d9895c-be5d-4e41-9a0b-472e3dd449ce", "comment": "Malware payload (NetWire)", "value": "9e53c66ef0e507e4deb0d6fced2775f653ab635f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509089, "uuid": "7aa48990-4dad-4fbd-a83c-ab346c005324", "comment": "Malware payload (NetWire)", "value": "1fecad6fac320f032b2d35ad834959b2869ba52d2e7fec55b33eb3e67ce1a2abcf672f3c122e7c67e1468e3e5bdd6be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509089, "uuid": "20b44cc1-bcc4-4960-aa3d-e95519f675f8", "value": "5D25E0919A8CF789E82C4F79C471497613771E67EA68E60FA84D30C52BB33C2F429257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509089, "uuid": "d65a65b9-e1d2-48a0-837f-970b948636b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509089, "uuid": "29d7208a-cb1b-4785-898f-7602f24a0ec3", "value": "24576:b28PLYqbczdHELxcf1HCvkVH9dx7D79mrqL39e:b/P8qbcz1Ec1OwddqQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618509089, "uuid": "bea12ed0-d921-4ead-aecc-51fa24238da5", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618509089, "uuid": "c3317687-c8d1-4997-a4cf-3b62aaae48a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509089, "uuid": "87d6abeb-6179-43e7-9021-fd290bd5b675", "value": "Tax Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1362ba93-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "a8c1fbe6-876f-4b65-958d-cbed687354ba", "comment": "Malware payload (Dridex)", "value": "1eacfcba782efe0bad1f47e096b72ed5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "6f2301ed-86a0-4798-98a2-608f77f9166e", "comment": "Malware payload (Dridex)", "value": "3e75b215dd0da4366a1b91aed0e5ed1559e4c08ae270e53b3c5eea177f7159f5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "4bef8c19-40d5-44de-897a-4f375da4c44b", "comment": "Malware payload (Dridex)", "value": "06b25dd499f53cad560b9209a59a2749e3f6693d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "64e902d1-838f-46a0-b24d-763aba625edf", "comment": "Malware payload (Dridex)", "value": "bb5300d6e762c38a008aee1a9d73678c3135ed72e9b9200af6bdfc2ba4a78d9d3da3556921ae0b26be35790d8bf6768e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "a81e549f-ba61-4d66-8651-1f424609d388", "value": "53F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F53725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "f8d65373-038d-4168-9f17-a69a8b81c39b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "87e44389-049a-496d-b8a9-83cb380feb43", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497007, "uuid": "f0a644fc-87d4-41ff-a016-d72dbd353f20", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497007, "uuid": "f58602b6-30df-4afe-a486-e2b0f868ad00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "a1783355-3d85-485a-b37f-ac2c4582d9c4", "value": "3e75b215dd0da4366a1b91aed0e5ed1559e4c08ae270e53b3c5eea177f7159f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691a8866-9dd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618482118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482118, "uuid": "5ef6ee0a-8d74-4794-813c-51c1fbbbb4f6", "comment": "Malware payload (Dridex)", "value": "77657f1be0e2f74f508f45d1e7de610b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482118, "uuid": "0f0a6098-df78-41a9-844c-a2093a55c9a8", "comment": "Malware payload (Dridex)", "value": "3e930dd19eb8d6423fe340bdcc80f66fee86b23f4ac650c4022f09b564d15f06", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482118, "uuid": "06817655-fa12-4071-9fe3-bd47c5b67281", "comment": "Malware payload (Dridex)", "value": "a34dd26aa4dfc3b22f0a79675e70df5bd6a5be27", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482118, "uuid": "efa3c648-d1bf-47a5-a48c-1b35ee795ad8", "comment": "Malware payload (Dridex)", "value": "854c62b2cba821efc9a4acc4dc70eb8f820e53ece9acbf798005b28342b9671cb1652a6e80dab7061d5f97213aad78a5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482118, "uuid": "a9407430-49aa-4256-ba4d-688b8a4f0ff2", "value": "CBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482118, "uuid": "6bc20f6c-9f23-4517-a7d4-a1839648209e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482118, "uuid": "982c836a-cc48-490c-9ef3-3f4a278ce9bd", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482118, "uuid": "7c8a855e-bb42-4c4d-abbe-72fb96173820", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482118, "uuid": "b3d79285-b523-45da-a27a-bf1152f345c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482118, "uuid": "6199122e-47dd-4481-a934-fd19b383417a", "value": "3e930dd19eb8d6423fe340bdcc80f66fee86b23f4ac650c4022f09b564d15f06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231157f1-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497463, "uuid": "fd163219-1a05-4e87-94b3-44ca89205049", "comment": "Malware payload (Dridex)", "value": "ffcc3295078aad7d3bebfb6a060759a6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497463, "uuid": "4e8c5297-9eab-475e-8ea6-5bbba1ada474", "comment": "Malware payload (Dridex)", "value": "3e9e0c6aebc0d9f3fd206c07d49935393817ebddf3ebf0162fffdd3ec46256b3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497463, "uuid": "8d900754-c8eb-480b-ad20-aaebe68b5fbb", "comment": "Malware payload (Dridex)", "value": "027f1be33030434bf8176f8bdab58c082f30ad6b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497463, "uuid": "efd750fb-644a-4d8d-843f-44fa900a0b74", "comment": "Malware payload (Dridex)", "value": "4ced19f856b9ec0e2c509f74099c3e38e4f263ef6fe91edf61f18505918206f6654b39d6c282ce749160681221607361", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497463, "uuid": "bcc45634-af64-4aab-ab0f-7989fc3f6fe9", "value": "95F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497463, "uuid": "21589d16-bd30-4206-bbfe-8bf80cd47687", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497463, "uuid": "e2daec3a-cc31-4338-b05d-4f0aa241155b", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497463, "uuid": "360d9df6-1e33-4aae-8598-ce6f5a3981a0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497463, "uuid": "74573b74-c113-4a01-9cd3-6e275d2465f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497463, "uuid": "5f95e2d1-07ed-468f-8920-b6e7225f1996", "value": "3e9e0c6aebc0d9f3fd206c07d49935393817ebddf3ebf0162fffdd3ec46256b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db0a2c9-9e29-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618518499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518499, "uuid": "f263e258-55e6-4eff-89a5-e510ed66a109", "comment": "Malware payload (Dridex)", "value": "9d93185cc61dd74c471f71c73c5ae5da", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518499, "uuid": "d073339d-001e-48b9-a0fe-e6d7f2a17a76", "comment": "Malware payload (Dridex)", "value": "3ecaae2ab9e0ae557bb3a2e7df3b58cb424791a390bb447e2b2c6b1239ee5724", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518499, "uuid": "bd7e356b-dc2c-4e50-a68a-5781da9659b9", "comment": "Malware payload (Dridex)", "value": "32926baf35242ad6dd638758e380d3578053e7e7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518499, "uuid": "c9dc8c89-7b9c-482b-ab53-74d60c494093", "comment": "Malware payload (Dridex)", "value": "d8a020939745401da69f39dbb9ec76b0aa00f401d1ab55f80cb2a3cc903e60b531403476d29a2f4b44319fe982e9e73a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518499, "uuid": "e072b045-1bab-453b-8323-82f1859a0ad5", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518499, "uuid": "2d91749d-273f-476c-8688-580e68a9cb5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518499, "uuid": "1f5f768a-001a-4c15-8231-afdaac565d07", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618518499, "uuid": "180bd1c1-543a-437c-be19-df4f423118f9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618518499, "uuid": "e344218c-ec16-4c07-8603-fb1b80d761d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518499, "uuid": "81f2672b-bfb9-4708-8726-6e71d1eb7adf", "value": "3ecaae2ab9e0ae557bb3a2e7df3b58cb424791a390bb447e2b2c6b1239ee5724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8725ff15-9dc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618474867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474867, "uuid": "ac8b5946-c6cc-4f38-a799-dfc36d1fc2df", "comment": "Malware payload (Dridex)", "value": "8b8855ffa52f46e5e27d0ca0477751aa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474867, "uuid": "db387c6b-7e2e-4dd2-87c1-09d897ccef07", "comment": "Malware payload (Dridex)", "value": "3f33d143896bd3d9ad567f19bb95bba21bb847ee93c8dfecbf30d73d93eb4605", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474867, "uuid": "bb38f9f5-97d3-49c0-9d0f-c18a96f1ccb0", "comment": "Malware payload (Dridex)", "value": "97c8e3d262643f2f5cbaae1da1d573bde314497d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474867, "uuid": "bb897f88-0ec8-4c7e-8141-13e4dac4b25c", "comment": "Malware payload (Dridex)", "value": "0f65963b006e3625a670516c49c9e3c2cbf67c41d58bcc7ccbd69aefc7b1cd0ad34dc517625759e86bb2b7c69101c518", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474867, "uuid": "da156087-bc29-4a79-9f9a-7a451c980065", "value": "1EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474867, "uuid": "1d121eee-f4d4-4a08-8b9d-982e42f3d38f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474867, "uuid": "e15df70d-0add-45c5-b9aa-64a5d8d2d871", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474867, "uuid": "c6d4baf7-e4bc-4b76-94a9-50773aaed114", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474867, "uuid": "6f1d56c0-eb2b-4f91-ac09-7e1e83ba10d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474867, "uuid": "c5419a49-403f-4558-8aa7-88e632133dd8", "value": "3f33d143896bd3d9ad567f19bb95bba21bb847ee93c8dfecbf30d73d93eb4605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6535bf-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "889cca1c-3620-459e-8df1-1dd8e7f07bfc", "comment": "Malware payload (Dridex)", "value": "16c777605ff76a75d728fa691892add3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "bc7a15ba-bca6-40ce-ac3a-a2509d37e95a", "comment": "Malware payload (Dridex)", "value": "3f63031c2e5bda74154742d1111690bad1195df21eb3a042a4c6dbd7ad34eef9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "fecc82e9-be94-41a5-b2aa-6b3e5546e0e8", "comment": "Malware payload (Dridex)", "value": "0d0784d7d650b8131b86a9a74b3427ef63c9b639", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "a70b8730-1598-4724-9f0d-870ff3a24ee4", "comment": "Malware payload (Dridex)", "value": "4239093af77be8a3a622079f8c4859519966bcfff32692a355efee0664b1090cff7511353a001c26bd5713e3810e0192", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "09ad2be4-3635-4368-a9b4-d3bbd2495430", "value": "E0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "b2edca27-7a2d-41e2-aefd-d597c2b12068", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "edc39211-4664-422f-8cf2-31bfe23b436f", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497185, "uuid": "3bd736fd-1bce-4fa3-a790-aee1aeeb3eb7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497185, "uuid": "183b7a99-ae77-4178-863d-34df647bd248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "8a5ef745-9c57-4172-a794-9ee1ff20364f", "value": "3f63031c2e5bda74154742d1111690bad1195df21eb3a042a4c6dbd7ad34eef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b8fa56-9d8a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618450548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450548, "uuid": "b7bf609a-2877-4404-acc6-fbf168d567b5", "comment": "Malware payload (Dridex)", "value": "796f81c5acf3e3f6bbf4f0894030e116", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450548, "uuid": "87cdfa4a-5808-4eca-9add-eaea9ced249d", "comment": "Malware payload (Dridex)", "value": "3f8984f9dd17704b1847862bfdd4c4552ad68f003d71172870df9cbb497912e4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450548, "uuid": "9dc154dc-a979-43dc-b711-fcef30a742af", "comment": "Malware payload (Dridex)", "value": "9393cfd4dbea2970c8b9aa8200a44a9183cfb815", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450548, "uuid": "e9eca674-150c-401e-9a8d-83441bb607ee", "comment": "Malware payload (Dridex)", "value": "1178efd381b83028823c8adf8e9471e2f82f7aa64f5e67423b78a2a5fca69e8d186f8e72d175fc23c5123a88eeef718c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450548, "uuid": "e19dfcfc-c9b6-4db6-8bb8-c205020615c0", "value": "6AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450548, "uuid": "687175a9-7047-460e-ada6-19574d8789c1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450548, "uuid": "82cf150f-0a97-4d51-afb3-b3f006c9b61b", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618450548, "uuid": "dd40b176-4263-43d4-bb7c-92dbe2255c0f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618450548, "uuid": "0296b6f3-f961-439e-859c-847e8ad29293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450548, "uuid": "af0ba30e-e86d-4399-a190-b6e8bff513cf", "value": "3f8984f9dd17704b1847862bfdd4c4552ad68f003d71172870df9cbb497912e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810a9d48-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497191, "uuid": "2cbd3efa-5a47-4434-b01d-06a0392f84e2", "comment": "Malware payload (Dridex)", "value": "69aa36ef74a5115f7fdd74987746a321", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497191, "uuid": "77ed49a3-ad98-4c42-9763-94f3f4690f20", "comment": "Malware payload (Dridex)", "value": "3f8adf100d677e49e2dfa7549af6a401450819dbe958e75568a6dc306d9cdb57", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497191, "uuid": "2663c39d-9a22-42d7-812e-301214b416d5", "comment": "Malware payload (Dridex)", "value": "35048c488412b8198e8ba0a3fa85ce25c887eaa4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497191, "uuid": "c8d4b5e6-fac3-42f3-9b5e-c5c958548d19", "comment": "Malware payload (Dridex)", "value": "1fd8810d0da1a48d664ecd68c9b6fbb6505fe4955dfeccf18ac0abce1f285c2fd101cc77427dc4bc289f2ab41f57bdaf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497191, "uuid": "211b5aab-e2a1-400b-b919-0c4e405e9166", "value": "5BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497191, "uuid": "a2d7f1b8-82a2-4373-960a-6399cadbc246", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497191, "uuid": "40eae921-1606-4724-9bf5-f5251b172720", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497191, "uuid": "65bbdb8d-f06e-4137-a59d-b25315f9e400", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497191, "uuid": "b30b521d-d75b-4cc2-851b-a3cadeba8524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497191, "uuid": "553354b3-f58f-455e-8c1b-54f339eaf71d", "value": "3f8adf100d677e49e2dfa7549af6a401450819dbe958e75568a6dc306d9cdb57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f314c08-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497617, "uuid": "24985063-7a94-445c-bccd-9e7fa8be4081", "comment": "Malware payload (Dridex)", "value": "26e62b9df57bf38da921bba319be7ae6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497617, "uuid": "614c501e-062c-41c9-9813-8885c07c4b99", "comment": "Malware payload (Dridex)", "value": "3f8c902ce3112d431e6784d547638bcd0b215ed3e01a1754b04ffc6b00a750c2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497617, "uuid": "362d0a6f-18e3-450f-b794-2cc28be124a1", "comment": "Malware payload (Dridex)", "value": "514d24d3b9d10874fa617fe371cb8adcb524667d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497617, "uuid": "e080dbba-9f28-4ef2-88c2-c655fd7f3967", "comment": "Malware payload (Dridex)", "value": "1dbce75ca31deff307f262d2a438c72648ec7badae84aa693df86eb438c1eba7a9978f0ba6d55503b25727e77e859340", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497617, "uuid": "6068df42-d32c-4ec5-a58d-b5edca27180f", "value": "43F3E00AED9FEA88E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497617, "uuid": "23adba3b-4452-4505-b993-d18d064e744d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497617, "uuid": "105cd986-d8af-4bb2-af7a-df9c3fdc2ed0", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497617, "uuid": "0f326828-ceb0-4cb5-be7d-304fc02b2398", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497617, "uuid": "7b078ad4-e5b7-4e8e-a3af-810df5ebf442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497617, "uuid": "ed619e73-af49-4772-bcb2-d7dd69c97283", "value": "3f8c902ce3112d431e6784d547638bcd0b215ed3e01a1754b04ffc6b00a750c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e0f3e4-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618514934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514934, "uuid": "b455fdb5-d526-47b9-81c4-46f0a0e9c595", "comment": "Malware payload (Dridex)", "value": "1a28c61043e27292419629f14a91062c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514934, "uuid": "b641a49e-8329-49cc-a0f6-6a875d878da9", "comment": "Malware payload (Dridex)", "value": "3fc0ecfa06aefee188110a8c41879e260ad1398caf20fb35cb30e57d86524c48", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514934, "uuid": "9dcf285b-7e96-4e9e-9365-2e3875e5451a", "comment": "Malware payload (Dridex)", "value": "3fc851ebacbde0fbd8ca87cfac83792fcd0199b5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514934, "uuid": "6cfd2145-3250-462f-8667-4b359d2d2633", "comment": "Malware payload (Dridex)", "value": "86c4692a3f8da6356f1edd9f8d424893cc0118de3bd7445176fc42274828143d419aab22270321019ef35fa32e3c36d6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514934, "uuid": "f6110b64-fdfe-40d3-b41a-ac336c8f9c3f", "value": "D5F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514934, "uuid": "1826dadd-f45d-4223-b440-0c1076b8ea1f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514934, "uuid": "1d63ff83-bc09-4398-bee9-6837179328be", "value": "3072:oA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:o3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514934, "uuid": "1f125085-1585-4782-8a83-e8b66c43bb37", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514934, "uuid": "76843471-03f0-4bf2-a9cf-f6bf60d9d0be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514934, "uuid": "16597738-f987-45e6-9eb1-1c556559b88b", "value": "3fc0ecfa06aefee188110a8c41879e260ad1398caf20fb35cb30e57d86524c48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055759f8-9daf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618466059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466059, "uuid": "836913c7-74cd-464f-89a5-3c794a7416bc", "comment": "Malware payload (Dridex)", "value": "7f486a2ac548520ac10442c6c57d7fbe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466059, "uuid": "41a2f9a0-ccb2-45e1-8e9d-5cfa9b62ae15", "comment": "Malware payload (Dridex)", "value": "3fff99b8fa548b72ec846af763ef44520b3da3ee5887843539a33126f90a1164", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466059, "uuid": "ff2ecd54-c6e0-4537-b007-8c2151a4d040", "comment": "Malware payload (Dridex)", "value": "815a993d7dca470c17ae28a14555b29153475f8d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466059, "uuid": "d0db8d3b-ed71-4740-8418-286aca90737c", "comment": "Malware payload (Dridex)", "value": "2a53e3305bdbd01d73e54e77b85aafd9d6c7e390b6eb0e3f30dceed264232360b8c82aa86fab6f542eac2767062b585a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466059, "uuid": "83c80247-0d5a-4aea-ba3a-8be3679e1a49", "value": "8A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466059, "uuid": "dccb7f60-1383-4bc6-8427-ce5a00098f8e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466059, "uuid": "9e52692b-2f97-4528-9900-f552da7e7723", "value": "3072:z0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ypepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466059, "uuid": "f62cb061-7e84-4f25-92e6-fd8a809e63bf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466059, "uuid": "a4ca6cd3-fb67-4391-999f-0361012208d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466059, "uuid": "a23dfcbc-beaa-4dd0-9bb1-1f52171f4647", "value": "3fff99b8fa548b72ec846af763ef44520b3da3ee5887843539a33126f90a1164", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360427f3-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "96f2a5b2-544d-4568-81a4-3b3be6a9bc7f", "comment": "Malware payload (Dridex)", "value": "389d391dd25f36dc880c03b13d614d63", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "bf7c6179-fae8-4666-8b47-e32628c9dc05", "comment": "Malware payload (Dridex)", "value": "4024b259b05e9c52e62f5f959ff3dd9c7f45adb045bf2131edab105cc03dfb31", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "b5b5c54e-4289-4709-a85c-c0e88ccb6399", "comment": "Malware payload (Dridex)", "value": "041c5405bb52fd864876eea8a2dc1b39294c562c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "d48e3f08-f9f1-4225-9a18-980ac2ce7060", "comment": "Malware payload (Dridex)", "value": "f51d4814e72ee85d0a36e3ff2686f7794a208e243672409cd6893f722721062fd00e529342baad5e532be05c6efa8aaf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "121688c4-2a8a-4194-ba30-9e29b959600e", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "52555135-b646-4825-a597-e75bb5deac7d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "d5756169-7c59-4dd6-8df4-401e31ee6dc7", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497494, "uuid": "edd01b1a-5594-485e-bfea-d370cb2a9e4f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497494, "uuid": "4d0913cc-7746-4fb9-bf0a-4a11858a6a4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "533858a3-5e6d-4e0c-84f0-4b6d058eef30", "value": "4024b259b05e9c52e62f5f959ff3dd9c7f45adb045bf2131edab105cc03dfb31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72eb80df-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496308, "uuid": "8729801a-7909-45dd-91f5-f1f388e33955", "comment": "Malware payload (Dridex)", "value": "7aa82053e2aec911b59755b4dd08ef7b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496308, "uuid": "e0044f1f-443d-4dcd-88bd-257a95dd59fb", "comment": "Malware payload (Dridex)", "value": "4043470eb47710b19a847bc76b2f79c09f89ebd0a8a2679acb69a6cd98ebf41f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496308, "uuid": "a45aecb3-f3e8-4f79-99ff-1cbc0b98ca95", "comment": "Malware payload (Dridex)", "value": "f8987b118d40932385ca53e8cac571742ad99baf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496308, "uuid": "3ad34743-5d2c-49a5-8647-2563e8746b2e", "comment": "Malware payload (Dridex)", "value": "ccd1cbd4f2f174ac45bf2d8d370990183dbd1fb9993d81aeb34a8d2cb77758db23851a761e50fe5e10155271feb99387", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496308, "uuid": "ae296ea5-9a18-43e2-b8cf-cfad2f899681", "value": "D6F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496308, "uuid": "a76333db-8882-4437-8821-31da53783974", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496308, "uuid": "ab8f52e9-a575-46e7-bce3-5e463e543358", "value": "3072:+A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:+3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496308, "uuid": "007c5d9f-43b6-46d0-90ed-be4ea9bb17d9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496308, "uuid": "4fab8398-fcb8-4fcf-903f-e8ba9bcb0321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496308, "uuid": "a1674035-1385-46bf-be0c-55d70255b2be", "value": "4043470eb47710b19a847bc76b2f79c09f89ebd0a8a2679acb69a6cd98ebf41f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c46059-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464369, "uuid": "e0d926a6-dbd4-47fe-862d-04dfe29f1d81", "comment": "Malware payload (Dridex)", "value": "efb543484e63960bf2388f60c12bc749", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464369, "uuid": "6aa48e45-369e-43b0-b6d5-724e9177294c", "comment": "Malware payload (Dridex)", "value": "4048aaeda30c9a82813da7ce51cb0c4e7ae30950f02d0ce54b71e840d07567cd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464369, "uuid": "94908005-3dfc-4851-a24b-d4318764fce2", "comment": "Malware payload (Dridex)", "value": "a132139b62c571f4b78bfb0eb9aa6434fbe7a085", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464369, "uuid": "824261c6-d4f6-4dea-8ca5-a8616e86fd84", "comment": "Malware payload (Dridex)", "value": "42b3a99d60fcec38b7e94b27f0f5cf9c848c93a6a4bfe4b85a7521ebd2269d6aaf5ea37b092125274f4b798c80d979ad", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464369, "uuid": "47f90dec-5092-4757-802a-6820d1fbc282", "value": "27F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464369, "uuid": "af109059-d1dc-4ee9-8f28-6bd0b89ee9ac", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464369, "uuid": "6aa33da8-a0cb-413d-9daf-d0f6f6ce0da8", "value": "3072:kA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:k3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464369, "uuid": "18a5f3fb-cfa4-4a27-96e3-8e61633c0ddd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464369, "uuid": "c3eed224-c754-4e02-9498-0f4cd07f2292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464369, "uuid": "79fca31a-a1ba-4025-b6db-d383eae6a127", "value": "4048aaeda30c9a82813da7ce51cb0c4e7ae30950f02d0ce54b71e840d07567cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe8e213-9e2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618519731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519731, "uuid": "68574e79-0f6f-4d8d-870d-0ced526d37aa", "comment": "Malware payload (Dridex)", "value": "9ac78e09bef737d3cb21d151e68a9c71", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519731, "uuid": "b8595c89-1e46-4750-804d-c97b45ff90d3", "comment": "Malware payload (Dridex)", "value": "40668721c4ce60515ee3bfe857d3054db12297a06c973bafebb46fe4f906fc1c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519731, "uuid": "07ffb356-febb-4135-add7-7aed0cc18a92", "comment": "Malware payload (Dridex)", "value": "325c74387f5327d4b7a3297c308352761487d11f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519731, "uuid": "0e217cc7-4122-4895-8770-8a5c89771591", "comment": "Malware payload (Dridex)", "value": "4af55b04e5f780fa6798dec015381a1d664b043f5448234c9ab6a3ad727f0ff6091ccb41025236698e403ed752736a8b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519731, "uuid": "64c8a9cb-bc38-41c6-933c-430907f52d31", "value": "4BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519731, "uuid": "d758532e-6393-422b-9ade-e095c2ee4d6c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519731, "uuid": "ab7ecf10-65e7-4b17-be65-dc6856d39cb0", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618519731, "uuid": "42c215f4-e3b4-42bf-982f-8954f1881932", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618519731, "uuid": "2232ecf7-13a8-44da-94b5-57258c9bf47e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519731, "uuid": "4d24c3ae-40e4-4dc4-a279-d778eea7fe8c", "value": "40668721c4ce60515ee3bfe857d3054db12297a06c973bafebb46fe4f906fc1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b96414-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618498855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498855, "uuid": "acc3f6a9-37a5-4296-801f-4fcd30c0ca74", "comment": "Malware payload (Quakbot)", "value": "7ae4578c1c84194a31ec37bcd8b59925", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498855, "uuid": "49fc9820-a9ed-4577-871f-a1a9e13e1a99", "comment": "Malware payload (Quakbot)", "value": "4079d54f5c4100ef3682a39477a9213c6a47df60263adc8b6e40cf76a22981bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498855, "uuid": "1504eb1e-5db9-4827-a90b-aca96f4a3f4f", "comment": "Malware payload (Quakbot)", "value": "a0a3777830e2056bc5eb5d87c0e1001bf6850229", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498855, "uuid": "ae97ac69-8bfc-4506-9f64-05c0a10ebb37", "comment": "Malware payload (Quakbot)", "value": "7070e59227d7a7c79c42128a938e7b70aea498c879ca9b1c6c8c326df7ce03876ea76a9c728b3e8d451312daf17a3066", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498855, "uuid": "87dea9ed-cc1e-44c5-b57e-ef56bf801712", "value": "28055A36F193C437D4333A7CDE6B91A8A8267E121D38A45A7BE40E0C5F3D681392D6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498855, "uuid": "d4a775be-7ae1-482e-8fd9-34879ee44a3c", "value": "12288:NJFPIxFwurnmBHqSppmWsApnZc0Bj0kxhgjR3xhGwQ9UzMZuJqWUe1qAT2BhHTE:NvUmuTOq0mWsw5m04Rej8AuJ31g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498855, "uuid": "d2b9b298-4d3b-4caa-86f4-28bedc5cb3cf", "value": 861371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498855, "uuid": "4a9b588d-b577-42b8-9e63-8fb4cb6a4987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498855, "uuid": "8b86c29f-9d37-4706-826c-c9fcc6d2c11a", "value": "7ae4578c1c84194a31ec37bcd8b59925.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3332a783-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "e0fe1f1d-db26-4439-810b-1cc4e9ef20f3", "comment": "Malware payload (Dridex)", "value": "8da6412d1fd4f3d9887655418cf4bcde", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "8c9d5352-0353-47fb-80a0-3ec081b793f6", "comment": "Malware payload (Dridex)", "value": "40abb21294e0da2b74704091ecd312052a749a037f51f6af311fd28d35f0dc45", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "ff434362-1928-43ed-9ace-2dfa41c622f3", "comment": "Malware payload (Dridex)", "value": "139f678bf029a296045b81f069c1b18e8cae3ca9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "bf363ec6-7d31-4bec-b304-08314b0b1fc6", "comment": "Malware payload (Dridex)", "value": "279d264e653c372667785f12d92111058e3dbba7b63dc5ab3a2bf88b50b2fa632b60ce46a168339b40eb3d6155fa5803", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "e82da93c-3ca5-46c8-b6d8-ea29349074c3", "value": "F0F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "807a00d9-5059-4664-962c-c7048ce543ca", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "07b25f1e-20b3-43ae-b970-582a0d2b009c", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497060, "uuid": "323f062a-86b9-43d9-921e-c36babe0c961", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497060, "uuid": "8440f37f-64fb-42d9-a76a-dba1b30a48c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "5db185f9-a912-4d2c-a9fb-2304766451aa", "value": "40abb21294e0da2b74704091ecd312052a749a037f51f6af311fd28d35f0dc45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c89920c-9da6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618462313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462313, "uuid": "52476829-d0fa-4626-bd5e-a3293625f89b", "comment": "Malware payload (Dridex)", "value": "2c4a8f0080ebff1ea766a7a728c0c585", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462313, "uuid": "d1d44c36-fd05-4c77-a497-796317913b63", "comment": "Malware payload (Dridex)", "value": "40e7329a3adb64cf8361659a43de5728374249d4a8a148d830922b20b3572bca", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462313, "uuid": "a43f5f46-8da4-4db7-82c5-0a104ca2f49d", "comment": "Malware payload (Dridex)", "value": "aca61820b8ba1e2aefb5cd3547291627cbf45ecd", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462313, "uuid": "04a037b6-58f1-4746-895d-d7f87d9e91c3", "comment": "Malware payload (Dridex)", "value": "fc1c130bb39eee858f1eee45f642b7ba354e38d9dafb99d6c74ed73b101b00b9aff8f3d2d70f7afdd3162d3f261c0b84", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462313, "uuid": "361ce231-fc02-4477-80bb-9faf067954d6", "value": "8BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462313, "uuid": "cfa7caa4-5206-4e53-8c95-eb65225e11c0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462313, "uuid": "5943d1d8-d253-44ba-bd01-b353032c40fa", "value": "3072:6lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:6lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618462313, "uuid": "a188df5a-1465-45b1-9f04-940b279daf2f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618462313, "uuid": "2bcddd20-a570-4759-9d31-13c126a5de1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462313, "uuid": "f6f2b262-b8ed-4bf7-b50a-2e359531c700", "value": "40e7329a3adb64cf8361659a43de5728374249d4a8a148d830922b20b3572bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705bbc6b-9e3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618527228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527228, "uuid": "c48362a0-df37-4ac1-96a7-2429097de580", "comment": "Malware payload (Dridex)", "value": "8c6229dd71c3c7db95c0f7d6acda2b41", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527228, "uuid": "9a3368a6-ae26-4781-964d-ae35ed745182", "comment": "Malware payload (Dridex)", "value": "410ebe403dc7502d48bd41caebff3f4820fee90519dd77d5626626afb3ab1168", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527228, "uuid": "6a225060-6324-41ab-a0e5-7a023fd78570", "comment": "Malware payload (Dridex)", "value": "07c026678b0609598ff30da9e2e54bd613ef5b1f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527228, "uuid": "1a30bbc7-d955-4f81-8053-9ef44763e831", "comment": "Malware payload (Dridex)", "value": "859d1212539493c23a23fc0d88028a2b4ae0190026c446f96b526da9e85b7e9757016855461e1e7d47dbf9cf2cbcb0c2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527228, "uuid": "8d5768c3-462d-4048-8926-6196cb004d9a", "value": "40F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527228, "uuid": "db4a36fb-055f-42f5-9f6c-d881c0ae63d0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527228, "uuid": "01201708-d90e-4e8f-a05e-52a208e52ea4", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618527228, "uuid": "0942917c-e353-4e13-a691-5494ab9526b8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618527228, "uuid": "0288c522-973f-4d2b-b5af-6bb5ecd5db0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527228, "uuid": "b2878b45-bd7e-49ee-91ab-cc89bb974d53", "value": "410ebe403dc7502d48bd41caebff3f4820fee90519dd77d5626626afb3ab1168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc141429-9db0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618466849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466849, "uuid": "f0e483fd-1299-4ea6-b439-a9e08f9454d6", "comment": "Malware payload (AgentTesla)", "value": "8cc88b2fc2bc81082b5fb191ce776623", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466849, "uuid": "d1f0cfdb-7eb5-46b8-b55f-c3b3c7c447af", "comment": "Malware payload (AgentTesla)", "value": "410f33042e18da4bbcc65d94bd6c7cbe7da6643917f89ce38aa08130b8a20f26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466849, "uuid": "b897a5c9-a817-4e06-8a16-fe0a4d885fa2", "comment": "Malware payload (AgentTesla)", "value": "87a6b9b886db475553372838d4da567ef995e206", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466849, "uuid": "7e837c57-c907-4816-a4f3-62910f336b97", "comment": "Malware payload (AgentTesla)", "value": "c868cce516443a8780035fb82968389f853d3a6e5c52c730a89e056c6a12d2c1eda7f70e131b912a0bf7623cc98fddb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466849, "uuid": "f3bcb1ef-6e17-4e20-922e-2dfd686e1bce", "value": "F835D32322BCDAD4F03E7EB45061170496F1AC429636D28BED9F3CD9D973A83C6256D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466849, "uuid": "030972e8-9f21-4e7e-83b2-90f87028d3ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466849, "uuid": "2ffa7ff6-ef38-48f0-ab61-fa78cef37637", "value": "12288:MbBTWttwz4TbW3GP3zykaOa5hFTNNOwDTNCP+TR37lFDeTBnGMeTyKHq6w:M1yFTb2nkc5dNPgWTLFVMAHq6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466849, "uuid": "5f8d7349-faf9-4825-83b8-d313ebf5c3f3", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466849, "uuid": "226dd520-c537-44fa-8c87-53ae15ca2a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466849, "uuid": "88140f94-22d5-4fce-94f2-ea4861b612b7", "value": "DHL Delivery Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61dc80e-9e2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520473, "uuid": "f99f6fcd-940a-4cd0-b54c-b5d339cf4e06", "comment": "Malware payload (Dridex)", "value": "8285392d10f79c4c637c2c2957e98708", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520473, "uuid": "bc0bc256-9c4f-416f-ac0c-9479ce9cd3d8", "comment": "Malware payload (Dridex)", "value": "420f62ed6f6124824eac08ef424a19dfc147e26c919b745c7ae82a06da643fa5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520473, "uuid": "487dc6a0-1950-4be3-b8ca-ba17fffa6bb5", "comment": "Malware payload (Dridex)", "value": "8ce82ad44e17ade490aa632dc11cd3619da4d2bf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520473, "uuid": "cd79ac7d-2967-462f-a670-a7f80c17c8c0", "comment": "Malware payload (Dridex)", "value": "b64da26cd94a488e3f3e2bfd219e098f16d45e4a9104f0efe9b6004216ad871d4d5a05ee289c4be7b8fffcdce4a12c83", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520473, "uuid": "de528054-c1eb-4c1f-8357-5531562ec197", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520473, "uuid": "b2864f4e-4a5e-4e2f-80a9-1c506b124594", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520473, "uuid": "2a5c8696-ce22-42b1-99ec-5e88e0c51b0c", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520473, "uuid": "498a8e1e-9646-4769-95f8-9abfdf7c816e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520473, "uuid": "60af7793-da7c-4648-958c-33fd75be44a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520473, "uuid": "cd3446fb-8eac-4121-9973-fa519690c2f4", "value": "420f62ed6f6124824eac08ef424a19dfc147e26c919b745c7ae82a06da643fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864468e0-9dc6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618476154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476154, "uuid": "4cb24248-63e9-472c-a91e-102e86f6bede", "comment": "Malware payload (Dridex)", "value": "e8dfb5ed3465c6b5126464c1e7669dfe", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476154, "uuid": "e6899be2-01a1-4c56-9741-628dbe1db76f", "comment": "Malware payload (Dridex)", "value": "422aa4f271d34b791c1a657aba1b99aa59f3607322a383efd31137c43fd9bcc5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476154, "uuid": "d701f6dd-d69a-49de-9d3d-e142697f8eca", "comment": "Malware payload (Dridex)", "value": "863a47b3fb3cca87842d7bef7e46ed7269bc1669", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476154, "uuid": "878f8e6d-ad28-4030-a194-11a2727ae096", "comment": "Malware payload (Dridex)", "value": "1fc7c2a8e5ff0b69689e9303378ae2f46335cf30dffc3f87895e2f426986dfcd458953040f968b42edc1c56dda34f645", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476154, "uuid": "06a30216-ed5f-47b6-9ce0-94651b23f45f", "value": "ECF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476154, "uuid": "cff27e3f-e515-4f11-bd21-ac53985ace06", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476154, "uuid": "61ca403c-0cc6-45c6-afff-95b77cda4915", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476154, "uuid": "436e4123-f402-47fd-a688-ea36cbecf2b8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476154, "uuid": "aaddc0c9-e58f-4284-9d91-c4532acb1090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476154, "uuid": "5346bc9c-15f5-4264-adf6-48a9decc8d85", "value": "422aa4f271d34b791c1a657aba1b99aa59f3607322a383efd31137c43fd9bcc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b8e4b7-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495908, "uuid": "98fb2f1e-48de-4a46-9525-1f06bc3a4555", "comment": "Malware payload (Dridex)", "value": "8a82e922efa86030a1ff3958be961e00", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495908, "uuid": "cae052bd-b41d-4908-8b8e-4c0ea0882a3d", "comment": "Malware payload (Dridex)", "value": "422e0a904c1451f06c829f1e11c900b257c0cd4727106d5d328c036fd896a8e1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495908, "uuid": "3f579777-b9fe-4841-a790-67933d7b1854", "comment": "Malware payload (Dridex)", "value": "6b90a6d1ab650b37bded6d57e0f8cc19328ce5a8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495908, "uuid": "a1a4c8c3-5cc5-4f13-984e-2af9abbda53f", "comment": "Malware payload (Dridex)", "value": "db7ecff1ebfc92b97452db2930fcf29e3b7c71d551a4af91b464b354b871641c0345d0b723a852bf3fbfe54c42572311", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495908, "uuid": "e2e1757b-fb21-4e81-83a6-d22236a93268", "value": "18F3E00AED9FE988E84C55F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495908, "uuid": "edb9d959-30b2-4dd8-866b-7de8d941ea60", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495908, "uuid": "67444f35-b0f5-425f-be98-59c018bcb882", "value": "3072:+iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:1eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495908, "uuid": "b80c14e6-4648-4001-83ad-13d3174d5cb5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495908, "uuid": "76d0bc2f-95f3-4570-ac2b-6e710595b2ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495908, "uuid": "9cf85770-abec-4490-b817-d76235242a12", "value": "422e0a904c1451f06c829f1e11c900b257c0cd4727106d5d328c036fd896a8e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5240cf90-9d84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618447720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447720, "uuid": "553f6f0e-683d-4af5-a413-c81fc8e83ede", "comment": "Malware payload (Dridex)", "value": "8897efe2d6a095445050576e3232f8fd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447720, "uuid": "b60b9499-6066-4e2a-8ec4-8248f1ebe87c", "comment": "Malware payload (Dridex)", "value": "4248ee935bb312fac85351f76b47e939423d68fe786e79f11ac52404f2ef78d4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447720, "uuid": "6f562ff8-ba9d-4bb8-8834-f94a25b3aef8", "comment": "Malware payload (Dridex)", "value": "af2029ff353ce04be3911b0a4de07cd06310da59", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618447720, "uuid": "fe17f88b-7f78-45c0-a93e-ad6e4077385d", "comment": "Malware payload (Dridex)", "value": "a510307301ab393e6ad3cfc42a19013e6c6ed81c38ddb35cd2d8784a1cfc39c0a7970d07d85663d25996e64f0c43ad3e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447720, "uuid": "ad6ef249-e452-463a-8dee-d1a05bd58a24", "value": "FCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447720, "uuid": "932ae40b-3fab-4f3d-a9bb-22b1a764f15d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447720, "uuid": "f6826855-8d4d-43f0-888b-903a1a358367", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618447720, "uuid": "94ee4e70-7156-4d3e-8e9d-314cff71d5bd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618447720, "uuid": "ea004a82-3a08-46f3-aefe-4148f90100e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618447720, "uuid": "6cf588a1-cba1-452b-b550-f044ab46fa70", "value": "4248ee935bb312fac85351f76b47e939423d68fe786e79f11ac52404f2ef78d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390488e-9dc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618476901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476901, "uuid": "b1bd8405-2792-49d0-918c-680593fc03bf", "comment": "Malware payload (RemcosRAT)", "value": "d6dc3afd4a99d269489b77bd4160a886", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476901, "uuid": "085a1987-0010-4e7f-ac22-ef737576cd3f", "comment": "Malware payload (RemcosRAT)", "value": "426d3af918c60fbc12206aa3bc31f47c30f16b69cb7ff8f8de1d381270e12a36", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476901, "uuid": "1845ef47-1cb9-4f31-b4f1-7fa39f740483", "comment": "Malware payload (RemcosRAT)", "value": "4f01a610219cf9a409b7393742aca1da34593bb7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476901, "uuid": "a6e965e7-01bd-495b-b681-7f9f7aca0b89", "comment": "Malware payload (RemcosRAT)", "value": "219cfd30274b80f442daf28d7564b0b54d33a24cc2aa02d0dda815731b70997785593ab535870843c1aaa2faf0150027", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476901, "uuid": "184e6a13-956a-4d1f-88c5-704ea014bd25", "value": "D325338DA510409F834907123E4EAD939F51A633D9603CA01EF1677B99BCABCA9C7C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476901, "uuid": "5b41107e-a660-42c3-81eb-95942d5c5873", "value": "24576:hHp3DAVQAgBtm3napuMxc3JXIlM4qswIHSsZ3QoYNNV:hJ3qQLoXLvlVsRlY7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476901, "uuid": "76b3aadf-51c6-4125-b84b-d720a85a3578", "value": 964275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476901, "uuid": "eb330597-0e07-422e-9630-1b84d8e64ebf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476901, "uuid": "a3b57fb7-fa7a-4de3-a0f7-f4f55a9be7d4", "value": "NEW PO (PO#HD512-6 5700)12.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def1bd08-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496060, "uuid": "4281c3cd-3fb3-40b2-b330-d47201b40071", "comment": "Malware payload (Dridex)", "value": "573eecc6724bece9b35e81d15cab59cd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496060, "uuid": "938f269a-d4df-465e-8d71-118011a0643d", "comment": "Malware payload (Dridex)", "value": "435ebdef900b36617640d5f10fe061c11cab746de75e43426b329d4151e71415", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496060, "uuid": "050cdb3c-659a-4a0d-ab7e-a882ca34393f", "comment": "Malware payload (Dridex)", "value": "90980be433564e458d998ddb793ab45b0a24ac45", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496060, "uuid": "303683a7-115e-4275-ad79-ffdbabf50cd6", "comment": "Malware payload (Dridex)", "value": "7a4173f3d388f9283cb99dddd10824590e111749181bc068217d2f97d51c4209bd730b947b70b4bedc137ae6a71e499b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496060, "uuid": "920275dc-5d3f-4e71-8c03-da04b9731e26", "value": "B3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496060, "uuid": "c3c11403-09df-430b-8c06-fe95e32d90fb", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496060, "uuid": "e923da13-dcce-4056-93d2-e1d19efd2b4e", "value": "3072:UiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:XeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496060, "uuid": "e06f2460-5846-4015-b128-a43b9bdac9ff", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496060, "uuid": "5a9aebcf-4382-4560-a0c8-9260c01d2f13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496060, "uuid": "ec388267-871a-4fc6-a6f8-343dbe651627", "value": "435ebdef900b36617640d5f10fe061c11cab746de75e43426b329d4151e71415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4689f0a-9e12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618508900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508900, "uuid": "2890415e-111c-4a4a-b1ec-e4778bdcd304", "comment": "Malware payload (Dridex)", "value": "30a58dc9c5367d375630f0eddc8d67e9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508900, "uuid": "357064de-2a34-4c51-afa4-9b6d9838dbed", "comment": "Malware payload (Dridex)", "value": "4385e6e9f324a1cca32814c6c31340f878b3340f35277dc0cb8b149ab555d369", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508900, "uuid": "243f3752-7c78-40f6-bb7c-1dc5e2caad27", "comment": "Malware payload (Dridex)", "value": "0b4a745d4f9887fc6c398143560a3b2ad3b37925", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508900, "uuid": "b20d7463-19f2-45bb-be05-7ce7ad92a4a5", "comment": "Malware payload (Dridex)", "value": "00de6f18e5cc947b45eff7132f3e1fd3684606f9eb59a86441ae5e980ec09217362090f7eea6492478bced619b8bbb58", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508900, "uuid": "73996dd1-8bcc-4090-b128-ca1b12c4f888", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508900, "uuid": "627b5f24-f552-4e22-8ba6-a720acf054ca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508900, "uuid": "00f76a5e-c9ad-4b92-98c6-6a6e31fe643d", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618508900, "uuid": "4546460b-a33c-4544-ac72-cc2263cd39fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618508900, "uuid": "b745bec7-0d33-4225-b5ab-b3093611f4ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508900, "uuid": "f53e2084-2e1a-4959-b842-e6819b0614cd", "value": "4385e6e9f324a1cca32814c6c31340f878b3340f35277dc0cb8b149ab555d369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ac2582-9d91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618453204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453204, "uuid": "0180f32e-75f2-41ce-ac54-d7d5d54934f2", "comment": "Malware payload (Dridex)", "value": "72bb3ea6691d3537f841581ee8f6d8dd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453204, "uuid": "bea687a7-f440-4ed3-9510-141c6848d69e", "comment": "Malware payload (Dridex)", "value": "43f26ef797510a039f105ec52ef60447d928b6f11b957cda7ffe91dc30117a34", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453204, "uuid": "ecbb2c3d-35a3-4de5-9cb2-1f643f77e05a", "comment": "Malware payload (Dridex)", "value": "54307cc81888ea8c39311206d10b459aaf5c6df2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453204, "uuid": "420d6a5c-d5c4-4309-96a0-732d852f3931", "comment": "Malware payload (Dridex)", "value": "4bdd9344d7983e06404f4968ed282e80eeb6780a5af021235726ee46441db16e45b96803325cf8c14019530007e06a22", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453204, "uuid": "96152d2a-51cc-4671-923c-5ddb73c54f1f", "value": "00249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453204, "uuid": "0f27c016-9928-4211-a35e-83d0d0036dfd", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453204, "uuid": "ce08cdc3-dbb7-4f65-a923-f61a4865e61c", "value": "3072:i0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:BpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618453204, "uuid": "744ccbe9-4b1a-4794-b4e5-ec8797f8ed12", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618453204, "uuid": "475af109-be20-4751-a2b1-1cdcd8c25608", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453204, "uuid": "7d153d6a-8bad-4a27-af02-25bd685a93d9", "value": "43f26ef797510a039f105ec52ef60447d928b6f11b957cda7ffe91dc30117a34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6bf0a2-9d97-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618456136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456136, "uuid": "13809c10-1b3d-4a32-bbdb-2ad33c5b470a", "comment": "Malware payload (Dridex)", "value": "9f2d6f915688457cb01f8c6103610e67", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456136, "uuid": "0523fc9b-f80e-46b3-b757-441b9de20a2d", "comment": "Malware payload (Dridex)", "value": "442c047c60d2f0818ad96cc827f67e0ade1723b7f10e7a4df4e640136bb1a668", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456136, "uuid": "33ef8452-8a26-4306-b912-2e499e7b8309", "comment": "Malware payload (Dridex)", "value": "9e30b2e95680f4308038f0bba2b05be974582400", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456136, "uuid": "6cf4e30d-4997-459a-8d2b-1f434244645a", "comment": "Malware payload (Dridex)", "value": "71238353adf769a0dad1a43be72f72bb8c2ed5e8b917f5eecd98735041c2351f0ae28ccb883a023d7f4cea16117e66b7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456136, "uuid": "b9445764-16af-4072-aea9-e67b95e8031f", "value": "D3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456136, "uuid": "1bbeb0cc-8400-42de-ba9e-5000d25fee31", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456136, "uuid": "99653ede-b4ec-40fa-9e95-20ad1be8b977", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618456136, "uuid": "450664f9-f68c-424f-8df9-f0da036d2019", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618456136, "uuid": "fe1f9287-31e8-4e90-873b-e099c1a44594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456136, "uuid": "d42970f4-39ca-4fa4-bb7b-84626d21fe65", "value": "442c047c60d2f0818ad96cc827f67e0ade1723b7f10e7a4df4e640136bb1a668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809c4470-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494184, "uuid": "697ec99d-633d-469c-b65c-080657f8769c", "comment": "Malware payload (AgentTesla)", "value": "f644d09df9c1b48ffb8c302fc4857b98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494184, "uuid": "9282e102-a636-4387-877b-caa849dfc5d5", "comment": "Malware payload (AgentTesla)", "value": "4432242a957e8398b51aadb45f9db62fcfd4d6f12d676a20b3cd4322ba33ddd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494184, "uuid": "8fd85ffa-209f-4e47-91c9-824563a13f05", "comment": "Malware payload (AgentTesla)", "value": "20f6ebfcf21f7dd366ccc64a1d11e22b70ca102c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494184, "uuid": "85c9f872-4185-4244-b9dc-666a62a15b5c", "comment": "Malware payload (AgentTesla)", "value": "d09002f2c38b3b4c6c6372a15874125f3956525c4137b916dac60aa32c87bf1ab0ffcc22763df138d1f68fae3c26d1e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494184, "uuid": "c1430e58-58e7-4d47-8e72-ed207ab408b0", "value": "FB255A9722F46E66F0BE5773806330C493FEAC47DB16C2AD3DD154E82D62981A62DF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494184, "uuid": "590de785-7aaa-4b86-aad2-53b6551a02d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494184, "uuid": "a937a471-7720-4396-87d7-b06627c8343c", "value": "12288:ycQZw60z7obwz4TbkZjg6jkdfjL660yWTl2t/wTlvAPggHGnGUKRq6KSS+:FdDoTbA8S+fHVi2iY46GG7Rq6xS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494184, "uuid": "9c84e9da-04e1-4203-bd4d-593c7be44ab4", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494184, "uuid": "4699473d-7d6e-4d07-8afd-447a1c2efcd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494184, "uuid": "cc0140ef-c56c-4d76-a8a3-ac7860e08641", "value": "Enquiry 042021 Emine INCE_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f968797c-9d7e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618445424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445424, "uuid": "b60a5c79-4335-4292-b46a-67b745fcacd6", "comment": "Malware payload (Dridex)", "value": "4c8d93095ea194c072e85f8f04c6d9af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445424, "uuid": "2cd9d98b-de59-494e-917a-ff6350801ddb", "comment": "Malware payload (Dridex)", "value": "444ba63639f045a3d20cf53605d1d0f9f8b3263b26f4502f317bc94176cbf27b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445424, "uuid": "33d81830-64da-46b6-a862-9974b9952a1c", "comment": "Malware payload (Dridex)", "value": "306e03c65b0c2bb49947d5151749ea48b69657f0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445424, "uuid": "8cb69539-c667-483f-8881-916f7acb720a", "comment": "Malware payload (Dridex)", "value": "f4419531f84172eb1f981683bcc5aa593d7b68d7d6c358474861b58a98328fa3f1127d3232d8a428c1f12b25c277484f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445424, "uuid": "f884a07d-5b0b-4696-b5b5-3ebca791761f", "value": "69F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445424, "uuid": "cfdcaf42-8eea-478a-ac09-208c29f52b8b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445424, "uuid": "c8b35352-2f33-454a-9605-1d413988e5de", "value": "3072:hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618445424, "uuid": "8cf86c22-08f6-4cfa-b0f0-4104653debd6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618445424, "uuid": "146bc570-5f37-49c5-b758-2a116a663a02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445424, "uuid": "305e6937-5543-4d68-940a-98e16f6d44de", "value": "444ba63639f045a3d20cf53605d1d0f9f8b3263b26f4502f317bc94176cbf27b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d019d882-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464252, "uuid": "4dbe1c33-be2d-46db-b23b-2fef293d82b5", "comment": "Malware payload (Dridex)", "value": "0bc0cd36279708127bb76dfcbfd35d5d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464252, "uuid": "44a1c370-18c8-40e7-a3dc-ca93a83996ef", "comment": "Malware payload (Dridex)", "value": "44690f8891a86895a9b79170e5f7402c943866b9b2cd1ead00fe1f320f091a7b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464252, "uuid": "30b9f3f9-a4dd-4b07-8852-1d65c50a4400", "comment": "Malware payload (Dridex)", "value": "de0b7a2d1ef3584f4be1ec02292bca2c60ff8d9c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464252, "uuid": "a3ee05c3-ebf2-4c72-b2d6-89b11aea3235", "comment": "Malware payload (Dridex)", "value": "1c1506063e93ae73e9d2ffe0c7fd79b0774964a42b156eb3e2024c9e321e9ad13ae815c7fe7ae839d4aafe6f86a0e67c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464252, "uuid": "c353b6b8-20f1-437d-b49d-29bf2e27adac", "value": "ACF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464252, "uuid": "deb7b35b-4909-49a2-aca3-4b31d7d1c48b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464252, "uuid": "27b674a6-2937-4809-b241-04ad5cedfc59", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464252, "uuid": "fb727298-7966-45a5-b4e9-f8716fd2bc05", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464252, "uuid": "d906818e-3fdb-4061-828d-dd66a19bf490", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464252, "uuid": "bc8330f1-6c67-453c-a2fa-557e5d938036", "value": "44690f8891a86895a9b79170e5f7402c943866b9b2cd1ead00fe1f320f091a7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7121d5-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495873, "uuid": "98c0b910-139e-42a8-b04a-af92791257aa", "comment": "Malware payload (Dridex)", "value": "4c3cb7338854a0bea3135ce817e989d1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495873, "uuid": "a7b2cf27-a689-49bd-80fe-bb7a5992b947", "comment": "Malware payload (Dridex)", "value": "447a1dcca2a73223bc5b0aa2355683b5a372b89c09ff9afc9042331cf89e6f09", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495873, "uuid": "dcfb8d02-ad0e-4988-b7e5-1f163780c6bd", "comment": "Malware payload (Dridex)", "value": "722c896376e2edfe8d37485e4310368245385dba", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495873, "uuid": "93c9d66f-81c0-45fd-a37d-cf086296ac85", "comment": "Malware payload (Dridex)", "value": "8ade46fa265b1b5dbed3683136cb433f9270cfd7b02aa53aa2a0e65a5ed45ade59935ff5cf4911134ec6197bc2208151", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495873, "uuid": "b311158f-1cb1-4858-9650-e28d6d050eb1", "value": "DAF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495873, "uuid": "f499e33e-01ee-40ea-983d-f5da3ddda959", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495873, "uuid": "e56bf720-ed3b-46a8-a8a9-4fcfd795c244", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495873, "uuid": "2e4b1870-062b-4b50-bf8a-bd3caa0f4e6f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495873, "uuid": "2a189896-99f6-4042-9148-4992ddb0d569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495873, "uuid": "f5501740-1ac6-42dc-8a8a-ac4551580bc6", "value": "447a1dcca2a73223bc5b0aa2355683b5a372b89c09ff9afc9042331cf89e6f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788ddb16-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496747, "uuid": "eeac3d70-f3d3-4038-a2c0-fcca100ac51f", "comment": "Malware payload (Dridex)", "value": "1168c0749cd0c8ac844d8fbf199c70c8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496747, "uuid": "9039c9cc-0dba-46ce-a8a0-16cac95286bb", "comment": "Malware payload (Dridex)", "value": "44af9864541c9948b31778b8f9ae55a5d9ad4472bd5e177dead1a82c1dcef891", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496747, "uuid": "82bbe027-de64-440a-9576-3dc1d54c160e", "comment": "Malware payload (Dridex)", "value": "07aeba4e2b902f09dee3bb87b91bd6740178a176", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496747, "uuid": "56407a9c-fc56-4b22-8224-231534de4f45", "comment": "Malware payload (Dridex)", "value": "6bbdbae5dd33cab0bb3f4d341a52802d2addd7e981d8e241a63c3fb05f9f6a4d4ed308504d80506e79a6320196067e07", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496747, "uuid": "d61edac1-a837-411c-bd0e-c45d6605dc48", "value": "DEF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496747, "uuid": "a42c9c99-1f9e-4eb1-92ed-9bcfcf5a77f2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496747, "uuid": "ecf7c044-9b23-4a1b-98d3-8a34b2917f6f", "value": "3072:7iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:YeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496747, "uuid": "47dcaebe-25bf-447d-9a79-3bded62b19dc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496747, "uuid": "1ca864be-a525-4708-9ac8-dbb54c83f8b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496747, "uuid": "210439b9-1dc3-4db6-8ce5-21a8dee39510", "value": "44af9864541c9948b31778b8f9ae55a5d9ad4472bd5e177dead1a82c1dcef891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b544b06b-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618514458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514458, "uuid": "b9b2ef9c-1ec2-426a-b7c8-56e3b911e536", "comment": "Malware payload (AgentTesla)", "value": "c302784cbc611764ac7aaafc314f8ce4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514458, "uuid": "3927e756-b30d-465a-b5b9-4990f5077655", "comment": "Malware payload (AgentTesla)", "value": "44d8fba6d1dd42077dc8245c87adf27ac8cf8fac22ab798cead2124675ae6b9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514458, "uuid": "4e3bccf5-caf0-4e4e-bde3-befa14656f4c", "comment": "Malware payload (AgentTesla)", "value": "02a9c436ded162a66680cf8c7223d6f314d688fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514458, "uuid": "78903735-4f5b-40ac-a1a7-13c30acf5ec6", "comment": "Malware payload (AgentTesla)", "value": "9abd6d18364b8522f22045fd8edf7f9ef35e7a6455fa09748addcf522d077b6e5ecd8fe5ca132d20113ce226d1a10979", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514458, "uuid": "70a7e034-4633-49b2-a352-b0f6ee5ec420", "value": "FBC4232A33C1AF83E69B1976CBD955881C7DFD140B2ADA86E293760F6D31705B2F0790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514458, "uuid": "0a93a6d2-b4d1-4f09-a27d-7c73fcdeade4", "value": "12288:Euz5XgM9dwXyqTB2cqGjQDkSoaLUw7ktZlYmAk:ZX38XyuPQDBlgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514458, "uuid": "43b1cb2a-8988-4be1-99c9-cd8dc1b83794", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514458, "uuid": "6deb398a-f02f-4c19-ada7-0ad96511a430", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514458, "uuid": "cad57376-29ec-4a7f-890f-9d7ef3b63713", "value": "DHL INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6fcfb9-9e2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520354, "uuid": "5507e423-7487-4d6e-89fe-c029d567bef4", "comment": "Malware payload (Dridex)", "value": "c52d09ad25bf01d76cee6f45feb55e3a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520354, "uuid": "6ec74a00-8541-46bf-9a49-1cd78de236e3", "comment": "Malware payload (Dridex)", "value": "44ed8d536ec53c6da054070b6893797d1718065c16b3889509d43b379cd578ff", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520354, "uuid": "b874a8b3-9c46-4691-81ab-7ebda66dcf49", "comment": "Malware payload (Dridex)", "value": "1e2fe63aab82a1c07a3fb62871a60ea4c446fb30", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520354, "uuid": "d8a80047-ac45-45a1-b224-e958de214924", "comment": "Malware payload (Dridex)", "value": "d3af6be415053fa6b5b43ed4b9394f058b8da9c33ce120e4e0138426c3b44242074da055421bb49ddd1f53c47c9cbe58", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520354, "uuid": "51a98efc-d3c1-463c-8c3b-4a94f1bf992a", "value": "D4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520354, "uuid": "cde0265d-cc99-406d-8dd4-0a2bc012a4f6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520354, "uuid": "227762e5-f898-4a09-8985-6e193fb03115", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520354, "uuid": "0b8b627b-892a-43ec-96b6-58f2c8a495e1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520354, "uuid": "f4363d0a-28a1-43f7-a47f-b58197311ba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520354, "uuid": "d0f1f1b2-6d05-4e49-8df1-265898c465b5", "value": "44ed8d536ec53c6da054070b6893797d1718065c16b3889509d43b379cd578ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecdd90b-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "9c64bb5c-364c-4a9b-9a6f-21178d7fb2c4", "comment": "Malware payload (Dridex)", "value": "5af238731b7a441ff1803aab3587e332", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "508c8199-86ce-4e3a-a791-3389f6e6d989", "comment": "Malware payload (Dridex)", "value": "44f7abcb47400023b41e7bdae9ab739a3d84f36e0e3bf341c6dfd1e58046dd07", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "2ffbcdac-96cd-4283-aa50-d994a30ab155", "comment": "Malware payload (Dridex)", "value": "30126b6f4b0747ffb6faca1bb535f0f637573fa6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495872, "uuid": "c24ab01d-adc1-4643-a824-371eaec9cf68", "comment": "Malware payload (Dridex)", "value": "d353617298cf40ce9a99d7a92fcc316340cb67a59da648cf78b17a69696272557df6067ee71f7bf3ba58842879344c8c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "35b0f1b7-51d4-4619-ada4-a41968a63cae", "value": "84F3E00AED9FEA88E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "eeb01da3-a62a-41d1-9f1b-815b84665c33", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "5c0e1da7-84ba-4948-b780-1d37d6c5af69", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495872, "uuid": "52a6afd9-ed94-4572-97a4-25bf397dd42e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495872, "uuid": "4fa7c9c1-575f-4005-8dd1-b419153e045e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495872, "uuid": "c319f93f-2141-491b-a410-24f0b83ee083", "value": "44f7abcb47400023b41e7bdae9ab739a3d84f36e0e3bf341c6dfd1e58046dd07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22903910-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "423b55ed-66ea-4790-9645-60f7f9163e75", "comment": "Malware payload (Dridex)", "value": "bff16ecdbf3e90aa726b8e878cb7a07c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "e9ae963b-e7cb-4637-9971-61d4cb3ba8d8", "comment": "Malware payload (Dridex)", "value": "4519188de8eac73b59767e3ede7aac7b6edc138d0e6718ae3f0359493d9ac142", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "cb0a41f1-86ff-407c-85e1-b2de4b391361", "comment": "Malware payload (Dridex)", "value": "3bebc2f22060b18b5473efc472f438b2dcfba3a8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "554ebb25-deef-41db-9084-fdbffbe3a9eb", "comment": "Malware payload (Dridex)", "value": "7e926c4e23fc94a2812165e1ab6584d939f769441eff4e871486c083ac59dffaf4be25ad08a74116e3d55b81f2b80d28", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "1f216bd2-a4d9-4445-a449-e5efad82d36a", "value": "E8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "5bfae016-7362-4b60-aa11-3beac1ddb3da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "5f6ffd50-1ab1-46df-9342-073c74e58260", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515930, "uuid": "93999263-1c69-4bd9-aec2-fe12b8554471", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515930, "uuid": "160ac7c9-71d9-4372-afb8-cf7bebffb473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "bd8de0c2-f13b-4ef1-9125-586574229e15", "value": "4519188de8eac73b59767e3ede7aac7b6edc138d0e6718ae3f0359493d9ac142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4789db44-9d96-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618455433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455433, "uuid": "b37454d4-ab91-49d8-bae4-7a850eea5864", "comment": "Malware payload (Dridex)", "value": "27f533659a9f030c2e73c5db543b11e4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455433, "uuid": "630a576f-3c86-4cbc-8179-af73d7ac5432", "comment": "Malware payload (Dridex)", "value": "457c6cdd1e7ca1d59684eec7df302d96882c7905ff8279858fe73e00f3192805", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455433, "uuid": "5c50c21b-8f27-42cc-aa13-535c92e35992", "comment": "Malware payload (Dridex)", "value": "920c47569523f79b86cf4e4fca2c35dd0e939057", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618455433, "uuid": "b576703f-8053-4ccb-b7cd-53ac9fb9e0aa", "comment": "Malware payload (Dridex)", "value": "6196998b0b2e3288d6e30ef2c85167947482dba1ba18f989a077f099b43387ec482fe3b760d4eae958bb35835a01cbe7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455433, "uuid": "28cbd690-6289-4297-8403-3a2ab5e1bbe9", "value": "CCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455433, "uuid": "0c0ee26e-3e62-4f52-8512-3d87c00b16bd", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455433, "uuid": "d4f0bbe3-bef1-413d-b5bc-4df4595a71f7", "value": "3072:wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618455433, "uuid": "8b4a450f-52a1-48bb-9214-9fc061f12932", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618455433, "uuid": "3b00bdea-3bf9-450e-ac30-fed3e1f18f63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618455433, "uuid": "ef5ad4cd-1fa3-41b1-beed-72af0da1cb20", "value": "457c6cdd1e7ca1d59684eec7df302d96882c7905ff8279858fe73e00f3192805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d049136-9e29-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618518686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518686, "uuid": "d1b0c6c4-4cf7-4d08-9b53-d00fe81d111c", "comment": "Malware payload (Dridex)", "value": "e1edb35d2840df7b756722bbf7ad605a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518686, "uuid": "d3a29ee3-4e88-487c-9378-86854c10d06c", "comment": "Malware payload (Dridex)", "value": "4586d02c475bd5be5a327365837004bd10af7ce49cffeba756add4a0ffd37d46", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518686, "uuid": "21839a4a-6709-49f2-8850-df48ef222108", "comment": "Malware payload (Dridex)", "value": "15bc4be834ae5ab5858e695509821d1ada2e6158", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618518686, "uuid": "ba06374a-d627-40de-92bc-6dc8bcf9e8fe", "comment": "Malware payload (Dridex)", "value": "b1e435ecbc1bd0b56c2fec256ed61dc396c9155c02b7fee83cb468044c0e5a5b851819aaa9d38c6188b6764e8d72d946", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518686, "uuid": "ba4081aa-ca1e-42cb-8052-0f62a655e726", "value": "B4F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518686, "uuid": "e235dadb-7538-46be-b35c-5fa35f481219", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518686, "uuid": "7864eda4-38a0-4cb2-8408-a1ef3b6f89e9", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618518686, "uuid": "25eb4550-1045-42bb-824f-ef1c5f4bbd68", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618518686, "uuid": "e576ca1b-8d4c-4496-944a-4c57119cc567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618518686, "uuid": "9cf0c204-94ea-4e7f-9a5b-d81bfcb2bb83", "value": "4586d02c475bd5be5a327365837004bd10af7ce49cffeba756add4a0ffd37d46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51604f53-9dc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618477354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477354, "uuid": "8070a4c4-6907-44b4-a694-6e728d17ad98", "comment": "Malware payload (AgentTesla)", "value": "569452e06b5ce6e0ba4ef4edcb180f62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477354, "uuid": "aa9338be-d2f1-4849-85ef-f2c9ae2f9210", "comment": "Malware payload (AgentTesla)", "value": "45baa6de563aea42430ea807981f471b4c17821a6ff43fb688407d423d0e2896", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477354, "uuid": "c101c000-48a2-47ca-bfe0-20519d250fa0", "comment": "Malware payload (AgentTesla)", "value": "a61bb39974c8d96b3721a9f46a58fd283b53186c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477354, "uuid": "87b85c03-a9d0-4f20-96f0-ba23c5ae97cf", "comment": "Malware payload (AgentTesla)", "value": "5ee8446401299315224ddaebd75234cc152000ed73665adbedd1db44f543474e3db197de99db357020448ddcad9a7d5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477354, "uuid": "1abf2aac-a783-4f61-8bb4-7f39001c5bd8", "value": "1D057A5132B7D608D6E95F78449D0E040EB1AE126933E70D19A674EF0BB27838F1EF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477354, "uuid": "12e6c87d-aa49-4eb1-a1be-3a7286e825b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477354, "uuid": "30933833-38e3-48d7-a04c-577c65cee597", "value": "24576:jRvPw90EqhjfgqnNQfNdU5BpYaCL0Pfc22:2AhQDWBndc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477354, "uuid": "8fea2045-bd93-4a70-9e08-73e56369dc4f", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477354, "uuid": "5ee90d22-2cfe-4945-831e-e414e6b90fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477354, "uuid": "d14d019d-b9c6-4a42-a789-c1caedcaa7ac", "value": "LifeNet payment 91282196_15-04-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3819470e-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480747, "uuid": "9a16655f-b277-4606-bf02-82fb72784d03", "comment": "Malware payload (Dridex)", "value": "e5b63ae52b416cf19f49720f8a47d2c3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480747, "uuid": "0a7483df-e9ac-4933-8b63-27de8a0acca7", "comment": "Malware payload (Dridex)", "value": "45d74c3bf028ff032f454c395735896cbf60654e37fa1c2ceaec966fa13a5234", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480747, "uuid": "45829d78-e7c2-4fd2-bc07-8c5b5655e1d3", "comment": "Malware payload (Dridex)", "value": "56bcf7731894ae994fa1b18f798a180d2cc46743", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480747, "uuid": "b7aa889b-ae79-4218-9d88-b9fa5740d9c0", "comment": "Malware payload (Dridex)", "value": "b5736933b2697fb3b23d87ef8c7d3819c21fdaf4dbebdf5e58e8806dc98db1c55cc6422171c72ac4d345998b79e22810", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480747, "uuid": "b58dc863-abdf-4f04-9a7f-4ce7d513eb98", "value": "D5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480747, "uuid": "78f4d1c4-56bb-4351-9d93-aebabf70c8f9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480747, "uuid": "683e05fc-563c-4014-8572-6e868e64d23f", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480747, "uuid": "4dfe5500-ed44-4407-b7b7-24cf349ed06b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480747, "uuid": "29375ef1-0d0e-4e5e-ad33-004f01fcd5b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480747, "uuid": "f0e1671a-d01e-431a-96b0-3ff11dc63310", "value": "45d74c3bf028ff032f454c395735896cbf60654e37fa1c2ceaec966fa13a5234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85790939-9d91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618453390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453390, "uuid": "df36b853-03c6-45cf-8156-006e395e9834", "comment": "Malware payload (Dridex)", "value": "1886dcd9b6e1216651d6a4de8b9154e5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453390, "uuid": "e628f246-4ee7-49e5-9b50-e0b149683522", "comment": "Malware payload (Dridex)", "value": "45e1089e876d9d54a5534f1a1053151d41dd660769741d0b9d185320623b7a29", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453390, "uuid": "2b44540b-6f1a-446b-8a49-cfb7afeca4aa", "comment": "Malware payload (Dridex)", "value": "8cf58ddd098424d1dadfad8ebbddb7ee684e7dce", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453390, "uuid": "50e4862c-8df0-4ae3-acde-a61490b16f61", "comment": "Malware payload (Dridex)", "value": "69aa553a739c5830b1d4cd0d4f52a5db4c0741a0755c78072edb15a3dee4e4b4e9679b7ea6045aa42da6751034db3b66", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453390, "uuid": "8ed681a5-7493-4b08-b133-96cb43180b51", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453390, "uuid": "5274e249-04b8-4e43-b9ff-7e9e72c3e13b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453390, "uuid": "e0f8e97a-97c4-49c4-99b9-546abc643851", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618453390, "uuid": "a654a342-fa57-41d6-98c7-9aad7c1f9bdc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618453390, "uuid": "13919ac7-69e5-4c35-9337-667bc3684f01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453390, "uuid": "5b7c2778-a3d9-4c19-ab00-fd945300e504", "value": "45e1089e876d9d54a5534f1a1053151d41dd660769741d0b9d185320623b7a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e21ed6e-9d8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618451471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451471, "uuid": "5dd9dda7-a7c6-4f43-8aef-d4e2b6dae616", "comment": "Malware payload (Dridex)", "value": "07aa0bd8667af29e9275ce5e139786bd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451471, "uuid": "0b21fd23-6275-4b37-90d9-ef8c0edcb118", "comment": "Malware payload (Dridex)", "value": "46369c2661c292f9536b6ac6e62970c2d0557fcd8a71c79acc84a48b563da4ca", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451471, "uuid": "a2d74ddf-13a0-4272-941e-3486b2743877", "comment": "Malware payload (Dridex)", "value": "9e56474ad1628ead0dfa07801acbebf520f7031a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451471, "uuid": "2457891c-786f-42bc-b12d-fc8105f71e6a", "comment": "Malware payload (Dridex)", "value": "dbd937c85e0fdd336063c18803c371b22fe5ad94a69ab0465c150f0c419839433ee3bb63efae7c1abb73cccfea16651d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451471, "uuid": "2536d5fe-df7a-4e77-a887-ea78e881a258", "value": "27F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451471, "uuid": "d195df39-e539-46d1-91f1-a6129a40eb57", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451471, "uuid": "5e33abe9-3a48-4b44-8b51-c33fe7747255", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618451471, "uuid": "f5272d1d-61af-4879-b1a5-2da0ba3f0b50", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618451471, "uuid": "4a76dae0-21ad-41a0-883e-76e5cfae1408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451471, "uuid": "7a1da1c2-d876-4f2c-8386-63300ca4c3a7", "value": "46369c2661c292f9536b6ac6e62970c2d0557fcd8a71c79acc84a48b563da4ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18210e2-9da5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618462080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462080, "uuid": "65f0fd85-af9e-4c76-a95e-da0eb8f272fd", "comment": "Malware payload (Dridex)", "value": "4f66222128337bfd9e600c1dd6d5c80f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462080, "uuid": "a1c3b3bb-7c30-4f16-b556-db50dc68922f", "comment": "Malware payload (Dridex)", "value": "463d5c20f12cc2a419c1eccefe6419e491b2053d3ac8b32f5fa46f75e762ec5e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462080, "uuid": "b4d84137-db49-4fa2-83a6-3661fe6afbd9", "comment": "Malware payload (Dridex)", "value": "95301b2a6655e07196c9a847928d89eae34317aa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462080, "uuid": "45245461-8510-43a6-b08c-5eae5cc659a9", "comment": "Malware payload (Dridex)", "value": "2cc650601cf19c9c266a1f4028b1d349208b271c09395b18b9089d3f05e0ef962ccfe320e6737f10085f720b35720171", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462080, "uuid": "47ce028c-bc96-480d-a89b-8f17103cb692", "value": "57F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462080, "uuid": "d4b6bc25-e29c-47d4-8ba7-886b58825d3b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462080, "uuid": "f758c17a-c9a9-4661-9416-dc399ce92605", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618462080, "uuid": "f3d1eb77-e228-49cf-89eb-ca94e0b2c67b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618462080, "uuid": "27de7db0-a7f0-4d90-8b92-857878eb540f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462080, "uuid": "5cd6ed89-6e67-422e-8ef1-cf5fbc12663f", "value": "463d5c20f12cc2a419c1eccefe6419e491b2053d3ac8b32f5fa46f75e762ec5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e0d848-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480903, "uuid": "4ff44c1f-d222-476a-9cd4-48cea1735028", "comment": "Malware payload (Dridex)", "value": "3846f7e48b56ec1ab8b99beacf0cc187", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480903, "uuid": "3fff4980-3ea5-439b-bfcd-7f013b0f604f", "comment": "Malware payload (Dridex)", "value": "4644b7498073a8c0defc1015bc58a02fcf3ce6085e50b02e57ccd292ceb3b6e9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480903, "uuid": "24bd98ce-5496-4f4f-8aeb-1e3fd189340f", "comment": "Malware payload (Dridex)", "value": "751564dd8d687626fe0c3bf2e00dd2f422bf78d7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480903, "uuid": "7cc3620b-bda8-4fcb-bc6c-d5941d27cb19", "comment": "Malware payload (Dridex)", "value": "b269b4a548c283608ee658881c19221ef50ac5e8d897468d97e1eea4f2b56e0fd5bdefa601237bbf4e9559496971ba9b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480903, "uuid": "999a9b7e-b5f2-461b-bf79-865fc2392f96", "value": "02F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480903, "uuid": "bb53d286-c2f8-4eb1-9ab1-f19738379cca", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480903, "uuid": "70c3a90a-de5a-4396-b557-d4e921ce128e", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480903, "uuid": "a1780a8c-39af-466b-a09e-65af8373f8f0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480903, "uuid": "54436325-97f9-4f65-8d33-21ee71bd5c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480903, "uuid": "29e7a8c2-2884-4a0f-919c-d9decf79c355", "value": "4644b7498073a8c0defc1015bc58a02fcf3ce6085e50b02e57ccd292ceb3b6e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2f5086-9df9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498073, "uuid": "9fe71094-a0a8-4b23-9d37-22a4986568b8", "comment": "Malware payload (Dridex)", "value": "6a1d9164608246e077cddbd0eb84736d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498073, "uuid": "05d13797-bc1d-4abe-b5d4-7fae0832a41b", "comment": "Malware payload (Dridex)", "value": "4690f21b6d614118f51cb74bc3d24668f081f4823e2f94e5dabd509866582297", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498073, "uuid": "193ee1a1-3e7d-4e04-bb7e-ae19d2699b96", "comment": "Malware payload (Dridex)", "value": "708c6009f364146f2e5725ef2d6b3673a4e815c1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498073, "uuid": "3de26b4a-5199-493b-8b42-bba3e07d76ae", "comment": "Malware payload (Dridex)", "value": "0add1d52a610a31e600c5f208f458788a78b541abc00737bb83fd9b3d20de1a1e320a1a435d5f1fe8c55f0cb3e4e0e58", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498073, "uuid": "4ab60780-e09a-44b3-b2c9-7773a60a6c9c", "value": "CEF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498073, "uuid": "52ff1087-bb97-4508-aa6e-91f372941eeb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498073, "uuid": "58e732a1-ec3f-4d7e-9956-942c2b9f0b40", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498073, "uuid": "b8ca160c-1bb1-4b16-8b22-6c02aa734af7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498073, "uuid": "0384324e-c09a-42fb-9865-e8c4e7b8fa97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498073, "uuid": "9e70c4ad-7c2f-4bf7-a804-1cec42eb7f1e", "value": "4690f21b6d614118f51cb74bc3d24668f081f4823e2f94e5dabd509866582297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f90e32-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "ce1d8711-12fc-4564-8da4-a250bd31ed21", "comment": "Malware payload (Dridex)", "value": "f669d243cdb0ecda590d8a2b873ccc0f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "73de1adb-eaa2-4016-adb0-c2b906d5d496", "comment": "Malware payload (Dridex)", "value": "46994a1f8cc673af535e806a5adbebd4b52d2ddd004d23a9d41317f3fb88db21", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "e82bce2c-1671-4813-ab04-d2ffe4683385", "comment": "Malware payload (Dridex)", "value": "5bbe9451d88350ba2a6e98981b6d4d5983098e08", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "30433f32-1051-49d9-af6c-cffef83fd54e", "comment": "Malware payload (Dridex)", "value": "981fa860e411ae9992d1ac866899b073ba567d9443822defba9f5f2681be90319e2b7f57a425247ab207093f42e04321", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "4c583f1f-45b0-4689-859b-af6375dd4710", "value": "D5F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "27ef6234-6c86-4ef9-a3f4-1cef6166c826", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "8387e8b3-7294-4cf2-ae34-e6a177221a1a", "value": "3072:wA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:w3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496687, "uuid": "9cd1867f-fb53-4e0c-be99-65717dd3592c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496687, "uuid": "74137383-894b-448b-8d51-8462101a325f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "65f6f40f-bae5-4f32-9f32-0763fbb7d416", "value": "46994a1f8cc673af535e806a5adbebd4b52d2ddd004d23a9d41317f3fb88db21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4f7146-9e1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618514014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514014, "uuid": "08c7b46a-d75d-475b-9020-86fbd8543c13", "comment": "Malware payload (Dridex)", "value": "f47f5e9d4e485832834ae05b293e1bb1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514014, "uuid": "3650203d-d098-48d2-933d-9d9d55176141", "comment": "Malware payload (Dridex)", "value": "469e586e6a32d4ed0c02842a4c0546e7cc2c2f91c4f540636d464984c6730abf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514014, "uuid": "d7d154f2-5974-4e48-b5d7-34d1543ed734", "comment": "Malware payload (Dridex)", "value": "79f281a9372c3ca586a92c6319802f2c8b1b7968", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514014, "uuid": "66637863-ce3d-4858-864a-80ed73aadd4e", "comment": "Malware payload (Dridex)", "value": "e2f6bd27f793780ec987af0a19b1f20bd56fcb39220d6eb4bec33d9b9b6dbde80543add6f7f1485ce75f6be0c13060b5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514014, "uuid": "4ab3818e-f5ed-496d-a0b7-ed790b2471a1", "value": "F8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514014, "uuid": "637bbaa5-1a54-49a4-8243-70f3fc21e07c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514014, "uuid": "3be8a252-bf0c-4c83-b7fa-274057c09f1a", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514014, "uuid": "a1deed3a-5c58-4548-b0e9-c2253830bcee", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514014, "uuid": "08520512-7a07-4fc1-a5d7-06392c7f9373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514014, "uuid": "80707d58-7526-4697-b2e4-8b94575c2b4b", "value": "469e586e6a32d4ed0c02842a4c0546e7cc2c2f91c4f540636d464984c6730abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83e9965-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "80c1f6c0-803f-49da-a56f-a91490cef196", "comment": "Malware payload (Dridex)", "value": "976877fde729aa9c29429a0dab5230bf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "f5be2e64-073a-431a-ba7b-3c6c1500b4cc", "comment": "Malware payload (Dridex)", "value": "46c78bdbd6bc1991f26a65c508199fd028b8be0105d2fc97ba20a97ff3f71c90", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "3d3c42ac-3820-4910-ab4d-55a437ca4ff5", "comment": "Malware payload (Dridex)", "value": "642d1d2bb47643537ab20ee2709de4ad03a5bd7a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "bc3f9bbd-6edf-47b3-8605-3bac9c02d7a3", "comment": "Malware payload (Dridex)", "value": "a96db92bc0d77d047a908c98d2dc67727c527d0f9602c53da138c59af558a451eb6253dd011cd5368a67a656ff3fb875", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "e56ff56e-a09e-4167-a4c0-10b4ab126665", "value": "3DF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "54a737f1-be2d-4931-a9ab-93b6dd5d3076", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "ad203286-bb1c-4d10-96e5-2448a6d07589", "value": "3072:IA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:I3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464319, "uuid": "c3109b41-193a-413a-9539-3f0ed8115095", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464319, "uuid": "7725bad5-d70f-49a4-9ed0-c748c5b13868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "142c3134-4184-4274-b698-91d632993250", "value": "46c78bdbd6bc1991f26a65c508199fd028b8be0105d2fc97ba20a97ff3f71c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e45cff-9d9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618459024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618459024, "uuid": "399503f5-9d3d-44f2-9e5d-f9887606f816", "comment": "Malware payload (Dridex)", "value": "ab8f3b32b5f92407c046be126c42c408", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618459024, "uuid": "63768f6e-d2d7-4409-b091-bfadb5531089", "comment": "Malware payload (Dridex)", "value": "46eadb6e1612d23217aa7d84616e71c40b7144dc7ffc5c44a94098fa0068cf9b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618459024, "uuid": "dd03070e-439a-4df9-8f7a-e77a4cfda105", "comment": "Malware payload (Dridex)", "value": "2796d0521015e8829ffe645212f844ff1fb4c3b1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618459024, "uuid": "36ef5771-524f-4a79-9774-44e8e1d00775", "comment": "Malware payload (Dridex)", "value": "b4f3f4d755b617e37da95160c56978910b7b82b488b7c502f09920299f77fe03be4b7722e836b548d46c3b5cb2e2bba8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618459024, "uuid": "58817dbd-56a4-4e14-8366-c35cf1cccaff", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618459024, "uuid": "5c7572b7-d9fc-442b-ba94-dcabe2854847", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618459024, "uuid": "db93f41d-bc7c-4f75-aad8-e68d51581030", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618459024, "uuid": "7d8a46b1-0b01-4cd2-aebe-328b6fb8be57", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618459024, "uuid": "013c367f-c9e8-4941-9ff5-f1530bf4c1e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618459024, "uuid": "45bd285d-c89f-4850-adba-fa4a00e3420d", "value": "46eadb6e1612d23217aa7d84616e71c40b7144dc7ffc5c44a94098fa0068cf9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c296fb85-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618523500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523500, "uuid": "7f7e5ce2-54a1-41ac-bbdf-82199ccdfbce", "comment": "Malware payload (Dridex)", "value": "ab72ee76c1ce4884fde36fee787c62d0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523500, "uuid": "7ca83592-093d-4809-9b77-d3a88678edca", "comment": "Malware payload (Dridex)", "value": "46f005bf10f5540eee2d74eb592250784ac59b412018338a504bbe46caded51a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523500, "uuid": "24b7bd5d-fa6a-42a4-8d43-89c48fceae07", "comment": "Malware payload (Dridex)", "value": "1f687717d9b1a812ae937d2ba932d27e59ba86e1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523500, "uuid": "1ed88571-eec3-4081-8fa3-d6e223569e08", "comment": "Malware payload (Dridex)", "value": "e774aa595fceb269546359ca67b95c89facee62011f4af1a014be2ca793255360cec47912ba2cfd132bc863686d0ff6b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523500, "uuid": "04ef35dc-3a85-41b1-a041-a2b7d92d7646", "value": "13F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523500, "uuid": "0b88a265-c7a8-42b5-81ab-718de985bca3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523500, "uuid": "5bc0fab6-847e-41ec-ab71-ec012cc3bd6d", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523500, "uuid": "f4c02630-af27-4368-bab3-d749a403f2c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523500, "uuid": "df825443-bd75-4aa0-8a71-8de919909c6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523500, "uuid": "029a34c9-38ff-4afe-b3ee-947cd1dcdaf4", "value": "46f005bf10f5540eee2d74eb592250784ac59b412018338a504bbe46caded51a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e51bc5-9dea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618491562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618491562, "uuid": "8d3a7438-afd2-4b39-8958-37a3ada9b323", "comment": "Malware payload (Dridex)", "value": "ac38d41e78cc4bd74422c1ffea374f3b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618491562, "uuid": "891b90e4-b1c3-421e-b890-5b33eeb2f0b5", "comment": "Malware payload (Dridex)", "value": "46fcb0ee08ae802fa756ab837045a1b7f3eed973eaf2df9a9fee3338b0956c5a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618491562, "uuid": "30a65bac-c838-4ee5-b182-2dc260404948", "comment": "Malware payload (Dridex)", "value": "3ded375d7e78bc1c6a4d0431f0f064cf7e65dd71", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618491562, "uuid": "95db98e7-f4d5-477c-8c9d-5a112b87bdd4", "comment": "Malware payload (Dridex)", "value": "a81d90967cf28d4b6cb9aed93e612e6426c855ca412e5f8e366b7c8c696edefb4cf73e0145e9165129471280737f5295", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618491562, "uuid": "23b0ba38-c330-4c0c-a0af-b78fc817686e", "value": "9EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618491562, "uuid": "05755e34-8811-4798-84f4-77c891e36add", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618491562, "uuid": "deeb4335-fc1d-4e80-b1ef-8f4128c35124", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618491562, "uuid": "3822587f-2cf7-45d1-a571-eb732a25500d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618491562, "uuid": "9a378ee1-d1cd-44aa-a606-14bf674314d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618491562, "uuid": "086d93ab-cc49-4857-978d-05440a877e7a", "value": "46fcb0ee08ae802fa756ab837045a1b7f3eed973eaf2df9a9fee3338b0956c5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264583f8-9e38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618524956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524956, "uuid": "a9c318df-0ae5-48d1-9377-b53ef03edc5e", "comment": "Malware payload (Loki)", "value": "4a41efbf11ea5d57b345fdfec9cb2927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524956, "uuid": "7fac821d-4cb2-47a4-b3e2-c9c20069d1f5", "comment": "Malware payload (Loki)", "value": "470ead68cda3f1c054c44aab1914983eeab50fe774fb9127c31aa7c0df768ffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524956, "uuid": "a2b52b48-07f3-4afb-bddb-3634c4240893", "comment": "Malware payload (Loki)", "value": "242ecd9da38e8be47bd9caa8478c9350e067c0ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524956, "uuid": "9faa4ea6-fe22-4ce7-b77a-5c076c0ad614", "comment": "Malware payload (Loki)", "value": "04e158df3326c75bc0a35e8d98886c890af142306027d9db00c76697bfb6905fae87a4f08a3f6fabd6bde3d05078eeb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524956, "uuid": "8a83a3ec-7fe6-4124-b0f4-016b3d06f2c5", "value": "05C4AF673550E6B6DC24D171E89B45832F242D2997873EAB33CCF72B1AB1170A71A32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524956, "uuid": "842f6a86-8ab7-4ad1-aaf9-a94fafc03373", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524956, "uuid": "dd66b238-cd4a-4a1b-b437-6f75bd2a40a7", "value": "6144:s11QVja4uAjNskNwE8TEwTZXeRi0xe47vQUaXTAhmkne/IoyLYxgdS:g5ACkWEHsXovQU3hm6FLOgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524956, "uuid": "069e2d9a-bc1f-4297-b121-cbe8afc26736", "value": 586770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524956, "uuid": "4fe27542-0007-4311-b580-0f19ebfe0406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524956, "uuid": "1b318f7d-171f-4145-8545-74646ac3400f", "value": "4a41efbf11ea5d57b345fdfec9cb2927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406bb0d8-9da2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618460575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460575, "uuid": "7336816b-9dcf-497d-95f8-e5d7dfaf4da3", "comment": "Malware payload (Dridex)", "value": "74af1e45fa77476964f554448f3f2549", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460575, "uuid": "0acab7dc-671e-46ed-a263-80da66d36392", "comment": "Malware payload (Dridex)", "value": "47534cf124b23d5c395f2a1f9928626c4cd2ee589a4789ea0c4a381d97a2407d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460575, "uuid": "8b51ae8f-7327-4d98-844a-cd1f2cc994f8", "comment": "Malware payload (Dridex)", "value": "04b35d01a80de58809b33c93fda0cab31e7dbd27", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460575, "uuid": "d3e453bd-cf9e-420c-a99f-48217d0571ac", "comment": "Malware payload (Dridex)", "value": "68c1e6f428b88b6e0d04cedd8c8043bec9b74bd085d03fb6d580678d0ff81bc37f8628ba3a27205c16263244ad622b01", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460575, "uuid": "1bf661fc-323d-4373-973a-181e795274b2", "value": "CD249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460575, "uuid": "4d9c28ba-6a8d-4536-8f54-32a5ef825a82", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460575, "uuid": "359d67f1-1324-41c1-98ab-107a603a7a43", "value": "3072:K0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:JpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618460575, "uuid": "683b4f98-e9af-4eb7-b4c6-819ab93cc55a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618460575, "uuid": "8bd9e223-f1bb-48ba-926d-a2f4995fe467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460575, "uuid": "24815dac-5b63-4a89-8125-b12a6f5f8fd9", "value": "47534cf124b23d5c395f2a1f9928626c4cd2ee589a4789ea0c4a381d97a2407d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adec02af-9dd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618481804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481804, "uuid": "7ee6ebb5-5353-4410-9647-f3aca1cb889b", "comment": "Malware payload (Dridex)", "value": "9df403c395bdd491f9b4157778f2e2fc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481804, "uuid": "09516fb1-dd9d-4700-863b-3ee4e93b8d8d", "comment": "Malware payload (Dridex)", "value": "47765b6f6ae20273f83269498586923cb7bd2411cfb9c08c2c60f80374652b8b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481804, "uuid": "97460e87-4b6c-4bd6-9123-e3c8d6e2e918", "comment": "Malware payload (Dridex)", "value": "508e1f5d8b9dc6ea9b33e28856001fa72505e044", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481804, "uuid": "178b9478-4794-4575-b03f-d6c949692c2d", "comment": "Malware payload (Dridex)", "value": "44724287da5d446c6105cdaa9989147b7262e941e46ab3e5b8befb1c289f996ee5f45fd2353609c411943fc2066be3e7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481804, "uuid": "953ea401-e3ea-416d-946f-c0922742ee2a", "value": "FA249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481804, "uuid": "d675d836-1aac-400b-b012-8377ca0a7d34", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481804, "uuid": "77e86af0-0b54-43ed-b45e-8346ff098bfd", "value": "3072:b0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:6pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618481804, "uuid": "7dc86c4d-a20b-469f-b6c1-37901231151f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618481804, "uuid": "c36bda2a-f37a-4e83-8574-c33490549228", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481804, "uuid": "cd803966-e471-40c3-b068-99f8aaac5068", "value": "47765b6f6ae20273f83269498586923cb7bd2411cfb9c08c2c60f80374652b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fde9f0-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480737, "uuid": "1b2f1e7c-2f79-46c8-8844-b0eb30950c4a", "comment": "Malware payload (Dridex)", "value": "b174d51a3734c07218dafe07efd4f1ce", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480737, "uuid": "2b7018a7-b8df-41c7-934b-d739a6073572", "comment": "Malware payload (Dridex)", "value": "4783df2c2e216c3339c60d2261e72d3a3aa28762878395f36b88748a9f6097b7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480737, "uuid": "fb50622f-a3a0-40fd-8ced-98ef0bda82d3", "comment": "Malware payload (Dridex)", "value": "f2b34a4385d21259185f688b31711da9b2e99965", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480737, "uuid": "762e3c3a-bef3-4eb4-9d0b-e1b8b6e84d6b", "comment": "Malware payload (Dridex)", "value": "ce87d2baf34060cac68331e67985eaec2562ad212a11ede5854e62d2a8dae5bbfa550df5234c4aa7c96f332aac274443", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480737, "uuid": "a5593a52-c684-418f-9f70-151300a00ebd", "value": "90F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480737, "uuid": "fc0bd3df-7a6c-4c4c-876b-bbcb35e9fb47", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480737, "uuid": "0e4d18b5-7673-4454-80ce-c3ebce320958", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480737, "uuid": "137f6fbd-c487-4b11-888b-2f4f1fe33dd7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480737, "uuid": "d6f0ab03-970f-49df-ba4d-09b81d5f0372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480737, "uuid": "7fecde82-bd20-4359-8b2c-981dd5cdaeea", "value": "4783df2c2e216c3339c60d2261e72d3a3aa28762878395f36b88748a9f6097b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b895c61c-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "e6785f1a-274e-4a0d-9aba-1ab0d3943771", "comment": "Malware payload (Dridex)", "value": "cb9f23a1efcaebe787b699dc81e465ad", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "1d8e6253-aa36-4da3-868d-e6ad652bb046", "comment": "Malware payload (Dridex)", "value": "47b96405778bd038e30666e45fd64e54add3a049e2ecd540bca5bd360930ffe2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "bac65ef8-b2c2-4a78-a62a-d87d8723dc77", "comment": "Malware payload (Dridex)", "value": "a8eb27d786233d705b2c24dfa8c541d8c0ac49e6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495995, "uuid": "fdff2509-2611-4e26-a5eb-64356f58c58e", "comment": "Malware payload (Dridex)", "value": "b478df762afaa1c15975a53094662c1ae5a4b0e42d96f816268cc3a9070b775b67425f7b3a61477223f3c9a85d9e1f60", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "85b8f6dc-926d-42f1-af44-1c044816dd2c", "value": "23F3E10AED9FEA88E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "4d4e39fc-840b-46dc-a2e5-0fc49e2e6872", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "74016b43-82e4-483b-9078-1c6a026f173c", "value": "3072:iiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:heAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495995, "uuid": "932820a1-51c5-4fea-b50e-b471583640be", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495995, "uuid": "a7579e88-24d4-48c2-8f31-58c9f0dd11b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495995, "uuid": "74c8b1fe-6f6a-4f21-a912-04abc37afe49", "value": "47b96405778bd038e30666e45fd64e54add3a049e2ecd540bca5bd360930ffe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ae33ee-9db4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618468253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468253, "uuid": "6c7120ac-886c-424b-a66c-4ce62eaf0c3b", "comment": "Malware payload (Dridex)", "value": "23c056137e00cf0d595e9866ba768e1d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468253, "uuid": "f55f27b1-5448-4ed0-8070-4abf3e2c5940", "comment": "Malware payload (Dridex)", "value": "47c3d0cce25575751e677d036dcdc26820274666842f5dc09ca25a6ed771ed24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468253, "uuid": "7c5caacc-29b2-43ab-bb11-bf61a9572fee", "comment": "Malware payload (Dridex)", "value": "c39e75c421af322fabdd9cc0564fa5a2bbd87ac6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468253, "uuid": "4ec50ecb-02c6-4dff-a853-81fc2d94bae0", "comment": "Malware payload (Dridex)", "value": "d9f8f87153cb2b18994be08c67a005360ac7e24c039a63d0c68dca0498aa816ef62b54fb3c5c52bb7c83100dc08fa22d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468253, "uuid": "83d9d2d4-212e-4fd2-b25a-c88abc6db16c", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468253, "uuid": "f407e2c6-0133-46ff-9ff0-4de0276f07a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468253, "uuid": "18d9c235-37eb-42bb-8fe1-cf6031bf155a", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618468253, "uuid": "57394c61-a05e-4d93-b282-9a35b7442809", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618468253, "uuid": "8ff72e75-a2f5-485b-a0c5-223fbfc8a426", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468253, "uuid": "26f6ba05-7ceb-49a8-8036-802b92b21143", "value": "47c3d0cce25575751e677d036dcdc26820274666842f5dc09ca25a6ed771ed24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c423bfe9-9de2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618488284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488284, "uuid": "10ca51d5-d8c3-4b15-9b30-f59e5a0cef57", "comment": "Malware payload (AsyncRAT)", "value": "7715b4c1061c5f6c47cb1a156bb2a156", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488284, "uuid": "c13fef3a-841b-4458-8856-9ac338dff17d", "comment": "Malware payload (AsyncRAT)", "value": "47f0314cc5f0b5783bbc8df2084fc725c81771c09077623d6bc5d1a08c28e174", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488284, "uuid": "3a9b649c-343b-4c88-b881-5aac67086117", "comment": "Malware payload (AsyncRAT)", "value": "57ea28914c10cbe74e1f4a6a558250d4642329af", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488284, "uuid": "9c7bdf81-808e-4c7a-bab5-4c0ff1af3693", "comment": "Malware payload (AsyncRAT)", "value": "0304b1dfec9da17e21ce0103e07a9da610304d8fdddd7037835fdd91cc306e391b4a24069173771da59d176896303b0d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488284, "uuid": "9268e6ac-26a4-42d8-a2ba-850d6e558f19", "value": "7BD4F1205A8CFBCAD86E4BB6C46085B60373A663D359CB1FE48C30C95AB5782F52D357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488284, "uuid": "34fd8165-377f-405a-bf12-d5b980903e7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488284, "uuid": "082873b7-2999-44c7-9b78-59241ec00cea", "value": "12288:Q2WQUCiB99X73RqcvvHP20THqa4kOj/Cf4bVX/uKLSBATm:Q2eFrHvPP20THh4p/pJX/hSBATm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618488284, "uuid": "69e632a4-86ab-4cb6-abc9-1a1f17a5dc2c", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618488284, "uuid": "40ff6c88-cb73-48e0-a267-15cc8d0c11b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488284, "uuid": "06b505cf-2314-4f21-a647-57a55c0df1d6", "value": "SCAN_COPY-369326739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bedd56-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495934, "uuid": "5cd2c8f6-7aca-457d-aa38-38b9a23e51e7", "comment": "Malware payload (Dridex)", "value": "bf99aa5c7e3372beb2b4215309b283c3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495934, "uuid": "ec6be204-9a74-4561-95b3-08f0e88978b0", "comment": "Malware payload (Dridex)", "value": "481526f42b0a1ff0061ab019676cb5e6a6a6bd9b69e1e8fa7f4ec0f98776be28", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495934, "uuid": "d9c5f99b-8cdb-4a5d-8569-53982bb90440", "comment": "Malware payload (Dridex)", "value": "01bb9ec297a77e67649472919540cfa82360e8e1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495934, "uuid": "32a17d32-160b-4508-8ad6-7d5bd4e9ad8a", "comment": "Malware payload (Dridex)", "value": "d34fdeb24be49bdda9930dabafb2600c5e3181c0c19ef7ea26fe9a74f15db524876bcb4104cacb67b746abe1157ebc2c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495934, "uuid": "ae55ece1-29c3-485e-a779-5093b37f8409", "value": "70F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495934, "uuid": "f90c99d6-3edd-444e-836e-63bd434b41aa", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495934, "uuid": "2f0dad26-89e0-4fb8-95e0-22903a872952", "value": "3072:bA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:b3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495934, "uuid": "e5803581-f469-4ed5-a233-a58cf227f343", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495934, "uuid": "a23435a5-4e88-44d2-92a5-f41035feb510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495934, "uuid": "6b571195-91d1-4e3c-9129-0a1612f1fea8", "value": "481526f42b0a1ff0061ab019676cb5e6a6a6bd9b69e1e8fa7f4ec0f98776be28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28ba8f4-9dcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618478483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478483, "uuid": "83f95d64-6635-495a-a4bc-89f05550c719", "comment": "Malware payload (Dridex)", "value": "796a433b3f8ba871fc65009ac80cc6ff", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478483, "uuid": "237d4b84-1c37-40ec-961c-3fb06c68d9ea", "comment": "Malware payload (Dridex)", "value": "488706a50d5a5f0cda8814d2e0ba201ee9864b233cc32634a28c4d41aac02d19", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478483, "uuid": "4d120351-bde6-42a6-badf-9bc2f25c0300", "comment": "Malware payload (Dridex)", "value": "fafbafe023dfb4d4ea5c05f0d6b185cb3aaa611a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618478483, "uuid": "0de548ad-38fb-4f74-9764-004ca5f77902", "comment": "Malware payload (Dridex)", "value": "cf69feddcb9d5b8bb758187ffc2134945cd1d844baa7af609e8e6139d15c54dd13e31052e7c5f297b58a35d41f26531f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478483, "uuid": "f289f18e-0b45-4437-9067-9f066d4fb8d7", "value": "15F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478483, "uuid": "11511e67-a4e5-4fa9-8b63-4e538e645876", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478483, "uuid": "7741e4c9-f0b4-4a71-8832-feaee4140c6e", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618478483, "uuid": "87c3af3d-16b3-468d-b404-d942640f1717", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618478483, "uuid": "c8e441e6-38af-43f9-8358-8d9b682e78aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618478483, "uuid": "cdb8613c-1f30-4d85-9a68-7b519ee2aa8e", "value": "488706a50d5a5f0cda8814d2e0ba201ee9864b233cc32634a28c4d41aac02d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d611ab03-9de2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618488314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488314, "uuid": "ad7e802e-282d-40c9-8e0a-210fab8c64cb", "comment": "Malware payload (Dridex)", "value": "e3b6b577da10d6c7e2a03c751c8a19d8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488314, "uuid": "e74911ce-3feb-44a1-9dc9-28ae21e49096", "comment": "Malware payload (Dridex)", "value": "489cb30635adf01f326a4c334ffa6101d85290f9411ca2c32add96cd608f7e17", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488314, "uuid": "49091d64-6b45-4e82-b81a-622931567841", "comment": "Malware payload (Dridex)", "value": "a38a3341685c4d41b3279f85a4a393e08b008e89", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618488314, "uuid": "4df45fd7-ac83-4ea5-b508-7de5742b6453", "comment": "Malware payload (Dridex)", "value": "b09d84ae5daaff965ef94e103fc589d313ff37e162ba1b2518f91f0ed47271c183eb10d2da3e642b7105c0b1ca6f4349", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488314, "uuid": "d38822ad-161c-4008-bf0a-decec67039b1", "value": "CEF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488314, "uuid": "98c9f3cb-d0c3-4d9a-8f19-6c3afea8e2ea", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488314, "uuid": "7f10acb6-c4df-4fb8-9f8b-8b20fa3a631f", "value": "3072:WiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:NeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618488314, "uuid": "dd9cde63-91d8-4ddd-95dd-d5d5dc44e21e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618488314, "uuid": "9dc21188-0d50-4501-bb01-159ebc4f8b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618488314, "uuid": "48d04e0e-592c-450a-adcd-7e6fb687ca07", "value": "489cb30635adf01f326a4c334ffa6101d85290f9411ca2c32add96cd608f7e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf6e5f2-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496055, "uuid": "bb9608fa-c5bd-4e8f-bfe2-83dac7e400ba", "comment": "Malware payload (Dridex)", "value": "a2f8636b8f1b7af0b48123a0fb24d15b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496055, "uuid": "ac291d72-75dc-43cc-a891-6beeb2ebcb3b", "comment": "Malware payload (Dridex)", "value": "48d570183f81b35dd5972155006400710bacc8e925823838ec89ceb26a538817", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496055, "uuid": "d4648bd1-1643-4583-b89d-e1f02e3a7382", "comment": "Malware payload (Dridex)", "value": "b309f6e33b92d59491a494ef58d8b7843c2d88d0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496055, "uuid": "0f9cb334-7e99-4c1f-a281-d78f1f5dd2fd", "comment": "Malware payload (Dridex)", "value": "ed5e9a205b4bc3f09f655eaf05b8901c22f92a9a2dc50314eff247e61f4d0ba897e97fdb1df3f9c81106e9a1f0839ea9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496055, "uuid": "5af13330-2f60-4134-a702-0dd228abde57", "value": "F1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496055, "uuid": "d8439412-7355-48bf-8b16-1c029a4b9bbc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496055, "uuid": "b84703a5-5d83-4d50-ae2c-fc3e5813c169", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496055, "uuid": "edafda0a-1904-4016-8769-731c1b489add", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496055, "uuid": "4ee47177-2e18-4cb1-ba11-34a1a6e28377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496055, "uuid": "991db61b-42fb-4fe2-a8c1-0c73bb29df3f", "value": "48d570183f81b35dd5972155006400710bacc8e925823838ec89ceb26a538817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32aa38a1-9d85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618448097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448097, "uuid": "f2a198ed-152a-44d7-b109-5695558b6d00", "comment": "Malware payload (Dridex)", "value": "2aabd2f6d034c55a645872f8475d7a63", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448097, "uuid": "28bbe9f6-ebcc-438d-a092-d4c3ada10e94", "comment": "Malware payload (Dridex)", "value": "492bd3c2282142e5d74f4aa6dbaabbc235f11785366f342502c7fbdd2f2ba655", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448097, "uuid": "f6662f7f-5665-4498-9949-5f59de9a0599", "comment": "Malware payload (Dridex)", "value": "01e694c9ce6749e885fe292fbe10eaf2dc0ff203", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448097, "uuid": "dd4c6e19-47c0-430a-a6f2-ef4617bd41ee", "comment": "Malware payload (Dridex)", "value": "514584bb87c9dd35d0d71014245f95306ef9e8566897d50d57d436dc81b79f9e028f05dc8e0a8d53216d5d7a2284ac0a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448097, "uuid": "22951056-0a2d-40d2-800a-2fc66c6df20e", "value": "AD249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448097, "uuid": "4e6cbcad-ee17-49d3-80c1-ae9e4d8a5206", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448097, "uuid": "1f542efd-f33a-4b71-ad78-ce8adecfb9e8", "value": "3072:n0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:GpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618448097, "uuid": "f7626d82-00ee-4eb8-9c31-668e32474bca", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618448097, "uuid": "92acfdf0-5214-4d53-af7e-b5009504f613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448097, "uuid": "6313a009-602d-46c3-9528-e743403a5013", "value": "492bd3c2282142e5d74f4aa6dbaabbc235f11785366f342502c7fbdd2f2ba655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99678570-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498950, "uuid": "0c964a4a-71ff-4caa-94c5-de318d850b19", "comment": "Malware payload (Dridex)", "value": "b1353e6dfd9fc4db15f7d1c9f64effd9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498950, "uuid": "d5f770c3-89c1-4249-8008-6a5758ff4323", "comment": "Malware payload (Dridex)", "value": "49585a37237ba02e8d26ca45a4e2edc987858eff5508a53b184311c6f6bca470", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498950, "uuid": "3a3c3c56-75b9-4f29-9669-2e07583e1834", "comment": "Malware payload (Dridex)", "value": "66addcbe925d73e3cceeb88dc7e2ba454da53b25", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498950, "uuid": "8e216b53-75b0-40ac-bb31-c934579f744b", "comment": "Malware payload (Dridex)", "value": "bab5dd579404f071311ea2a25980c58f96171b49cec2813cc5d9ae8fe251c20c94c7ad7cfbf55107fe5f341042422688", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498950, "uuid": "90da4b5a-be5f-4a4d-b06a-eb2aebddf414", "value": "6BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498950, "uuid": "86b025f1-879d-4ada-bb8a-9eacd95e2721", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498950, "uuid": "75438798-fc67-4ea1-bbf0-a0e413d074ac", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498950, "uuid": "7826d749-b383-463d-b3ca-8e6f76c5b591", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498950, "uuid": "128de90f-21a1-451d-8749-47bb9ae6ea38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498950, "uuid": "179c10c0-b657-4c9e-b78f-ce00c2e783bc", "value": "49585a37237ba02e8d26ca45a4e2edc987858eff5508a53b184311c6f6bca470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236a666e-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515932, "uuid": "6ada990a-d532-4144-b246-26c18920ffcb", "comment": "Malware payload (Dridex)", "value": "1e820eeb8502af45c0d50390a336c430", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515932, "uuid": "6563c61e-62f6-44a4-b2a0-c1cd3fe96094", "comment": "Malware payload (Dridex)", "value": "497aa71ba37b9d89b8975db9990b37cb5ea15ede30ada69a98b7b37686a73d1d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515932, "uuid": "8d1f77d3-8476-4756-9827-21adf42de181", "comment": "Malware payload (Dridex)", "value": "367cde2cecc96a69235d945ccb39db69585cc4a9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515932, "uuid": "91b5632e-ddba-486b-a508-4579fbd80f0f", "comment": "Malware payload (Dridex)", "value": "0aecec83a31e31a7627f05de18ae9e71dfb46afc3316663b9d35a66975ca0c1b4fd10e635cc4227a64218689a2338556", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515932, "uuid": "912c52bf-cc15-4e38-8ec0-dc92ea53248b", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515932, "uuid": "d7440eb7-a636-44a9-a849-b124073a1c7e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515932, "uuid": "f48a9c05-c03a-4e17-9547-26b16de7706e", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515932, "uuid": "f43b5510-3062-4770-8ff8-97b47007e471", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515932, "uuid": "3970fc02-30e5-401c-846b-2463e115be4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515932, "uuid": "eefa35fb-b547-4a5f-b117-732de235de4e", "value": "497aa71ba37b9d89b8975db9990b37cb5ea15ede30ada69a98b7b37686a73d1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8135d5d8-9ddb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618485165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485165, "uuid": "697eb7c5-c11c-47ba-8143-9326aa26306f", "comment": "Malware payload (Dridex)", "value": "d7ce796be7e15d9e206ba9ea8b524c06", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485165, "uuid": "a83fbe06-a341-4fdb-bc3c-8a9942878147", "comment": "Malware payload (Dridex)", "value": "49d34655545133ebaf24c57898f175359670350a7323ecb070eaeeca5f9ddbcf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485165, "uuid": "cebf2add-f788-41cc-b5e7-b14cf7b894a1", "comment": "Malware payload (Dridex)", "value": "8e38cef6b79f72fd03310aecc268df6181773c2c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485165, "uuid": "48ab3ff5-a903-4ea0-8577-c27d673f48c9", "comment": "Malware payload (Dridex)", "value": "1424dc4bce55199cae95f465d98cbf56c1be848c6336a5825ffef182f5dadbf4f7f61a76cf21512c106d86d77b491dee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485165, "uuid": "71e9ac6e-90e9-478c-936e-4aed01f66456", "value": "F0249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485165, "uuid": "21c93831-c18a-432e-bbde-0cf60db2977f", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485165, "uuid": "54dfae52-c105-4e80-bda2-8882e216ea77", "value": "3072:v0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:upepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618485165, "uuid": "fe2f9f7b-9cc7-4d07-804b-4246be760eed", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618485165, "uuid": "3ce02116-167e-430f-bf39-017aee950db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485165, "uuid": "ae9ee22d-fa3d-40f0-bcf0-502fed45181b", "value": "49d34655545133ebaf24c57898f175359670350a7323ecb070eaeeca5f9ddbcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8df0e6-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "2a574ff4-a3ca-40c6-bf16-426c9ba4406f", "comment": "Malware payload (Dridex)", "value": "35beed4b33f32dbc791fd9bffaf40ca9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "78dc65a6-ffc1-4189-9a1a-3df39b373dbd", "comment": "Malware payload (Dridex)", "value": "49d38f1c5f64820a1fab165e3a9489159b05400388b87d04cc5d108b949ca088", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "87627c4e-f5a0-4358-9dad-1b27560e7a50", "comment": "Malware payload (Dridex)", "value": "724c3892ba090d3bf0c02bf35108651ea34c5b40", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "205e3d9f-ee76-48b0-88ce-45c8570f2f8a", "comment": "Malware payload (Dridex)", "value": "e1057a0919a8925189890e5d2f1edd021bda827549f2e415407c2e95ffca6aec872d0debef08c295341ef70686c70c5f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "bdb58123-e459-42a4-8e55-2003cc77a8ed", "value": "ACF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "abd00bcf-5322-47b6-8b6a-d759303aa7f5", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "5ab31ff9-2256-4e77-956f-5e6efe177bf1", "value": "3072:wA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:w3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464169, "uuid": "aca9124e-b9f7-4bc5-a0a9-32eb045d99e6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464169, "uuid": "1007364c-0d04-438f-a8fe-d7d35dda1605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "338db55d-8b53-4266-beb0-3261141734c3", "value": "49d38f1c5f64820a1fab165e3a9489159b05400388b87d04cc5d108b949ca088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6386b492-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618514321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514321, "uuid": "85bc613b-7870-40a2-899c-7f8f1bd8e23a", "comment": "Malware payload (Smoke Loader)", "value": "ebf1f2545f4d56934b70ee736283a82a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514321, "uuid": "09bd7588-e48a-4a87-9711-b27fd4bd1535", "comment": "Malware payload (Smoke Loader)", "value": "4a3edbea57e335f6b08ad17812f1c4746d4b6741546f1c497a3b809774f81d1d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514321, "uuid": "cf964490-e471-43ec-9915-82a2efadb781", "comment": "Malware payload (Smoke Loader)", "value": "0015da9c77c451f9bcae368b40310173b40833fd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514321, "uuid": "3d7b70a9-fe89-4574-aec9-5480c0aa2057", "comment": "Malware payload (Smoke Loader)", "value": "1b948d2841a8fbc531dfbedae94d53b96b7b12a6f68b6b3b49cbf7b367bfecab8ce089616386db5592c0a1edd2f34cfe", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514321, "uuid": "cfecbc2c-5a1d-446f-8ef4-3ccd549a688f", "value": "EB65D0F472409CD2E7AA5EA29945B88C2267F13A9DC458CCF00BF7B12BB7B45DE1C854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514321, "uuid": "32c524d8-e55a-4c5b-a23b-5fe5250e1813", "value": "12288:2PqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqBPqf:2KKKKKKKKKKKKKKKKKKKKKKKKx5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514321, "uuid": "a22c9dac-ea12-4175-938b-2bd5b69508ee", "value": 1444331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514321, "uuid": "19c54959-6c5f-4b0d-9032-bf835db5f53d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514321, "uuid": "6a5d3c9f-5770-4296-a3a2-45b760d09adc", "value": "TT-2021ME04LO15.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb835e44-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496108, "uuid": "2c6a55e4-d1c1-4de0-a099-0d5e0e74b17e", "comment": "Malware payload (Dridex)", "value": "1a22b99d3e3a3b7c1309c06b3d5e958d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496108, "uuid": "edadd5eb-ea76-4db4-87fb-6322607cb8d9", "comment": "Malware payload (Dridex)", "value": "4a9927c6fe4f56e147e554efd77d7ab68c275443e4531726028b31956fd549d8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496108, "uuid": "0bb56fc4-7d48-49a3-b0f3-b4861ad49b5e", "comment": "Malware payload (Dridex)", "value": "10905ebd55ca08d8f9e50cb2e5892933e371e662", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496108, "uuid": "a0e6c8fd-1992-4cc2-92ba-69d3d1769971", "comment": "Malware payload (Dridex)", "value": "57a8a6c55e4d406b41c94341cbed6e7ad42c929d557c4c0376e5f7bd7582c8db5bfef0eceab0b267f2ab4aeacd152821", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496108, "uuid": "0623ba49-d801-4e0d-880a-968a74fdd12d", "value": "C3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496108, "uuid": "c0b29c8a-deac-424d-a4d3-cfd829386d11", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496108, "uuid": "798d9369-c5eb-4e75-b337-858dd4566c8c", "value": "3072:TA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:T3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496108, "uuid": "c13d92e9-96dc-4d8d-ad1d-1fd429e44c0e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496108, "uuid": "ffde23f0-882d-42be-9ad3-8445e43a0d21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496108, "uuid": "1fd95497-6fe0-42fa-b78e-ac2d5eba1096", "value": "4a9927c6fe4f56e147e554efd77d7ab68c275443e4531726028b31956fd549d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcbe90c-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464567, "uuid": "6185dd5c-7445-48cc-a5a4-78900066221b", "comment": "Malware payload (Dridex)", "value": "0e07be7a3f96ec81eca7b8d90669e7f1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464567, "uuid": "43bf7216-7c75-473f-8fae-7784198ab513", "comment": "Malware payload (Dridex)", "value": "4ac0829bbed785eae01819728e410a1a9e14a10b5b1ba3a6cd59609e5e3f21ea", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464567, "uuid": "0a7e0527-bd4a-42b9-b5d4-f97279fd36ea", "comment": "Malware payload (Dridex)", "value": "1062bf5ebbd60f8f10703c446ca7007e52342936", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464567, "uuid": "abefa552-0a03-4d27-b4fb-e00633b57d1b", "comment": "Malware payload (Dridex)", "value": "ba8e12fd3a2b5681f8e222aa7a926c327a7a24d590eabff72e69c8161e3a8ee1e36239f16ad541a2125cfa6a980a8622", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464567, "uuid": "2d25ff2a-eaa3-4729-bdc2-12117cf12bf0", "value": "3B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464567, "uuid": "8b32b008-edb5-4c9d-91ee-b935d9837a7d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464567, "uuid": "c32d637d-e710-4b8d-851b-828e564cb87f", "value": "3072:y0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:xpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464567, "uuid": "31f9f7f6-6d50-4c5f-9742-fe6ceece4ff8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464567, "uuid": "e041e5a2-b9db-48f1-960c-38e4ff820aa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464567, "uuid": "6c8ceea6-3a83-4f69-8071-8e6ff50bfc36", "value": "4ac0829bbed785eae01819728e410a1a9e14a10b5b1ba3a6cd59609e5e3f21ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d17feef-9dbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618471253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471253, "uuid": "7907f10d-23c6-422f-968e-ddc2500b2292", "comment": "Malware payload (Dridex)", "value": "51c3fbb08959cc328f02f691a42646cf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471253, "uuid": "02792516-6e63-427d-b29e-640fdb532926", "comment": "Malware payload (Dridex)", "value": "4b50de88cdfe801eef5ceffcb2a955f3848e93c751e6a060f6c369bd7fd341d4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471253, "uuid": "b093322f-7f4e-4c67-84aa-617027d7e7cd", "comment": "Malware payload (Dridex)", "value": "5d3397463cfcc3349f60f5400248196b80b1f02f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471253, "uuid": "6595f564-3b23-44b8-a4b8-e873ec138e82", "comment": "Malware payload (Dridex)", "value": "92c9ad45d87af979ad30d2b920c822b07a3c80702a7feba6cf55fa757bddc26c2ce6e3e5bd1bc24f27bba83064ef774b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471253, "uuid": "0feb368b-03f3-49fc-a003-3ee06b0ad5d7", "value": "DEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471253, "uuid": "36c79199-70bb-4659-b492-31a74a83e3bc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471253, "uuid": "0de00185-1859-4a26-9d73-9a429e5db843", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618471253, "uuid": "4e0a825b-9643-49fa-9198-498fa21c3849", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618471253, "uuid": "683cd7db-c3ab-4ec1-88c2-d585de7744fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471253, "uuid": "bbe2c256-ceb4-4d87-b077-bd808835a18c", "value": "4b50de88cdfe801eef5ceffcb2a955f3848e93c751e6a060f6c369bd7fd341d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a44aca0-9dfc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618499166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "2a614d01-2d38-4e95-960a-9d0f1e9d5520", "comment": "Malware payload (Dridex)", "value": "3caf7c670d41e80c9ca6d24ad068b439", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "80184b87-b1e9-46f6-9a5d-0fb877d4e996", "comment": "Malware payload (Dridex)", "value": "4b610cf9cb82533970b694cdd560918b9b6fcc2082807e644a949d7b4f792dd4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "0ae00e0a-23ec-4cb9-9679-40fefb1bdca0", "comment": "Malware payload (Dridex)", "value": "de0673a55026bebb8edb2a8d6f9d679684ffa3ec", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499166, "uuid": "63e2e664-a1d4-40a8-9e10-769e4550d322", "comment": "Malware payload (Dridex)", "value": "4326a64cdd6bb8af5ccc719f7842aec658341cb0d6bb754ddf681abb6095854fdccd8681367594c11586166e2a9f08bc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "c25da16b-5490-4416-9daa-64bf33f6333a", "value": "3FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "ce48ea19-a7cc-4757-96d9-5afeff23b940", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "56834ce9-791f-4934-a95d-a708cd5e77ff", "value": "3072:EiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:HeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499166, "uuid": "ae432e7d-91ac-48c2-b5cf-f6e8dd760f15", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499166, "uuid": "e43370cc-cfe0-4969-ac9d-87dc62785e65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499166, "uuid": "f3197b1c-85cc-455f-8887-539304df51dd", "value": "4b610cf9cb82533970b694cdd560918b9b6fcc2082807e644a949d7b4f792dd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf46e1af-9dbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618473243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473243, "uuid": "3c48490d-20be-4c69-9556-f2be858b8692", "comment": "Malware payload (SnakeKeylogger)", "value": "1a85350c8bc9c7f72933ca3925f3b193", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473243, "uuid": "7f77975e-53e8-472e-96b1-a77853782b29", "comment": "Malware payload (SnakeKeylogger)", "value": "4b68616d6e2cd67db58b8386626fc23fce4e35ef6a9fdafaf6269a4e475df507", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473243, "uuid": "87a9fb3a-d8a3-4b97-9677-dec007ed6ae4", "comment": "Malware payload (SnakeKeylogger)", "value": "6314cf3d21230aadd1666d5ca4ac28ee68d64e36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473243, "uuid": "4987cb79-ed64-4a31-b0a3-513504315aa3", "comment": "Malware payload (SnakeKeylogger)", "value": "3f1b749c6f4702a33e4000ef45331fb9c7fcefc30496a5c2c19d40dc8cb436486b55d8d09be6346753e542d73b50bc1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473243, "uuid": "2c7d461e-527c-4415-9aa9-7191d6d4b25d", "value": "1615BE3932F09301D43C023653E1D22857F16F59DDE2D30AEAB819E9B762EC56B4668F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473243, "uuid": "78564ea1-0da1-49fb-b6fe-c4ea430366f2", "value": "12288:dTkP1zuA4YcAmd/rKn7S1Xr3iD5oRLj7va5He4i2J+ccOl9NVI2q1Kmnf:dTg4YcDdOe1eGLj7vaA5QnnNCIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618473243, "uuid": "0950b4a0-8263-4b81-b79b-3f180239ac9c", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618473243, "uuid": "18ce95b8-11ce-40f7-99aa-d3c4bea16f56", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473243, "uuid": "4aa93419-84d7-4232-baf2-c922184b7a7a", "value": "Neues Angebot PO-765465_785664,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b170a602-9da8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618463342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463342, "uuid": "e91b95bf-0409-4446-84a1-f8853f9d2fb8", "comment": "Malware payload (Dridex)", "value": "75443b50fddade04ef1885432de85b9c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463342, "uuid": "2989cb79-a0c7-47bc-aba6-729202081364", "comment": "Malware payload (Dridex)", "value": "4ba635017ebaae8281276bd6c371c473488b1a926748f50dccab3cffffb24bcc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463342, "uuid": "686dedb7-9efa-4d38-b27c-74b37d89c322", "comment": "Malware payload (Dridex)", "value": "7cb8a6fb786edb2fb5c54f6334a698da91b377c7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618463342, "uuid": "6a9c77e5-f7fc-4437-9c38-8b4c92c26dd9", "comment": "Malware payload (Dridex)", "value": "c33aae8d2228fde2bafa1e7c5e1fcb7a1ad22b46e39cde0a5a4cb9103479cf72a085c7dc9e3a96cf7d2ac1c8d90934d0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463342, "uuid": "4c05a2d0-25cf-41fb-8ca1-a804f0e7eaf1", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463342, "uuid": "ce27f28e-9090-4c1c-b607-b84e86552b77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463342, "uuid": "73883f28-aed9-49bd-88f4-9608e7f95356", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618463342, "uuid": "b9298fe5-06e7-40b0-beb0-500e07b4651d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618463342, "uuid": "606f05f1-a321-4966-8796-31be9887a51c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618463342, "uuid": "1b5fa1bd-5802-4c71-bbda-dde94ec600a1", "value": "4ba635017ebaae8281276bd6c371c473488b1a926748f50dccab3cffffb24bcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5a5a09-9dba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618470958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470958, "uuid": "8d4d317d-4b00-4158-b6d3-27114b5a9665", "comment": "Malware payload (Dridex)", "value": "5e0bfbf3a4b31e5152d2adc0be5429d5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470958, "uuid": "1422f1eb-e199-4c5b-84bb-d046720e859d", "comment": "Malware payload (Dridex)", "value": "4bab9b4bc8882654b5b6ffc9effe26344485349b3b3aae1ad7867dcebb7b5ab9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470958, "uuid": "c426aceb-ef16-43e4-92fd-cb87f68458b9", "comment": "Malware payload (Dridex)", "value": "fb14b47b383133be6c662b52a80b8cff9ee41a90", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470958, "uuid": "ec586b43-9b78-4c9d-b2b3-8eb27a4a42dd", "comment": "Malware payload (Dridex)", "value": "c61cd292ce204bd87817c3abca2816e43c4b48e66d379fec3aa9211023a6bd99cb33f2242c2724a5148b89fe3924daad", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470958, "uuid": "63872314-a5ca-4cf9-805b-0efec5872681", "value": "C7249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470958, "uuid": "f16f5f59-6ade-417d-9179-c237b9d766ca", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470958, "uuid": "2994ce7a-d04a-4661-8c30-7f64a35d49f5", "value": "3072:B0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:UpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618470958, "uuid": "16b11ce8-d4f8-4b83-b363-09dce6f466df", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618470958, "uuid": "364a448f-167f-48ea-b584-fc9f4940a7b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470958, "uuid": "48ccfb49-42d6-4bd4-aade-0a7cff00e001", "value": "4bab9b4bc8882654b5b6ffc9effe26344485349b3b3aae1ad7867dcebb7b5ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad36dd10-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618514874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514874, "uuid": "c63e8395-2e56-4618-96c3-7e6443a76541", "comment": "Malware payload (Dridex)", "value": "220cc96685aa2dd04984b75262998cb8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514874, "uuid": "f85e3b15-1186-48e3-94cc-3c24f54ce60a", "comment": "Malware payload (Dridex)", "value": "4bae351332400e9979fde50005721aa9b34622a49e98d90506e7b1098c16abb0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514874, "uuid": "df199e01-2404-4b49-94bf-caa8028ea682", "comment": "Malware payload (Dridex)", "value": "5a63c72b19bea037b7c0960d29736d57aa774a6c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514874, "uuid": "97d982b9-2270-4d37-82ad-52a76ac274a1", "comment": "Malware payload (Dridex)", "value": "a66c92dcdc7fd4729bc341fcff11c1f0779a0eef825c42b16eef2889d819b1b677aa8ad7f0b043eb83f9d5f1c3684698", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514874, "uuid": "c4631ef8-51d5-4bb2-9165-886f8b00e362", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514874, "uuid": "18258f8c-c758-4398-8843-d88019ee3709", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514874, "uuid": "eb10bb72-da16-4e78-864c-117e8cef1b6b", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514874, "uuid": "57cc8366-a849-48bf-8b4b-9897870319d4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514874, "uuid": "a84d01be-11a1-4a59-8846-de55e76f8dcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514874, "uuid": "550b66f4-8033-4351-add1-700d8bdd1fb4", "value": "4bae351332400e9979fde50005721aa9b34622a49e98d90506e7b1098c16abb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d34afb1-9e36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524216, "uuid": "10f26ab2-6e2e-42a3-aca3-f9d4a4c663f6", "comment": "Malware payload (Dridex)", "value": "61ef4b8646ce44a2faa8f8b89b484fad", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524216, "uuid": "69b481ab-1cb4-4f59-a487-dfb810c3854a", "comment": "Malware payload (Dridex)", "value": "4c351281cf9b7cbd631cfc3254b09108bc12625b06d6e65e2938b68930144846", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524216, "uuid": "80ce17dc-e9d5-463c-9a07-c9dc51bd5cb1", "comment": "Malware payload (Dridex)", "value": "855e1ae7ef6d23d17daacb92d77679bbaafb11e4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524216, "uuid": "11fa7a20-02af-40fb-9e21-3811e994c580", "comment": "Malware payload (Dridex)", "value": "6515ea5ca1fc6d8f39f39fad5756eb978c4e3fe2ce1d062e9299512c1f81d3f025dbb265fe20384954d9bc04c7305dee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524216, "uuid": "cf5f3b7e-2022-4d22-8c64-7dbb6558cb81", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524216, "uuid": "efd68fca-f732-43f7-8672-aac3460923e8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524216, "uuid": "33637a56-d6e5-41fa-9f4b-4b879999e649", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524216, "uuid": "bfc1d15b-efb0-4f78-b5ee-55b6d2734b09", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524216, "uuid": "341eca67-1df9-4d28-b603-0c4ef3f868b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524216, "uuid": "326c8828-e04e-4326-b3d1-707fa2b5a21a", "value": "4c351281cf9b7cbd631cfc3254b09108bc12625b06d6e65e2938b68930144846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf1e99d-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618514500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514500, "uuid": "3f76ef8d-8a0d-4c88-8629-ad650c1718ef", "comment": "Malware payload", "value": "5b713cf6a3bdc7d6e368764739e9fbe9", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514500, "uuid": "bafb7fe9-c7d3-45ec-b89c-9638b10ee128", "comment": "Malware payload", "value": "4c5355aa82dcbf39f36901a2b4018323d76704646959f1204e15163a61f534e3", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514500, "uuid": "f651c1af-0bac-417d-a542-8a829123e6dc", "comment": "Malware payload", "value": "4b420a8c5bbe39c39216ae6e5ea76236a24dada2", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514500, "uuid": "609ebea6-5165-496c-b1a8-d3d8e77f6b94", "comment": "Malware payload", "value": "019b1174fadb8d3095b09034eee504e6e118817d38e8e8dd1df662bd1d31a2ced009010c9a5bc1507903c5ef69ece756", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514500, "uuid": "37c7f5cf-6f08-4918-9903-30aaebed88e4", "value": "3C51A71AFC47D15C9BB9236BDC978962FF1B811B9DA2104C71DCC2455F3080996ACF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514500, "uuid": "7945088c-a9cc-4925-837c-f5c551608826", "value": "48:AxX8iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozl4X:tGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514500, "uuid": "d53497ee-01ff-4ad5-ae56-d25d914bba83", "value": 3085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514500, "uuid": "1f4e2e18-e4c3-462e-ac19-c8e48135f820", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514500, "uuid": "97bcaa4e-77a3-403d-8363-87dd64eebc1c", "value": "gDtk3epJ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549cc2e3-9dee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618493251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493251, "uuid": "af562b77-2732-475e-95ed-8d429baeb2b2", "comment": "Malware payload (Dridex)", "value": "f74ad55bfa220c0cbb8d7455724ce9a6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493251, "uuid": "3f666570-4e18-473b-95dd-eb05ae3151d9", "comment": "Malware payload (Dridex)", "value": "4c87290b48ac53e035498fabad32e4e5ca76edbc071ad987e8b335f564cf2763", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493251, "uuid": "4360f421-ca7d-4df2-9141-50f595913c67", "comment": "Malware payload (Dridex)", "value": "cc70bf19d5801e40c3c6942477cd46e73914050a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618493251, "uuid": "3ba559dd-3282-43b6-8a73-8f6fa11680b1", "comment": "Malware payload (Dridex)", "value": "42bb0f69f2d4b03f4d8a6929e9f1c8c7f11bee2b85b2f8af99682eec678427551f1315d84486eaed455acbfbbee196fd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493251, "uuid": "265ea899-23b3-49b7-914b-7bd08d3c4031", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493251, "uuid": "51763248-31dd-4ac6-b555-aeb2b52c06e6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493251, "uuid": "43d9f613-a1ce-4614-8749-c54673657541", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618493251, "uuid": "1d9564eb-40b0-4c25-9d3d-2cf8c9fd64c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618493251, "uuid": "6b733bce-afe8-44e7-910f-bf04ca3f5c2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618493251, "uuid": "8903c81a-71a3-462c-950a-43c2e357c2df", "value": "4c87290b48ac53e035498fabad32e4e5ca76edbc071ad987e8b335f564cf2763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fd2afa-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496607, "uuid": "b3968f3e-b4f6-4de6-ba3e-22ce186bc27e", "comment": "Malware payload (Dridex)", "value": "dc73c7b3ad49f21ebdc3b4d246f4aac2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496607, "uuid": "8378b67c-8055-4b22-8c96-875942b5229a", "comment": "Malware payload (Dridex)", "value": "4cd35fc7bafe378c10be2eaa6c1ac4bcb6d72debda6f8395b2bd6c29f04b3339", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496607, "uuid": "37f51a90-a04b-4574-9a00-181005d0c3b9", "comment": "Malware payload (Dridex)", "value": "5aff7753998551d71b5816034186730ef75ccd06", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496607, "uuid": "402da6de-c300-44c9-997d-b51108369cea", "comment": "Malware payload (Dridex)", "value": "9b11fb84b085b7e98ca1af45e45ba5c7d507a683c499d6e106aed006609a8f070789a0c751c20b0d5bcc0cb085bfb29f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496607, "uuid": "bc32cf71-1f3b-4ae4-ba8e-5570733bb59d", "value": "6BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496607, "uuid": "6408e61c-2112-4aec-841f-c9f56a7bfaf9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496607, "uuid": "1300d31d-73ad-4d19-92fa-3d9a02908f8c", "value": "3072:2A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:23J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496607, "uuid": "ad53ea25-6cf0-41a2-a755-a6cac9fe395e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496607, "uuid": "9f19c1f9-4896-441c-a9fd-6a4a9df2f922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496607, "uuid": "f7741dea-a3d7-40d8-8bf3-a6dc068b485d", "value": "4cd35fc7bafe378c10be2eaa6c1ac4bcb6d72debda6f8395b2bd6c29f04b3339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137809b4-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "d94be27a-4626-417f-824e-642c748ca9ea", "comment": "Malware payload (Dridex)", "value": "18a499eb1af7f06e182ca5c7bfbc2944", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "b9d07d67-63ce-40ff-900b-c0d3f00d465a", "comment": "Malware payload (Dridex)", "value": "4d095e3322f77b4146f6185d4ca45fd4f0923d5a5594f3119c9507553364e9b7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "4e896c52-0a5b-4542-b751-f999198e1478", "comment": "Malware payload (Dridex)", "value": "4435e08424315f58a0a35b7e1af252ef477da5e0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497007, "uuid": "e3a3a33b-2fc4-41b9-a871-b8828f180a33", "comment": "Malware payload (Dridex)", "value": "f27ea5efd7894a3db0846e185ee59ed3f90b5e9f887b0fbdd0fa2c85aaf1382564e9d9e868bc916c1fbe456e88ced956", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "9321da76-a1a2-46de-bb3e-375fdb4aa49a", "value": "4EF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "3915829f-fcc6-4798-a138-b024a8935f85", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "090bd8e7-dc3a-464a-ab2e-5cb4975a1737", "value": "3072:EA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:E3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497007, "uuid": "0bc55635-e8a2-4d73-9b1c-c26235bbab8f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497007, "uuid": "5c494144-2a6d-4198-86c2-19bb81cb5ed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497007, "uuid": "bae1812e-ea52-4e08-840c-c0d7121e771b", "value": "4d095e3322f77b4146f6185d4ca45fd4f0923d5a5594f3119c9507553364e9b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ed0862-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "f741ca74-c116-40ff-b24c-9b3e49decbe2", "comment": "Malware payload (Dridex)", "value": "bd38f58ba250b45506b2448ec958d3f6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "e24c37c8-ca2b-4294-938c-a9cd086bbbef", "comment": "Malware payload (Dridex)", "value": "4db1e0c6734f175e1527cd36160b9d4b53c661bccd22f88bce54660059f81098", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "ce93dda8-2cc6-4fc7-9d08-28c42fdb98c3", "comment": "Malware payload (Dridex)", "value": "488593bd5e43f0db409851c3312336856a673c6c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497494, "uuid": "699fddd1-cded-4e05-a476-d1730628fbc2", "comment": "Malware payload (Dridex)", "value": "7d39b51e04cd0d6ba0efeb689906aecb42b46b01abfea7ba2e7ca0976f85efedf4ba3af0969180d9ca7c9c8e26990a12", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "fc4883c1-b634-4523-b758-d2931d4417e0", "value": "BEF3E00AED9FEA88E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "8fe99838-d53a-4c62-b2d8-70fd1c8062ad", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "5c9b7a70-f390-4411-b9b0-f999f8031a0d", "value": "3072:xiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:CeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497494, "uuid": "528c5deb-ce45-4631-863c-293e1cb8a0c4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497494, "uuid": "020b3133-84e6-468d-b6ea-f690ab662b49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497494, "uuid": "fb490282-bf1e-41ac-ab7c-fd3c2ad91dba", "value": "4db1e0c6734f175e1527cd36160b9d4b53c661bccd22f88bce54660059f81098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9a889b-9de8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618490605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490605, "uuid": "0e6a23d9-77c1-4263-8505-ac7f23129425", "comment": "Malware payload (Dridex)", "value": "42f0f02feba346e0be5b2f6f9137ba10", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490605, "uuid": "dbaf41ef-6a9f-4d43-8c68-3c4c900dc774", "comment": "Malware payload (Dridex)", "value": "4db4cbb0c8688d4526351eb82a557b07bcbd35c8f99703e86104c17d588dc979", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490605, "uuid": "461e4c60-392e-446b-9a21-22db85567be4", "comment": "Malware payload (Dridex)", "value": "e41c7b86ff84eeaa4b33ac84e0482ac6946a47cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490605, "uuid": "a50913f6-7bb3-486d-a598-448b1112a4a3", "comment": "Malware payload (Dridex)", "value": "b8ba253cfa43db50eb84de109513080b6ea3fa7dce7f3aca5d31af0729a5065edbeccad0faeeeb3790fc0a101dfa514f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490605, "uuid": "d615414d-3795-4646-82ad-294ea3b69bfb", "value": "30F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490605, "uuid": "5038f90d-9d54-414d-9049-b39dce6a921e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490605, "uuid": "1d8121ce-f44f-43b7-9a29-4b0e3bd1cfd6", "value": "3072:kA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:k3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618490605, "uuid": "94b13dc8-3422-4c08-89e6-46c0610c17c2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618490605, "uuid": "21aeb9ec-c5b2-43c8-8d02-2060a442b7d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490605, "uuid": "7faba610-5991-4a13-90b5-f317a9a3e4c8", "value": "4db4cbb0c8688d4526351eb82a557b07bcbd35c8f99703e86104c17d588dc979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdad4271-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496111, "uuid": "f643b9f9-004c-470f-bbd1-f755c02fad81", "comment": "Malware payload (Dridex)", "value": "7d2ca3562ce5c9ed379c6c2fa0b200fd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496111, "uuid": "c9e0031c-6a1e-4ed3-9255-3313541bda9f", "comment": "Malware payload (Dridex)", "value": "4e4df9cb76487f986476b78b76afc36dc10188c44839d562bf6344a6ad8e023d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496111, "uuid": "523b7f1b-3887-4e64-baa2-cff92139da29", "comment": "Malware payload (Dridex)", "value": "bf01d38c6e792be165b33e4f2efd4704d467db66", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496111, "uuid": "d65fae8b-c3c3-4267-b5f1-e2e8f49b8e92", "comment": "Malware payload (Dridex)", "value": "478eae89e1c2254771fe5c97840a5640d487ef74168a5ab91b6e49678d5b319dd6faa0f7b4e90e044cb37131d57f4e34", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496111, "uuid": "361299a0-c5ce-4d28-a40b-b7480619f2c6", "value": "5FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496111, "uuid": "8f43215b-d174-4af9-bc79-d129b6656b52", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496111, "uuid": "05665194-09d5-4e03-b93d-046f6d791284", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496111, "uuid": "eb60b1e1-171a-4bbd-a9bb-17a010eec2d3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496111, "uuid": "3cc10d87-36f8-4cc7-91e4-fc1e0278322b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496111, "uuid": "72544584-94cb-4c94-8321-565b1f0d5b7e", "value": "4e4df9cb76487f986476b78b76afc36dc10188c44839d562bf6344a6ad8e023d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1244a440-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "78a84915-75e5-4717-959f-1600105f681e", "comment": "Malware payload (Dridex)", "value": "4b7011b38b5d2e9874a1af8cb480b625", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "ed934c9f-5529-4df7-820f-0c9d36d1da99", "comment": "Malware payload (Dridex)", "value": "4e4ee72b1209759cf682f3a68670d46356fa22a669dc92284d2e2b5abebe81df", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "0803dc60-ebef-4a4d-a13c-49acaa0565b4", "comment": "Malware payload (Dridex)", "value": "0c789e8deb492b3f32c2d82c8073b59705122e16", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496575, "uuid": "da929e43-43cc-41cf-9851-099f6e1e14e5", "comment": "Malware payload (Dridex)", "value": "fc9e2aea0be26b90790c4a52cfb68c5b28c6f4ac6b285662acdada2710c1ced2286183006af40ed5f316fc721d15805c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "c2414026-2d10-4ec5-91ce-3f111125fbc2", "value": "4CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "1dacbe5b-cb11-47ac-aa8e-ab0435cb51e4", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "015acf6c-c37d-40d9-b8e8-26ff400c3aa6", "value": "3072:CiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:BeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496575, "uuid": "0b1ee050-9eec-4fbe-85ed-3b3f68b0db84", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496575, "uuid": "74814089-e2b4-4fd6-a047-4674bf25fdb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496575, "uuid": "5ba45c27-b1a7-4288-8926-d8df6102c0af", "value": "4e4ee72b1209759cf682f3a68670d46356fa22a669dc92284d2e2b5abebe81df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a80338-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496017, "uuid": "822a0661-74fc-400b-aa5f-6ba08094d21c", "comment": "Malware payload (Dridex)", "value": "e60170e36e68fcf0fa96d3d11b55d2a4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496017, "uuid": "23f5f417-5fa3-4c6e-a544-2e4986ec52a6", "comment": "Malware payload (Dridex)", "value": "4e626cef36dd4bfa3c9cc0443ef80a62cd0911e9526385bbe0df10913fd0eea0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496017, "uuid": "705e23e1-5c98-4418-99c4-968a059a2ff6", "comment": "Malware payload (Dridex)", "value": "0df25e6c2cc69edb00267c3eb0d0a282bd3fcac8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496017, "uuid": "936f5aa0-68c4-4c5d-99ba-8c98a5fe7d7d", "comment": "Malware payload (Dridex)", "value": "bf94022a91478468eda072a0bfe4efc5546c1cb059507ea95301e46f08472f39a71487a766c66fe4b2943912695ef671", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496017, "uuid": "9d99fa1f-adb0-4424-af4e-b71a372d9609", "value": "20F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496017, "uuid": "539afd1a-2d45-443f-aee4-7c055acf8f14", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496017, "uuid": "2f927710-63e1-459b-9b08-5febd884a926", "value": "3072:ZA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496017, "uuid": "f5bc0d26-639b-45eb-b8be-aae88ecc2068", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496017, "uuid": "177b9541-56d8-402d-8918-e9ac603b8d79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496017, "uuid": "3f24384b-bd5d-458b-aca6-349de5bd5658", "value": "4e626cef36dd4bfa3c9cc0443ef80a62cd0911e9526385bbe0df10913fd0eea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ff623b-9dca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618477842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477842, "uuid": "752a4387-5b83-4bcf-8ad2-b637f691a079", "comment": "Malware payload (Dridex)", "value": "e99da99a218274c7c7499d447404e4bc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477842, "uuid": "c0853a5c-9968-4a7f-92a3-35dfbf8be49d", "comment": "Malware payload (Dridex)", "value": "4e7e1d3f82d3221fefb48dc4034730828a62bdcfaf3f25fc697c9b1a3719a410", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477842, "uuid": "14fabdf7-a46e-497a-8937-a20be51ffdb0", "comment": "Malware payload (Dridex)", "value": "c0b63feaef80f630c6b37d5de279fa958853aafa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477842, "uuid": "98cf6e86-d030-4964-9704-b32484e2233c", "comment": "Malware payload (Dridex)", "value": "eb4a0284271f8b74caf8fac99d67b0bb40a6eaf8234d82c9fbe9bbe57d1b2ef5ee48270e2552e84c90f4da9945375d24", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477842, "uuid": "dfc5f6cb-8a28-4f18-bcf0-60ad8aef8107", "value": "B4249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477842, "uuid": "1db99d00-998a-4bdf-9586-61399a1b344f", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477842, "uuid": "1c532258-f6e0-4039-a264-4bab1027c71a", "value": "3072:Z0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:spepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477842, "uuid": "7de41c0f-7a1f-4854-8bcf-d382edd708f7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477842, "uuid": "d51af438-a09c-4c55-862e-632e2cdf0034", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477842, "uuid": "b1e88a13-3382-4a54-9165-063615c0c5b7", "value": "4e7e1d3f82d3221fefb48dc4034730828a62bdcfaf3f25fc697c9b1a3719a410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b3beaf-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618523425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523425, "uuid": "23e143bd-01d9-4bb0-94b0-ff8979e79b99", "comment": "Malware payload", "value": "7f3a0c0a72b661ad8eaf579789530634", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldMax", "colour": "#C61351", "exportable": true, "hide_tag": false }, { "name": "sunshuttle", "colour": "#44BFD0", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523425, "uuid": "2d340f4e-1833-4259-ad1a-3bcae222fe5d", "comment": "Malware payload", "value": "4e8f24fb50a08c12636f3d50c94772f355d5229e58110cccb3b4835cb2371aec", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldMax", "colour": "#C61351", "exportable": true, "hide_tag": false }, { "name": "sunshuttle", "colour": "#44BFD0", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523425, "uuid": "135a10cf-6cad-431d-9bc5-0868b11fc69a", "comment": "Malware payload", "value": "d11a1fa8811781ad17253d47f23044994f691739", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldMax", "colour": "#C61351", "exportable": true, "hide_tag": false }, { "name": "sunshuttle", "colour": "#44BFD0", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523425, "uuid": "459eb3e7-cc84-4b46-bf74-bc21162c4eb0", "comment": "Malware payload", "value": "2e6f7fad84e9c670c55951747456afe73c8cc025c71e1e401d944e20fdacab2a46b87544956522466ff37158eb6df23b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldMax", "colour": "#C61351", "exportable": true, "hide_tag": false }, { "name": "sunshuttle", "colour": "#44BFD0", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523425, "uuid": "921234df-8c85-4318-bf88-565d275718cc", "value": "D1362B13FCA204F9C1BEE23486559722FA317899433177D35F949A962A26FE4BB3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523425, "uuid": "6f3d8351-320e-4c57-b026-ec40a78941b3", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523425, "uuid": "f30d84e0-6736-4b1e-aa3d-a8f921510a74", "value": "49152:YQ4uataXvwDOvdk6NDv0U/u3BT1OZutqIpYFDkciESn1KNJQvJiLxETsL0qoIqxk:L5gOwOq6NYbSZutqIpYIcmvpw7+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523425, "uuid": "ce961f16-b8b0-44eb-ba1a-e7f9a6298a15", "value": 5178368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523425, "uuid": "e3e6de74-b5df-46bb-a250-eae701fa05a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523425, "uuid": "696552a3-6fcd-4e6f-bf28-22d52fdd8d5a", "value": "4e8f24fb50a08c12636f3d50c94772f355d5229e58110cccb3b4835cb2371aec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2487cde-9db4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618468524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468524, "uuid": "05a6515b-a5a5-426a-99e6-2e9247cc4c2e", "comment": "Malware payload (Dridex)", "value": "3f12da0b4c6b27f9da0f0deb0c52900c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468524, "uuid": "7c00103e-421e-44ef-b59d-2da5b4358deb", "comment": "Malware payload (Dridex)", "value": "4ea43ed5fa9374c924c26e77af00e57307f3b88ecbc3681fc8ab62b9c12f58c2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468524, "uuid": "9b8fe907-09ff-40db-a2bc-fc4c28186a40", "comment": "Malware payload (Dridex)", "value": "15fa332a5f1be7c21ef75401052d20db0cd41aa8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468524, "uuid": "e02fde81-672b-4bf4-b907-9fb0f639b43c", "comment": "Malware payload (Dridex)", "value": "5486fcbd44b8f5ed7407413dc8261ac49a637b9529a301f6176a2b08bcbaf30703ce8e5dc22e2dc8695d92908f5a0c78", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468524, "uuid": "4550f2cf-e72c-49b5-a40b-9513df4e3fa8", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468524, "uuid": "afca7ed9-3c65-4314-9b02-31e5fb6ac5ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468524, "uuid": "111a985c-e5cd-474e-8bdf-20186deee6d2", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618468524, "uuid": "4abd0948-1afb-40d0-bba2-85506373bc47", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618468524, "uuid": "f0857ca9-35d7-4391-9d71-bd005daf47ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468524, "uuid": "499018b9-d194-4b3f-aedb-f68600b69a65", "value": "4ea43ed5fa9374c924c26e77af00e57307f3b88ecbc3681fc8ab62b9c12f58c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6061445-9dc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618476744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476744, "uuid": "aa809154-f556-4ea4-8ea2-77b5ecd17f6a", "comment": "Malware payload (Dridex)", "value": "f4dad06c6b45746379eaec377966d6a0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476744, "uuid": "2c6bd320-2c7a-4e8b-b3a6-7e8e6fd07242", "comment": "Malware payload (Dridex)", "value": "4eb18b950301e56f6978ba9cdd13ef07f67e8c5b83f1ed7b71e01776f89c0459", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476744, "uuid": "e0fcc70f-5134-4ce9-977d-b52e0555dc16", "comment": "Malware payload (Dridex)", "value": "9b79b57348fa27698bb20915bd00ffef7bd43817", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476744, "uuid": "9e7a1a7a-1dd8-4eed-bf8d-a62918b92d12", "comment": "Malware payload (Dridex)", "value": "3989e2649104c0ffb928ce2317cb1959a695bc31f3be482c30fa8d6f0ff787256a1f83dd7c67f036ec14ec06148cf239", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476744, "uuid": "650111a2-ac93-443c-b22e-51e366668710", "value": "1B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476744, "uuid": "5ee52a7a-3285-4b7f-a33a-4ee4a887b579", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476744, "uuid": "8bded4d1-0e67-4b23-a907-4ee38614f43f", "value": "3072:40DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:TpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476744, "uuid": "e0d056d5-8a39-4b0d-911d-858f09272e43", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476744, "uuid": "90052b08-aeb4-4e8f-a60d-39203efa2eac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476744, "uuid": "e486f532-e73d-4a9f-a8dc-db96c3b10ccd", "value": "4eb18b950301e56f6978ba9cdd13ef07f67e8c5b83f1ed7b71e01776f89c0459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e7d28b-9e08-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618504576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504576, "uuid": "81399bac-814d-4f4c-b938-8aead306e02d", "comment": "Malware payload (Quakbot)", "value": "cab7f624aa26f44412d8473a51f3890d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504576, "uuid": "ccb250f5-ee84-4fdd-8428-90421d8e164a", "comment": "Malware payload (Quakbot)", "value": "4edab06dcb7679fddfeee205145628302047f50862d7ee5818abba9f01b5a050", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504576, "uuid": "1e1640b1-fe69-40d5-8eee-821deca579a4", "comment": "Malware payload (Quakbot)", "value": "bca25889391980adf9a4e49fb806015499561ba0", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504576, "uuid": "13d82b00-5071-416f-9cac-6e58f5de1023", "comment": "Malware payload (Quakbot)", "value": "54c44059796b0878a91f994fbd1a11fbdd30820d2aa8f7f9e2591f67d4abccf74ed883bce457873ff2c4c685a04d87c2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504576, "uuid": "18da3f5c-8a96-4ecb-998c-a067da10a281", "value": "EDC3AEDCCD53E4D2CA51DF3E9609719914B8E4B73B1BF4166088823E1982E6D098FADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504576, "uuid": "01667c6a-658a-4760-90a7-45876e1f3b4a", "value": "3072:cOKybaf6JMcuaNB19ofM1xjy/YD6GQ8cl:cc2f6Jzuu9oM1lyu7Qnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618504576, "uuid": "9ae1fff9-dbd0-4ff5-9272-43aee19d2bae", "value": 122951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618504576, "uuid": "ce8fb7d2-f808-44da-a394-641896615b09", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504576, "uuid": "ec7615d2-5d19-4d51-a5de-cb0ad159aa92", "value": "catalog-641455000.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906f65ee-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "e61ee24f-0ba7-43c3-ba61-837a8ab9fd0c", "comment": "Malware payload (Dridex)", "value": "7ac91575f8d21b27c7c9de18e28470f1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "0031b73b-9bcd-43c7-a82f-6422ec6dc40c", "comment": "Malware payload (Dridex)", "value": "4ef9478f1b587ffc53f7d843ffb98d1fc7e3682ec9a16d394f050537933e709f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "51940613-a43b-452f-8f5a-90a46f73d692", "comment": "Malware payload (Dridex)", "value": "6da9a10be69a9d8f2cfe886deb45ab1375354a0d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "05d6c6b4-1818-4062-a920-92feb7fd19c9", "comment": "Malware payload (Dridex)", "value": "8a3e033cedb3151e90d487ee0220cc8f17f959a5cbef880d2704cfb4d985288c42f5b657cdc66fce567ce84d6aa4875c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "ca0ae37e-d784-4d47-bbab-5cf2cbdb007d", "value": "24F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "9b10e403-ee8d-458f-9deb-2e96dffe54da", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "cf0590ce-0ba0-4e3f-801b-1a5a387a4579", "value": "3072:JA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:J3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495928, "uuid": "21144d56-36fc-41a9-9f9c-12b697510fc9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495928, "uuid": "7f08df9b-39db-4156-9973-0d0e53623597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "db19a320-e513-4e28-b432-9016b770b25e", "value": "4ef9478f1b587ffc53f7d843ffb98d1fc7e3682ec9a16d394f050537933e709f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb952b9-9e15-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618510174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510174, "uuid": "76810a44-b41e-44e4-9f07-6c7337e3d919", "comment": "Malware payload (Dridex)", "value": "cfb0403ced912a014dc51466bb56965b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510174, "uuid": "101e7b30-45bb-409b-9a4c-26d7f1cf21f1", "comment": "Malware payload (Dridex)", "value": "4f024955bfe9c9a866ee7d0d85adbb4ffd75b72131e5c6e261a2422341342697", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510174, "uuid": "f7330525-b928-4955-a1f7-283b711026fd", "comment": "Malware payload (Dridex)", "value": "d8516da24a49326750bd06ada28a5523b12da324", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618510174, "uuid": "c3b1c6c9-e3e5-4011-a400-6f4b4db147ef", "comment": "Malware payload (Dridex)", "value": "0b7cc4c12ec8f4427807e48310b26008e7c2c659c78ccc412f92e3393e79689b6929110e092b5502e5eac196292ace67", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510174, "uuid": "ab42c905-858a-40cd-96fb-78acefe3584c", "value": "1AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510174, "uuid": "fae97fec-a3e9-4fde-a028-b16441457319", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510174, "uuid": "3f546084-1e4d-4614-bc2d-3433d531ccdf", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618510174, "uuid": "1eeac522-92ec-4418-99ca-e6376ec19ca9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618510174, "uuid": "18189751-6041-44a8-9062-8a9ed9cd377e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618510174, "uuid": "fee09d97-b336-4ed8-961f-2adf0c9119c8", "value": "4f024955bfe9c9a866ee7d0d85adbb4ffd75b72131e5c6e261a2422341342697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59e2558-9db1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618467268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467268, "uuid": "0319773c-b6d0-4fa6-af2c-2e82061ea1f5", "comment": "Malware payload (Dridex)", "value": "13f45bf57d667ccc1c32886a93488316", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467268, "uuid": "cc716009-1db5-4259-bcf0-3fac9b277632", "comment": "Malware payload (Dridex)", "value": "4f08afc36980f47055cc02401c1adc76ef659d1fcd0f69ca889f08956fd1618d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467268, "uuid": "b96408fc-d764-49a4-a458-5d2921a9f6e6", "comment": "Malware payload (Dridex)", "value": "316285fc12c5f5bd4f52de4c31ac9f3a4f5956c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618467268, "uuid": "d18cca01-2a90-41d6-85a2-e5446c5ed29f", "comment": "Malware payload (Dridex)", "value": "44d176640a18c0329beca33108bac49e3670464b2e245f18acbe630e6a438e7b1db836fd859358ee92b4058cee7f6a41", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467268, "uuid": "5902a24d-7a37-420f-ac3f-829bee09ea8f", "value": "06249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467268, "uuid": "f345114c-a957-4d13-a96b-c5865e454947", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467268, "uuid": "cbd1e7f7-3c8a-4815-865a-b046328a7ad9", "value": "3072:q0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ppepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618467268, "uuid": "6bdfa7ad-e5c4-45a0-92e6-22fdda2e1868", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618467268, "uuid": "365c12a5-e424-458a-af71-edcfac984f44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618467268, "uuid": "d673c956-302b-473a-bf99-d7eb9cb14ff9", "value": "4f08afc36980f47055cc02401c1adc76ef659d1fcd0f69ca889f08956fd1618d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8745281d-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618523400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523400, "uuid": "856b4de8-fc48-4b45-b4a7-fb3f747afb75", "comment": "Malware payload (Dridex)", "value": "004d4dabaae91c7f2edada128ed4cbbe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523400, "uuid": "2fee1b80-3960-42a2-a54f-01274912246f", "comment": "Malware payload (Dridex)", "value": "4f130ab6d1e514629c1fd783337d9d9b88a5fe96dd738f629b83ba7c54e7b49d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523400, "uuid": "3cd4150a-3ea3-44f8-a020-ad104deac3af", "comment": "Malware payload (Dridex)", "value": "6811aca05a312310fee2376fa0dde0b50af1f45b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523400, "uuid": "a8cc5901-66be-44e9-96d6-e0a68377ad0c", "comment": "Malware payload (Dridex)", "value": "ef73ab4b265b484a70d9f6d59c6aa7b0ee9988c46fb2990f06a1f50f9a44c6d6cadde5f39f305440d95e50326cf32711", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523400, "uuid": "616e32c4-e1ea-48e7-9bf4-64c28e81097e", "value": "59F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523400, "uuid": "2b671ebf-af61-4d6e-86fb-bb8dcb46c555", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523400, "uuid": "05a7b53e-5178-4cae-81aa-ee0883bad396", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523400, "uuid": "33cf3bce-043a-46c4-adc6-8fa094e0373d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523400, "uuid": "b7c27544-7e2a-4994-b240-49a24a6d559e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523400, "uuid": "602bfad5-1afd-4884-a723-1fd3376b9831", "value": "4f130ab6d1e514629c1fd783337d9d9b88a5fe96dd738f629b83ba7c54e7b49d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bfdc13-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496048, "uuid": "efd0c04c-7f58-4235-9e48-48088a1ca326", "comment": "Malware payload (Dridex)", "value": "2dda1e2a7f910cc4356b56005d2479c7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496048, "uuid": "f26b1950-96b9-49ea-85e2-74822948ae9b", "comment": "Malware payload (Dridex)", "value": "4f5be7d5316561e8df925125a54dc6ff3038359282360868f4556f8e77f652ba", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496048, "uuid": "941254ba-b5ec-4e90-afa4-abdc976de7f5", "comment": "Malware payload (Dridex)", "value": "e65e1f1a465730a41b1af91a08af00428b1e109f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496048, "uuid": "fdf896c7-b923-47d9-9384-9f76d3f94d3a", "comment": "Malware payload (Dridex)", "value": "ef7761f904170e928ba5feeb26bbfd7727d84a10d34a148200b793d5e0f3977fa25ce5708076931204fb909af0c7c54e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496048, "uuid": "db16fdb5-b0a4-4df5-ab75-01491b9ba4ab", "value": "96F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496048, "uuid": "80f17661-933b-42c4-9af1-69703aff434f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496048, "uuid": "a4ebbc0f-220a-4f02-b6d6-a166c273bb64", "value": "3072:8A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:83J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496048, "uuid": "2410c80d-70c5-4b37-8359-ef0564da25b3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496048, "uuid": "e56a080d-fa7d-4b0b-9c88-777d9b46a6ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496048, "uuid": "203f49e1-1a72-444e-b1ed-95f6653dce48", "value": "4f5be7d5316561e8df925125a54dc6ff3038359282360868f4556f8e77f652ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49947eca-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497098, "uuid": "e0502bc8-a453-44f3-b655-301357f71468", "comment": "Malware payload (Dridex)", "value": "79a8fc3d2605175e2fd5c79ea6394cb6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497098, "uuid": "2756a3f5-bb2c-4bdf-812d-19db8bd9c0fb", "comment": "Malware payload (Dridex)", "value": "4fbb597a6787e73a337d8c68a1d21769b2800901109cd1e013c5e7d27fc64f6d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497098, "uuid": "74c1a52a-5fed-4251-b329-2d1e6c6f784d", "comment": "Malware payload (Dridex)", "value": "7333583f21896229e3618593a0dbe72c0d277b23", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497098, "uuid": "a4d1f8f8-d35e-436a-8dfc-814ded3b259b", "comment": "Malware payload (Dridex)", "value": "873038515b72027beb9c4249b745f001f217c0e26c9859f95ac64301eaee88d5e7df05b5225ab8509aa0e48b418b6ec6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497098, "uuid": "200d075a-71ea-4f31-a543-b820c7cb073c", "value": "14F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497098, "uuid": "25b38a42-8c09-4158-aef7-11a3be70eeb8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497098, "uuid": "41f0d256-aec5-45cf-a289-c548cbf25954", "value": "3072:5iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:qeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497098, "uuid": "8fe5e031-7b25-4103-8fba-9c04871d3b9e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497098, "uuid": "e63392f3-36b5-4d6f-b543-c22e7b1664cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497098, "uuid": "68f07c81-67f1-4711-a71b-251f1ba6e096", "value": "4fbb597a6787e73a337d8c68a1d21769b2800901109cd1e013c5e7d27fc64f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a50e580-9ddd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618486066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486066, "uuid": "03bc3f28-6fd4-49f2-9917-440d22e3a164", "comment": "Malware payload (Dridex)", "value": "7ba0ad967788e0773b8caf4e348ffc56", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486066, "uuid": "1b273c9d-3746-4958-99d1-6c5d15fec16b", "comment": "Malware payload (Dridex)", "value": "4fe516a7b7618194a9930408fb0885be23ab54f597c5f7f85a3aef4ba0328e03", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486066, "uuid": "7d03fe82-efff-4fa4-9fed-6e161f0bd27f", "comment": "Malware payload (Dridex)", "value": "c4d92251f76a5e8974de15ebd1cf409a6e0dc7b7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618486066, "uuid": "dde54369-6ab4-4380-9a24-2f13124d5ab8", "comment": "Malware payload (Dridex)", "value": "10e87eee5cdb611a2db0a89220adeafcec63f3b7b33aacc57443ecc1cc6fe45bf79a995c97e5d1b8e719a28b263ddf1c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486066, "uuid": "ccc0e6ce-3f94-46f2-a690-8577df1d02ce", "value": "0FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486066, "uuid": "538088b9-910a-45cc-b28a-63bb911ac3eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486066, "uuid": "b0367fcb-bf1b-4e9a-b32c-cc5c851ae1af", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618486066, "uuid": "ed7ee639-75b1-4847-89b1-fe7f56c8e3f4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618486066, "uuid": "12fb1629-ea55-4b42-b2dc-231947939321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618486066, "uuid": "2c425f09-3f59-4f1b-8a98-82f882afeada", "value": "4fe516a7b7618194a9930408fb0885be23ab54f597c5f7f85a3aef4ba0328e03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b552639d-9dff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618500714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500714, "uuid": "47806006-3292-410b-980d-178da40e8d4e", "comment": "Malware payload (Quakbot)", "value": "3d71c2324b9628baa9da3c627ab2c07d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500714, "uuid": "ebfaf3e0-1523-4315-a358-d21b32a48435", "comment": "Malware payload (Quakbot)", "value": "500c6c2dd903a6584d2a1e5b1bb9d63a837412d305ef8adebd4661cc6ec4a56d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500714, "uuid": "b7bf9930-ddd6-43ae-95c0-14ebbdc1afd1", "comment": "Malware payload (Quakbot)", "value": "150e6125adf29658a400b6085721180fd91abcfb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500714, "uuid": "d4a41ba2-bebf-421b-9b0c-e201b4ea01aa", "comment": "Malware payload (Quakbot)", "value": "04de2f5c74aab0e58e2ba6a8c52ebcf4161a6334ae5d8040f19327a6ae711df5b0798bac74ceba9a4c0c74be41484691", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500714, "uuid": "a8d954a8-aaf8-4066-b702-c0503b71143b", "value": "EA058D35F0D3C437C5337A7CCE1B51A9E82ABA551D68B89A76E50D088F3E681392C2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500714, "uuid": "342d6c6f-6274-4735-9d24-823a9ed2d2d4", "value": "12288:LAlF6Uoww/SY6TB0bbg3dW3JHrvVDPjjqXtBIV0Q5VFRObABg2Cg+82iN:LAboz/I6budWhdq9EROsBlCrziN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618500714, "uuid": "fe2ad416-8177-41bf-b1ed-79550d39467d", "value": 873004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618500714, "uuid": "f4a978b1-682e-4d03-b7f2-6102a86f54d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500714, "uuid": "bd203b1c-a48b-473a-82a7-fda0d809f55c", "value": "3d71c2324b9628baa9da3c627ab2c07d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ba76a9-9d87-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618448994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448994, "uuid": "5544a1d7-7e54-40e5-8a30-ea9b07463a84", "comment": "Malware payload (Dridex)", "value": "6435ed7b7b60597adbe6ea4d757f594e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448994, "uuid": "c45d2b4a-c47b-4d0a-b91d-1e9a51b27e57", "comment": "Malware payload (Dridex)", "value": "5012cdf1027c81ba76efcaf1ff8433eed9b95bb5cdd26cf177458cf5c87c49fb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448994, "uuid": "c7e32f8c-4dfb-4f1b-9af8-fc3740d379a4", "comment": "Malware payload (Dridex)", "value": "35d1318c3e26dda8897ac0765dc82864159c41b5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448994, "uuid": "558add54-37cc-4f4f-9b97-6f60fd1a6a91", "comment": "Malware payload (Dridex)", "value": "e43da3224e14ae2de83ac727764e1898cab2fb1530218d4ad7535574be633d31ee22cc66011e8f49b7fad66f52cf2972", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448994, "uuid": "45187169-c64a-4bc5-bc83-b25e22853978", "value": "33249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448994, "uuid": "15fe4b4a-ee07-4e9f-bd69-548ee30a2a97", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448994, "uuid": "8a3402d8-c633-4139-b502-a8b5d191a7da", "value": "3072:w0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:LpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618448994, "uuid": "fdc5c061-a2cc-4568-81dd-a6121acbd24e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618448994, "uuid": "3dba1939-2b88-4849-990a-04e5246aeb4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448994, "uuid": "30a49e8e-9f6e-47dc-968d-492531dc2364", "value": "5012cdf1027c81ba76efcaf1ff8433eed9b95bb5cdd26cf177458cf5c87c49fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc964dc2-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1618515007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515007, "uuid": "f90139bc-97dc-4e9b-9975-f3a8fdad41bf", "comment": "Malware payload (Pony)", "value": "51437bb88a6cd60bd970e35ed88160df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515007, "uuid": "240c5f24-0d88-46bf-94cd-ce7c7052370c", "comment": "Malware payload (Pony)", "value": "504b55a6e93fcfac9ac20bfc51c2c116e5ed3bd9c6a6cb36efcd6161d3ec1e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515007, "uuid": "9654c2d7-45ea-4250-9d87-de3a6737b859", "comment": "Malware payload (Pony)", "value": "0212aee8b15b9b0060ee0e5fd738e25b76950268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515007, "uuid": "e7da0448-17e5-4174-b125-d5b8a9d98c94", "comment": "Malware payload (Pony)", "value": "eac24ccaa9a97327f35f92c0961344a28ea37246b1510772a61c111b428de97ed862f26a483777f154467128a5f77cea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515007, "uuid": "dbe844cc-387f-4f34-82ae-777d0ab4177e", "value": "11F48C983614B6DFC85BCE32C9A45C74AA616167D30BC607A01F11EC9E4DA97FF281F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515007, "uuid": "1f5413bd-7ae0-4f58-a2ad-7254bde05a4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515007, "uuid": "61c079cd-d453-4fff-a1e2-29ea5b596696", "value": "12288:fXWV/Kg2o0gpZoez5AuKHY9GnLv1BuRH6pZA7W7oU17aOk18DPfI4k95DfcaVkbS:fXaKg2JaZNaYa2uosoaZk+hkMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515007, "uuid": "c913970f-2457-445c-8b64-0cfb0185f456", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515007, "uuid": "f920ccde-db76-430d-bead-7e983682721b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515007, "uuid": "abd8bda7-b13a-444a-b397-d04418679570", "value": "NEW PURCHASE ORDER REF#00127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718cea6f-9e02-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618501889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501889, "uuid": "59cdba0c-2c36-4391-b1b8-4bc8f57c3246", "comment": "Malware payload", "value": "a517ca0780dfd20ff1ba5ce7b8e8a265", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501889, "uuid": "e8c7fb2c-87fb-4622-98d0-2f2aa16a154c", "comment": "Malware payload", "value": "5073e1fa4493b7eda098621c9cc31bdcd36420e277aa9cdda5117def65c88ee9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501889, "uuid": "00d671d4-ce4c-43f3-9a28-50d9a40c2855", "comment": "Malware payload", "value": "ec6f6f9178b2091b5122d1574b3d02c4d9c6c012", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501889, "uuid": "cca5fd6b-dbba-4f7e-8c6f-f19b057d63af", "comment": "Malware payload", "value": "7c3afab6b92e17e0c1695073e29fc3e2a69f879753d8659f75e6a91fae18e1e1194d739119021130dd7a716b4f696c31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501889, "uuid": "967f5866-91da-4542-9a33-74c089169587", "value": "0393091E7B948F25E89C247381EF152903F4ADC32AB2F367AFA4365D09022976C55ECD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501889, "uuid": "1115d770-b05a-444a-aa43-f66b40aad269", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501889, "uuid": "6775578f-3124-42c5-8a21-27dacf4f6e28", "value": "1536:vlJ5oyv7GzhGsBZGlQiXNcIpGhjW2/v1mX9/GklkEnVLWJgeNw:tH7v7wYrQiXNnpGhjV129/x5nVLWJgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618501889, "uuid": "00b08e9f-1061-44a6-adf7-df50ed0aadea", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618501889, "uuid": "0c8be34d-7704-477d-ae49-a8fb9d22911e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501889, "uuid": "265f50dc-d941-449e-8239-8473ff9cbefe", "value": "SecuriteInfo.com.Trojan.InjectNET.14.12246.15304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2e7b18-9e32-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618522578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "f99e4e0c-99f9-4f1b-94a9-a513502874c9", "comment": "Malware payload (Dridex)", "value": "3a3f460f50e7bfbf280d8b8713d12821", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "98916542-a213-4cab-9c2d-d0c94a4d1512", "comment": "Malware payload (Dridex)", "value": "50a03f8ec063913a323dc8e969a0482d46974ab50b3ba1c3314f1845df9f2f67", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "81df7fc1-10b9-44ac-88bf-b171d6083b42", "comment": "Malware payload (Dridex)", "value": "9d3a9d7cbd3df32131837986bb0bc529a5162f30", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "6edd35df-3865-4711-b3aa-7cc22fcda5ce", "comment": "Malware payload (Dridex)", "value": "18341d979de739761247d078caedb443b069337fa9f0e0ea495325f0d435caa33733051dd7ad0bdc51dc6915043de7fd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "c98c3346-d233-49c7-8736-dff4eec4123d", "value": "BCF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "02ff7018-cb06-4190-8080-2e98ebcd8261", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "56754f53-dcb3-41cd-8c4d-37851b88d8d4", "value": "3072:NiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:WeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618522578, "uuid": "0c60270e-eea3-464e-8f20-77fbd5d7f2bb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618522578, "uuid": "eed0d6d2-3f34-449f-ac93-c4816119bea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "b993293a-ad5f-4834-b442-0915d628a980", "value": "50a03f8ec063913a323dc8e969a0482d46974ab50b3ba1c3314f1845df9f2f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c51782-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "53df84a4-9638-4ab6-97e6-4140af321158", "comment": "Malware payload (Dridex)", "value": "7a60e97e2a374ac87ea4f5c2153bce4e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "dcb16dc9-07c6-4a93-bdb9-111b4e185820", "comment": "Malware payload (Dridex)", "value": "50b20d3c73dc928d76304e073e6b0cca3148e5b17c0f5348117d823d23dd469c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "aa313dde-c1fa-458f-8175-78a86f01efc3", "comment": "Malware payload (Dridex)", "value": "98c08cf72100c2ab14690f5958337e46142a3d9d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "ace876f7-f890-48dd-8c97-4653b248db50", "comment": "Malware payload (Dridex)", "value": "ffa3922ba0d36112e15edd473d4dfe6ce7d4e52604525ccfcf8743ec2360b8227d70ae2bdf23c28f708c8b92a0024deb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "4a71adc0-edcd-4175-94d1-168bb590c039", "value": "4FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "2316a2b2-56ac-4f2a-a6f7-da8d5d8ff155", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "3cb6edb8-b469-498b-a328-a074ff617459", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495932, "uuid": "f5fd141f-d315-4199-a055-fb8e441e0e71", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495932, "uuid": "6390e868-f068-4654-a5f7-de886432d53d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "7655cc5d-df8a-40ad-a3dc-76af58d8586b", "value": "50b20d3c73dc928d76304e073e6b0cca3148e5b17c0f5348117d823d23dd469c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58626cc-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495990, "uuid": "4b6040fe-50a0-4208-9815-66cb1f84212b", "comment": "Malware payload (Dridex)", "value": "45e8c3c56c17ea616cdd1945b62992e0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495990, "uuid": "0fa33f54-13e5-4908-a658-703ee7b7350c", "comment": "Malware payload (Dridex)", "value": "50d5f882fa963fe96ec8c9dca3b0e15211acca3fa8a733183c8db54c7a2e4046", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495990, "uuid": "822fa171-f8ce-47f3-b750-12e146edcf92", "comment": "Malware payload (Dridex)", "value": "f4e38a466643faa66b68c21cc35b01b09478b690", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495990, "uuid": "15d2b6e9-3c09-4f69-a966-34e38df61407", "comment": "Malware payload (Dridex)", "value": "80e2abba5b62487a3c40a6d82d9a58b8804d35a7e7161fb395f17d585017b75cbccba8da9e9232e6de951896ba450873", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495990, "uuid": "47af260d-7883-4980-a2e6-061a19830904", "value": "D7F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495990, "uuid": "c5979e05-23a6-4bf2-8722-56bc8edf594c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495990, "uuid": "fba56010-3064-4920-a524-2362b301828d", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495990, "uuid": "ab8c7ade-78ac-431b-a49e-5224f4b433c9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495990, "uuid": "84590acb-da99-43a0-9031-34b47e16a3ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495990, "uuid": "c962c89d-ac8b-4b3b-8a7c-0eb3dfa3d5ab", "value": "50d5f882fa963fe96ec8c9dca3b0e15211acca3fa8a733183c8db54c7a2e4046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bade08-9e03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618502170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502170, "uuid": "76bf1f77-2838-45d6-9367-911423e90ae7", "comment": "Malware payload (Formbook)", "value": "efe63e09c4ad82e21ee9f63ed8d2f604", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502170, "uuid": "bde578c4-c553-4c90-b9b0-e6ccace1af64", "comment": "Malware payload (Formbook)", "value": "50e51f844a0653a83e215e03926f3569954fe02882cc07d127c1d8056edc7d5d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502170, "uuid": "84c25c5f-6679-4fcc-a931-e3c0cb4bcc89", "comment": "Malware payload (Formbook)", "value": "92cdb0a86d559d8dbe9129fe2b41aeb09eb7b9bc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502170, "uuid": "e0e052b0-377d-4aa9-98ab-07592ccc51bf", "comment": "Malware payload (Formbook)", "value": "767547d69be829168ac931a28e316032cd5ac8d26f6be81a93c4fddcf497f14c1cc863d797d42c3d0683557ebeeb6873", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502170, "uuid": "7f81f88e-b833-4bff-a4c6-eed8bd7a793f", "value": "AF428FAC9DB8F76DC90E924B1A6A7D0C0A3A347160E15D813C8C5FBD37ABA254F32419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502170, "uuid": "1e8c6e61-7c38-449d-be56-188c58e3d480", "value": "192:yCumHrYW6W/0SjVoK4AC2iOQ+zg8Gg62+4pNb126pb2NegrRRxHnQB7D1GL59a48:5d0W6/+qAjfzgc62HYQgrJY7D10jnvB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618502170, "uuid": "e76dbb15-7370-4af8-9691-be65600c6e03", "value": 12274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618502170, "uuid": "887e6598-c284-4225-aacb-26f00ed91367", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502170, "uuid": "1a8df82b-0d8f-45f0-8ec5-7b33e0cd5ac9", "value": "efe63e09c4ad82e21ee9f63ed8d2f604.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cebaed2-9d90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618452758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452758, "uuid": "460758db-51d0-42a4-962b-71b85855948f", "comment": "Malware payload (Dridex)", "value": "82b9de7b5d9cd9a4f2341cbbb96cb138", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452758, "uuid": "4b243d46-9da6-474b-8af8-c61d5a9de436", "comment": "Malware payload (Dridex)", "value": "510b890d73b75743cdaf9355502ee0d70809d589a133d80b518f7942c29cc61f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452758, "uuid": "b8bbcee2-b3aa-404c-8614-9a587404bfd0", "comment": "Malware payload (Dridex)", "value": "a2110dae9b201f39118ca784a3f5001e58db3bc2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452758, "uuid": "ef9cca88-1169-49fe-a15c-36f138809211", "comment": "Malware payload (Dridex)", "value": "1cc3c6c10537b5840a40e1881b97b339fefae7540924fc38c7295596da1bd12592c000f6928dd3d7c615000524e3df72", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452758, "uuid": "a08b6d31-61fe-479b-81cf-02d0fe1b0c37", "value": "27249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452758, "uuid": "2cca0ebd-3325-4e5f-a4a2-86b038fd05bf", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452758, "uuid": "7aa0dfe4-0e6b-4d51-8e88-dcbd0edfcc6a", "value": "3072:X0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:WpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618452758, "uuid": "2a26ae7b-1767-45eb-911b-af6907dca7b8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618452758, "uuid": "11dc31e9-ca5e-4afb-8721-26664df62cf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452758, "uuid": "8e4bed47-341c-4cc0-ae8d-f494086ac93e", "value": "510b890d73b75743cdaf9355502ee0d70809d589a133d80b518f7942c29cc61f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1849574-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618481005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481005, "uuid": "e5e124ed-1a98-4dda-8c95-e582062759d0", "comment": "Malware payload (Dridex)", "value": "98a5bffb7d0f08854b27776c474ceec0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481005, "uuid": "a4215006-af10-44cb-a81c-7e1594d863be", "comment": "Malware payload (Dridex)", "value": "510eaf0c5a51b1960c49cd00b991b4236f28cd804070b6f50577dbf0a0ab4a2d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481005, "uuid": "827f4d68-8c50-4536-8bd1-12e1cd15bd77", "comment": "Malware payload (Dridex)", "value": "5424d4bba1f1d4760f59d3587346a1052ae3397b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618481005, "uuid": "6d71f913-80b6-406d-9dbe-22c0f0712b53", "comment": "Malware payload (Dridex)", "value": "da151ba905ee356745fec8d66655cb770f40d1c87d187b31f95669fcb3f7eb4eb8588022568aad0f0ff7889a16740acb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481005, "uuid": "5a970c9b-8690-4f19-a008-c9f0947f5dae", "value": "58F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481005, "uuid": "1e47c020-a5b5-4240-8afe-aff60061b186", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481005, "uuid": "8b41a76c-9b70-4c76-b5db-dca6276404ef", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618481005, "uuid": "0f98e8ca-e2b6-422e-89e9-0696c25e158d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618481005, "uuid": "a5dc906d-448b-4e06-93ce-cd2e2a786f3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618481005, "uuid": "1dbbb827-cf14-40a4-8be0-b4bbe472fa8e", "value": "510eaf0c5a51b1960c49cd00b991b4236f28cd804070b6f50577dbf0a0ab4a2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94c7414-9d92-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618453960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453960, "uuid": "7f3b2d91-b53e-452c-baa5-138ad6b977b0", "comment": "Malware payload (Dridex)", "value": "6add30490a9e3323273ac7dfc0dca4af", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453960, "uuid": "a5ddffd5-9ab2-4602-9f94-a71fa63d5fe1", "comment": "Malware payload (Dridex)", "value": "513500f8aa12366115567b1ad492720b6849d3635224126bdab64580a58ae16b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453960, "uuid": "ebdd39fc-b15b-408e-968a-26fc532508bc", "comment": "Malware payload (Dridex)", "value": "8495a29c39a00701c470ccd816e6f982cff0facf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618453960, "uuid": "d2624d29-ce0f-4a98-879b-2b44596bab9c", "comment": "Malware payload (Dridex)", "value": "5d6ea1920dd251bd025bb0708e40a047c5a256dce4dc877bea65a134d0c3d444c1f3dcedb818ec062a947b0702040cd9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453960, "uuid": "bd1eec4d-cabf-4185-8e78-64cd2bcc9819", "value": "E1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453960, "uuid": "717a2ec4-0138-4e9f-951f-a9acb3e4036e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453960, "uuid": "c06b980a-6d81-441e-9399-06b1559e3c0f", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618453960, "uuid": "5f95b8c1-9bde-406f-8ca1-28093c256ba1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618453960, "uuid": "040c39be-6073-4013-96e0-a4c858a0f825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618453960, "uuid": "ce834e7a-ca2d-4883-9111-af8d3e2da768", "value": "513500f8aa12366115567b1ad492720b6849d3635224126bdab64580a58ae16b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55090faa-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "95b9fdc4-1785-419f-9a63-30941a262847", "comment": "Malware payload (Dridex)", "value": "9252690fc9f1a683a581c75633e6294b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "80c184ef-3977-47fc-b9f6-f62aaea3f7a5", "comment": "Malware payload (Dridex)", "value": "51424a3f019eb716c20e0c5f6b896bb9a80248cb411705f33fa286645391affe", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "873fb07d-da86-4aac-85b1-b15df4ffa75d", "comment": "Malware payload (Dridex)", "value": "d5a1503497fe682c1a7989458ce75945ec645ebf", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496687, "uuid": "21a3e230-4276-403a-9b3f-9a06f838ac5f", "comment": "Malware payload (Dridex)", "value": "0432cef56194163f75cbb497c20fbce533bc7b65f7e6c92483662353ccf3880be9228cf12c236a4f4677357f1b854bac", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "111da127-b136-42a9-97ef-11948ac2ca95", "value": "CBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "6ebd4539-a391-4ba5-b48c-3fb5ba55e190", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "18131488-fca3-4beb-9e82-597a5c1a64b8", "value": "3072:niFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:8eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496687, "uuid": "d5e17811-46e0-4e14-b79a-c0b940824710", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496687, "uuid": "97f4dc64-4e66-45c3-aac3-131e530a0b3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496687, "uuid": "cd8177a0-3625-489c-8991-25aa6048230e", "value": "51424a3f019eb716c20e0c5f6b896bb9a80248cb411705f33fa286645391affe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec379797-9dc1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618474178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474178, "uuid": "3c690f50-9999-4c7b-90ec-35ec7de765e9", "comment": "Malware payload (Dridex)", "value": "0aabfc159b9dc5237b1a8ef8cc6fb360", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474178, "uuid": "97ef7fcf-fe37-4702-86cc-f2b410b04af9", "comment": "Malware payload (Dridex)", "value": "515313eed3afeef2f50484e244ad48aef999fc8eda42022807a41794180d4e44", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474178, "uuid": "9b2e5521-92da-406c-a52e-1ff4c9aa1f4e", "comment": "Malware payload (Dridex)", "value": "ef7883f383dd1f9a579f9421da0ea693044e7a4c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474178, "uuid": "70e08fc0-f701-44ab-86ed-b4f4a822df9a", "comment": "Malware payload (Dridex)", "value": "84bb62afa9f8d151ae43f95e5ccb58d27d71a08607c2945928c41c28821ef1a623d2df46fb41a9f9bc7b6a7f978a4167", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474178, "uuid": "a004ff18-3cd3-4f67-b1f6-515615076bff", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474178, "uuid": "71df85c6-6847-40f4-8246-714faebe157f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474178, "uuid": "b3c59391-b10d-45e0-aad2-64842d509fcc", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474178, "uuid": "8a8ace69-12e2-49f4-a6ad-32fb1b9af935", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474178, "uuid": "23dfe1cc-f2db-469f-ae57-02445e4cbd52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474178, "uuid": "6d32a972-5185-4768-a31f-e644815f9497", "value": "515313eed3afeef2f50484e244ad48aef999fc8eda42022807a41794180d4e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a568d5a2-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496822, "uuid": "6b893a83-5122-412d-a8a4-295d6e4b5a1f", "comment": "Malware payload (Dridex)", "value": "a02800f483f46eb7cabff8303370b6fc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496822, "uuid": "662a70be-20ec-4134-8376-31caa0c7c095", "comment": "Malware payload (Dridex)", "value": "519db170d3a7fae33245fe4010371637f6f6c7d07d83c0c8da166c91b9e35f68", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496822, "uuid": "cdfdfea5-3167-48dd-acf0-9e2a553154cc", "comment": "Malware payload (Dridex)", "value": "c22ddc87cbd3a04d41c86f174c84c8b8c24ee794", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496822, "uuid": "0136418b-2f5f-4e9c-ace2-df9daee56bd5", "comment": "Malware payload (Dridex)", "value": "ff2adc0420524aae04027d06b4840123035b63f92d0ac8088565e10c65bda15bf7d3692068b96813d0c1defd007932fa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496822, "uuid": "bf5e59d7-7c4f-437a-85d1-403fd5a0cbac", "value": "F1F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496822, "uuid": "3862f84a-fa2c-43c8-b288-f7ea9e0a2fd8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496822, "uuid": "d0f1c450-41c6-4f3c-a227-636f025e8e68", "value": "3072:HA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:H3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496822, "uuid": "0ae2dcfc-154c-45f1-983b-ebb898dcec6c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496822, "uuid": "e1ebfee2-8cc4-4a05-bff4-6361e84d11d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496822, "uuid": "9a05e451-b4c0-4451-90d1-32e1b9d9b8ff", "value": "519db170d3a7fae33245fe4010371637f6f6c7d07d83c0c8da166c91b9e35f68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61d0832-9e3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618527855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527855, "uuid": "faead60b-7e2f-4caa-ab63-5916ac633ef7", "comment": "Malware payload (Dridex)", "value": "ecb1586b8451bce2c56d2b1787a94252", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527855, "uuid": "39ef8ca2-ba7e-4aee-ad49-2c01034cfedb", "comment": "Malware payload (Dridex)", "value": "51e1efa652488c836d52bc9c69c8302e59dde3383183e32763b899649db2f2e8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527855, "uuid": "1ff0117d-4941-450e-918a-49a0f464945f", "comment": "Malware payload (Dridex)", "value": "2fbae077264a59b6c979c49f784e091679468f69", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527855, "uuid": "c17bc05a-b765-4681-856b-4dba66849e0b", "comment": "Malware payload (Dridex)", "value": "1ad0cc5e2b9410fddb8fa368f4cd03bc30c6b22bace52b1c0746d314b8a163c76e5ae6526c58d85c7f2d822b77a90c1a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527855, "uuid": "d1273318-ac5b-43eb-821d-55c01308e7e6", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527855, "uuid": "a74b73f9-4f76-415d-a546-9ef715c8befd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527855, "uuid": "6359155b-f937-4b4b-a1dd-895c894a3f20", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618527855, "uuid": "b94976af-8b88-45c9-8408-c01d3e773ed0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618527855, "uuid": "e30a5695-0d5f-4503-a443-69bb597d9edf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527855, "uuid": "2027be52-108f-4faf-8268-96dedcee674a", "value": "51e1efa652488c836d52bc9c69c8302e59dde3383183e32763b899649db2f2e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26398e50-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "83a86adf-5d24-4a0b-9d50-af528b0084e2", "comment": "Malware payload (Dridex)", "value": "47e294f913c7948dc0f3a2b7a2694c17", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "6f58bd27-f4e3-4ab3-a7cf-52ddc2bc9919", "comment": "Malware payload (Dridex)", "value": "51eb0c679c3ec39f2089249d9799ed6ab0642886305c0d09895af47c4c22e451", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "ce2c0967-9f6b-4bb9-ad67-526fea850e63", "comment": "Malware payload (Dridex)", "value": "d340c45a7b8abdbf9fcba31b7630e9b281d65491", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498327, "uuid": "b5651175-6d50-4544-8766-076abf97f657", "comment": "Malware payload (Dridex)", "value": "792b51ce0bc0ba1425479ca7e12c5427c30e0470a02e6b9ed74905f0adcc8e95c04fd838cba3260546b2c3256555aec0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "0d364e8e-1ba2-4afb-a740-c3eeaddc06ac", "value": "AFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "b1153c74-77e3-4637-b1be-08d75a852a7b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "91af8015-ff44-44b6-a6eb-fba19c1c1d2d", "value": "3072:BiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:SeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498327, "uuid": "cf051edd-2d7f-4de3-821e-46cc25182df5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498327, "uuid": "c1470eed-2f0b-45a2-820c-7f6af2515bd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498327, "uuid": "fcb31e67-0fd3-419a-a137-589a5c55e936", "value": "51eb0c679c3ec39f2089249d9799ed6ab0642886305c0d09895af47c4c22e451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550fb3c7-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "96cd19e9-bb0b-4d46-9b93-64a867119bd1", "comment": "Malware payload (Dridex)", "value": "3edd04f1723af14e4af8e38275dcc68a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "5e7cd62f-54ae-4dfe-9e2f-25ae7edb40d7", "comment": "Malware payload (Dridex)", "value": "51ff5e46e637aa0ed289c0c7b2ff67d3770e1965bace992fedcae03d5a631018", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "710a4fb0-2faf-4879-9433-ff318f962bb3", "comment": "Malware payload (Dridex)", "value": "032cd560123aa99bbfbd10b1400dbad69b3a8e3d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "cc8140ed-fa5c-4819-87c3-5886fd300cc2", "comment": "Malware payload (Dridex)", "value": "c5d5fb79fc03d3b7aaadea1f6553833bacabba856cd025969e892554574bd3b3ebe063270299fbd2812c2f5443a63cce", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "7ffc31e3-c698-4fa3-b31d-24c520a5cf21", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "1afbec1b-6d51-4cc2-aa69-992f851dd1dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "3f9f9060-cc2a-4589-9e41-f8cc4f110140", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516015, "uuid": "79cb9d4e-2947-4f36-87f4-c60cfbcd8ba6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516015, "uuid": "390e08ef-f5f1-4e59-87b3-aba21a6573b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "887044e2-a3a4-4ed6-9f5c-5eae66cb42f5", "value": "51ff5e46e637aa0ed289c0c7b2ff67d3770e1965bace992fedcae03d5a631018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819e700c-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "2efe143f-6a64-4da6-9fad-2e5a978c919b", "comment": "Malware payload (Dridex)", "value": "310d7cf684e20313f2d9bc8db9be481b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "3b76ceee-564c-47dc-801b-d3a56a6bc07f", "comment": "Malware payload (Dridex)", "value": "5206799e94e007e4ab7b2adec8d08f2ffd09a51803fc8bd686077b3598d26a42", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "64f2fc30-7e56-40b5-9e3e-88f6f1cf8f38", "comment": "Malware payload (Dridex)", "value": "e2edef3ef496ea7cc7d56e1a43de4ac891bafd0a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495903, "uuid": "e87a9e08-2dcb-4709-8bf9-fc32a57f4ae7", "comment": "Malware payload (Dridex)", "value": "3660bc8c5e879637cc58f18adf4aae3a817d8d2f3b561696f2bfa02e73074731059a40fe5694db3762703e040bc22fc7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "1eb66f5c-a2b4-4aae-9078-277d598821fb", "value": "F8F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "62a038b7-3e06-4e45-8d4b-c0d05a7b3e2d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "9126077d-79fe-4135-9318-a2089d18e046", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495903, "uuid": "eae44308-fdf4-493d-bd94-6910e158e330", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495903, "uuid": "4111c37d-8a27-4622-9f27-f26e4df5f598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495903, "uuid": "2cadb507-9dde-4253-a5d3-a5c5dc62e5cc", "value": "5206799e94e007e4ab7b2adec8d08f2ffd09a51803fc8bd686077b3598d26a42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bae2617-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516053, "uuid": "d162c2bc-4840-42d0-8a43-91531a039c03", "comment": "Malware payload (Dridex)", "value": "4dea773e060c342061db41722e9d6e1a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516053, "uuid": "154633fb-a683-4854-9639-92c69d1af4a2", "comment": "Malware payload (Dridex)", "value": "5207cd4f5392d328ad308c525385fb169bd0996c0719130539d0d45c774af44d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516053, "uuid": "19d969a5-b583-48e0-9bfa-89c1bc3e3ecb", "comment": "Malware payload (Dridex)", "value": "74ed5d496ff4d82eb5f88ccbcda03717c8051388", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516053, "uuid": "fb11573d-0c9a-41f6-8712-1f234e285398", "comment": "Malware payload (Dridex)", "value": "e151bdd028811ce955a6be99d5a9f6cfc1edc4d354c592f7ab64e099c611cb1e02ec325d1da066db8024e69c50e393ec", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516053, "uuid": "4b2b2ed9-9491-4067-a128-c4656cf54044", "value": "C1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516053, "uuid": "1c5013b7-55ae-47e8-be07-5cd7ae74dd3b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516053, "uuid": "b7025984-b319-4859-8181-6d9f18a7baf2", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516053, "uuid": "8eda3a83-dd4a-4a87-a527-48abff3f929f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516053, "uuid": "0e3808da-6ad0-4700-9505-f54ec22ac023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516053, "uuid": "aae3d808-1819-4022-bb32-8387a9d08031", "value": "5207cd4f5392d328ad308c525385fb169bd0996c0719130539d0d45c774af44d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ec9927-9e2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618521330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521330, "uuid": "ccb3505a-8425-41f2-ba71-35af48792449", "comment": "Malware payload (Dridex)", "value": "2dc1e6831b643abb709b0b9bdd79c37c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521330, "uuid": "6743e4d7-c66f-427e-b29e-255595ad5491", "comment": "Malware payload (Dridex)", "value": "52379c572192da26c78d9e256780e9bbea1b755f081f6c985dfb969f529b91fe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521330, "uuid": "90efa65d-bf34-4ba9-8292-cc0213ab055a", "comment": "Malware payload (Dridex)", "value": "070d7cdbdd5caa263510279e035ab976963dcd9f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521330, "uuid": "cacffbdf-be0b-4345-90ff-5f666a9d3a07", "comment": "Malware payload (Dridex)", "value": "0ba89879be530e04517ea7275b7cb190ff7ede0c4e8edeb9ea5f0f947ed6d9c32a4b6e9389fd95f520db6c629ea7cd48", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521330, "uuid": "6be9842b-4db7-44cf-a182-ea4830cd8f1d", "value": "99F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521330, "uuid": "05c2eb13-ac1e-4fed-8b12-5ec7cbae9944", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521330, "uuid": "4bbfc8e1-7d7c-4a98-8318-66ad6a32667d", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618521330, "uuid": "164b6f9d-ffd9-42e5-a0bf-2cc436f43896", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618521330, "uuid": "8825c2f6-e529-449f-a8c6-1254583e5585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521330, "uuid": "1cc3db28-b28c-4f33-82b1-2e2ed0f7e503", "value": "52379c572192da26c78d9e256780e9bbea1b755f081f6c985dfb969f529b91fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925bef9c-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "c3521584-93ce-4a5e-90cf-39bf7ed7ff2c", "comment": "Malware payload (Dridex)", "value": "1d0846284c519854a0ada394d6a8d098", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "0f363b6b-1d3c-422f-99d7-3cfa6d7e937a", "comment": "Malware payload (Dridex)", "value": "526e5b4bd1f051b28d1938031f75120a9e0e8e7869e931b37821bff0a29b0252", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "428ef4f9-7507-439e-bcd4-72ccf47dcd67", "comment": "Malware payload (Dridex)", "value": "6a6c4107e7039465aff0f9d7b6fed2a9fcb6d0b4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495931, "uuid": "aa028055-989c-4858-bb90-a5d53a92dd3c", "comment": "Malware payload (Dridex)", "value": "940cbe5b8615f9e7fb3a4a32252562acc7ebfea08ebf9c19fff1f7c7d2603c82bc247b660a2a63cc2b34dd4a534eb9d5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "65b2f46b-d5e3-4227-bebd-20569171dd51", "value": "77F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "fbf37b9b-64c2-4c88-a59a-b796f15f6034", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "66e7bd56-48c7-4650-8b5a-4ceeb81634b6", "value": "3072:lA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:l3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495931, "uuid": "7063e628-be49-4ab5-8b10-9fbd33a73413", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495931, "uuid": "366b9457-c3c6-4a5a-af01-cd7c6ad6eca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495931, "uuid": "bba0cb95-d99d-423e-b003-bf39c7302e7c", "value": "526e5b4bd1f051b28d1938031f75120a9e0e8e7869e931b37821bff0a29b0252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ab45ec-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498349, "uuid": "fea4d7c6-2dd3-43b0-aaa8-4e51b7f01410", "comment": "Malware payload (Dridex)", "value": "ce8df09c4c010bf1c8546374ba5670e3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498349, "uuid": "7a95815c-3d9b-41c9-8021-b167e10111a6", "comment": "Malware payload (Dridex)", "value": "5299e2bce3d848ef0a3cec925133fa885ed23b7fd3aa789a9c6091c552fe772f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498349, "uuid": "be6128bf-124b-4ca4-b3d0-c587c148130d", "comment": "Malware payload (Dridex)", "value": "ec29159540d22f059bd97327b2e5175cd2d0903a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498349, "uuid": "52fe55bd-2681-40f1-9bef-c7e608ac8629", "comment": "Malware payload (Dridex)", "value": "bdf8145cc93ed99753339fa1c5162f4afac9e64001e36e40dc2075063d66d9b8b7d7ae23ee38d049fd8ee2a9dca4844c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498349, "uuid": "76bb64d3-0f91-4902-9216-f2727c3b0bbc", "value": "1EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498349, "uuid": "5fbde563-8000-4514-a081-1662e03bdaf5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498349, "uuid": "19908b95-b0d7-4981-ab14-2471222c2b4f", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498349, "uuid": "7e7f0993-5967-499b-982b-bc3a50d1a81b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498349, "uuid": "e10d0563-21a9-453f-b06b-625612b35c02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498349, "uuid": "668c45a7-1b42-4e33-a20f-af4cd7dffef4", "value": "5299e2bce3d848ef0a3cec925133fa885ed23b7fd3aa789a9c6091c552fe772f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f94e41-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "23209a6c-e268-4e02-9a0d-3277cfef1116", "comment": "Malware payload (Dridex)", "value": "48db5a6412a382db10fff6e88271ccec", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "f29df1cd-34fc-47e8-b811-351ab59ad0c6", "comment": "Malware payload (Dridex)", "value": "52a211ddf19a203f731fb9655ccc1054f5526a56f915079a3f9179effa7a3419", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "9925f613-4290-4b0b-a144-849925c500b2", "comment": "Malware payload (Dridex)", "value": "ead6fd6e78e109c7212df1153f87bcee0b913555", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497006, "uuid": "8b0735c4-c401-4163-a79a-664c66e27543", "comment": "Malware payload (Dridex)", "value": "5256413d3059555944eb6b5f65016754fa29930f805e04b1f3f363b2b6ff30166ae2844838bcc85d5c52ef038af80678", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "044905d3-578e-49c1-976d-8a5d9035ebba", "value": "D9F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "8e5db4ef-7fe3-473a-8cee-c03b63cae8c6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "47b1671a-2bf6-4125-9015-02d6f03a0ba1", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497006, "uuid": "6c7d7861-b7fe-40b6-86af-9442788d284a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497006, "uuid": "0d65e856-f531-4e2f-bdb0-29607b91bd06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497006, "uuid": "47450127-1928-46b6-a77a-97a734632e89", "value": "52a211ddf19a203f731fb9655ccc1054f5526a56f915079a3f9179effa7a3419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b43cd3-9ded-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618492982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492982, "uuid": "f8346e6d-9637-498e-bb6e-19c8c0e1f725", "comment": "Malware payload (Dridex)", "value": "3bfcf666648777307a015c9961c622c9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492982, "uuid": "34f97ee4-67bb-4284-a8ec-28340015b49e", "comment": "Malware payload (Dridex)", "value": "52bf76c6e7ee031d86b3789d97612a2ff6589e7511fa8f8b4f2d7c1d32c768d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492982, "uuid": "1026919c-f47e-4936-a1d4-9f9bfed808b2", "comment": "Malware payload (Dridex)", "value": "2c893e06da80a02154166c0efb33862a48aaa492", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492982, "uuid": "e999a13c-080f-4707-ad5d-d2fab1dfff43", "comment": "Malware payload (Dridex)", "value": "3922802e8630c21dd2b1f779a377d9bd16fe059491a73fc8de3f401bfe59de7ed2a9a7b542b80258c8aec6ea17b8d524", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492982, "uuid": "98b04af1-ccbd-4f8b-afce-ec2c6a46b046", "value": "98F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492982, "uuid": "36e355ef-7fcb-45ad-b268-b7f206008afe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492982, "uuid": "44f187c1-4291-46c5-8f09-2fbbaf228084", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618492982, "uuid": "3c941aa5-4b48-4a34-b628-917c50645f1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618492982, "uuid": "f329667d-d158-4611-a58d-7219f901098a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492982, "uuid": "2cb14fa4-3f1d-4dad-8051-6662afcbd898", "value": "52bf76c6e7ee031d86b3789d97612a2ff6589e7511fa8f8b4f2d7c1d32c768d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d050034-9dd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618483252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483252, "uuid": "3ee2eaa3-2910-4728-8ab7-72b5c902073b", "comment": "Malware payload (Dridex)", "value": "5773e0ef8c5e2788a055c7a2d3b66dfe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483252, "uuid": "8d71c13a-f99b-4b5d-9392-a349df6b2d2e", "comment": "Malware payload (Dridex)", "value": "52e0127b1c21c4785c00026c321fd0fa4c72eae6e7449acdc3341621147c96be", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483252, "uuid": "60a2d832-9842-4b3b-b552-a782c77ea0a0", "comment": "Malware payload (Dridex)", "value": "371fd9eb33b7821cdebc7a5b8f852c979348cb1d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483252, "uuid": "98535849-5daf-4ea4-95bb-d50ed3937870", "comment": "Malware payload (Dridex)", "value": "b23f7734086b6a0c096c655faa8ba76b3dfbbc1bec9929e06285881d6abe12c0853076d35fbbb53cf49a8619f175b0f0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483252, "uuid": "15366567-b8ce-4be4-8705-cbc94d684591", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483252, "uuid": "4715e4ec-644a-4061-b9d2-2398a8406705", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483252, "uuid": "502d4d3b-8093-45c2-a7a3-b347add50ba5", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618483252, "uuid": "155dc447-0755-4d13-b073-6a3d984ee272", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618483252, "uuid": "92e76ba1-724a-431f-a002-b60b65f5d53b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483252, "uuid": "c8b2372b-b98a-4eb9-bf03-5377d6a48705", "value": "52e0127b1c21c4785c00026c321fd0fa4c72eae6e7449acdc3341621147c96be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83529549-9df9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618498054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498054, "uuid": "e7cfd781-e4d6-46db-b8f1-e9c2ee10ae69", "comment": "Malware payload (Formbook)", "value": "284e7c1b0ec68be738f6afad5f5acbfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498054, "uuid": "c532a836-4705-4249-91b0-2ab366844e98", "comment": "Malware payload (Formbook)", "value": "538ce80f929a6430a62d4e631f28d6bcba372813a2860faca1b5e8cbbd94e7a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498054, "uuid": "e84447bd-ea3f-4953-ad1d-81cb242d2198", "comment": "Malware payload (Formbook)", "value": "b9ceb31d1dcf1d81c61f4faa501ec938a0d46ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498054, "uuid": "e59d2db4-8abf-463c-bc2d-8c52f452537e", "comment": "Malware payload (Formbook)", "value": "fff8677bbe55d96cec302d4b05af31fd7277f2cf9ca8f2ecee41fab1eb621afbb9e569e3a59ef066bd94312898e648e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498054, "uuid": "c5e80cf3-5cc9-435b-8d01-c443fae86fc9", "value": "EEF4AE62F2C04637D16F2A34AC1F76746929BEB02EDDD04927F47D086F39694392A1B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498054, "uuid": "cb3a8f0f-ec7e-4e2b-8040-6b4fadd364ea", "value": "af885d192a6d952d22f10a55ec50ca3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498054, "uuid": "fdd56619-5287-42d2-94ab-6934f303e8b6", "value": "12288:iW77uI5+unxNWV4JurCVsiSoT2yLBkx1l1HNGM0oU/OyV:5PuQ+unK4JuGVsiSoZ9kddRUDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498054, "uuid": "0243baf1-6ab3-4ace-825d-1cdc625b59e6", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498054, "uuid": "c4bb17cb-d7e9-461c-8cad-5e602781e77b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498054, "uuid": "71779206-3b2a-4c3f-952e-956516e5e3eb", "value": "Nipro Order Confirmation-PO#27174DD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a780db8-9dbe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618472537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472537, "uuid": "2d8b5eeb-d634-4bfa-981f-9a445207cf58", "comment": "Malware payload (Dridex)", "value": "0d356a8a97ef25354699fd9331e31113", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472537, "uuid": "7340acbe-bd6b-4bb7-a987-aea2cf9393d7", "comment": "Malware payload (Dridex)", "value": "53b7021e5dd8f53b7f3d0a8efd9879203dee1ca430a7a87153233acdfc674c72", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472537, "uuid": "9ea8ca0d-f9a4-4b0e-a453-fb45001b058b", "comment": "Malware payload (Dridex)", "value": "4aa692e51fd28b9a0f5d87b32c90a8a2df3a7d2f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472537, "uuid": "922d5c1e-b96c-47b0-8a26-c7c8a67becd5", "comment": "Malware payload (Dridex)", "value": "11a24ca8f951f7669b655fa18a005233c1ef6e9d5a36f0bd92999e5f1875f1e640fae20614825854b7c01e1338157735", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472537, "uuid": "f441d0a0-e9f5-4570-b47a-14bcb7cdba2b", "value": "BFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472537, "uuid": "a8677014-c8db-4432-a3cf-3eaf6caa5b44", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472537, "uuid": "717fce23-e521-4251-a13e-b6cd9d43e1c1", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618472537, "uuid": "9da93f93-f3e7-4af1-b674-404ef975fc36", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618472537, "uuid": "106e7f9e-6424-4a18-8b66-81fb47435cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472537, "uuid": "db05de3b-6bad-4475-b4fe-e1679f6681d2", "value": "53b7021e5dd8f53b7f3d0a8efd9879203dee1ca430a7a87153233acdfc674c72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ab19fa-9db1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618466978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466978, "uuid": "f4148164-d770-4776-9cb8-c6ddfb56559d", "comment": "Malware payload (Dridex)", "value": "182c785dbf4cac75c54805a38b8567c0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466978, "uuid": "61c5f28e-f183-4c12-8c17-3de20122259a", "comment": "Malware payload (Dridex)", "value": "53cbb7d17d8ced0b0e9df172d6406a4b7d4af24fec3bff8a7dbd8c45ec51d368", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466978, "uuid": "f6644e35-accd-4137-bd0b-78996fd347ba", "comment": "Malware payload (Dridex)", "value": "67bad33d2669ba35ed6f8371c3019037aa3ed66c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618466978, "uuid": "0da88885-564c-4567-95dc-0ba86a4ec235", "comment": "Malware payload (Dridex)", "value": "888b0c2c0b582d7931f8a7273b59ab7f54709a54e0eb3bc25076e40cd6f2631ab50965646d8d0a88fed9e4665db934c4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466978, "uuid": "7a6fcfc8-6bd9-4b52-9681-b9b49b5ee390", "value": "4CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466978, "uuid": "a06aa833-0d82-4851-b537-36c7d3833121", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466978, "uuid": "0b3b6670-6f85-4d96-a153-e28878f6a187", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618466978, "uuid": "ef69c43a-6032-48cd-931e-a4c69659be2c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618466978, "uuid": "98295326-dc5f-42db-98fa-d6b7013ca0f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618466978, "uuid": "44f9cd22-f4cf-4c56-a6d5-b0108d77e31a", "value": "53cbb7d17d8ced0b0e9df172d6406a4b7d4af24fec3bff8a7dbd8c45ec51d368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76c02db-9e2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520582, "uuid": "ff607f5c-e98f-420b-8465-1f260a593386", "comment": "Malware payload (Dridex)", "value": "f91a1983e848b5b1555b0f824026f11f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520582, "uuid": "e480fce6-d83e-499a-ac34-82a4b3633640", "comment": "Malware payload (Dridex)", "value": "53e0450659f0e58b55ccee9f5a72c3900d674df543a7008ff4b5e432c34db6a9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520582, "uuid": "ab5a6b30-167d-4f89-9448-f2af8d823c9d", "comment": "Malware payload (Dridex)", "value": "67d9b7a6a0f2fd79380b58b7637f4ebbf84b06df", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520582, "uuid": "7c8f4081-8f13-494a-96fd-e8376ee730f0", "comment": "Malware payload (Dridex)", "value": "55095058d66d50c49d20c0f5cfea9efb6551ab5e884ed1f0683fe63ec1ad962f26c0cacbc9486fad8b670075ce4d38e5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520582, "uuid": "ad87f28a-027d-4145-9ccc-0fc7310c897a", "value": "DEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520582, "uuid": "394a05a5-89e1-4aaf-a20a-ab4056ede34e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520582, "uuid": "4a027b75-e6b1-44b2-ab0b-6cde73bed8b0", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520582, "uuid": "12ae922c-b422-437a-a382-7f474f1ba595", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520582, "uuid": "0f1d83d5-f0d0-4d9c-b595-a59a18851a95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520582, "uuid": "dd65fbc5-d2fa-4f8a-8ecb-7c3e985d1630", "value": "53e0450659f0e58b55ccee9f5a72c3900d674df543a7008ff4b5e432c34db6a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ab478d-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "74113cd6-6be3-417e-92a6-fed64aa78234", "comment": "Malware payload (Dridex)", "value": "517584b3322555574bf9ad928a2d4af3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "a89c2506-9b59-4e16-98fd-96e6271babf6", "comment": "Malware payload (Dridex)", "value": "53e64cf0560953a9cde20ea4ddcf6ff6e200a894abd812cd82748d00382b7356", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "f346a80b-18bc-4842-a370-1b591b1ad73f", "comment": "Malware payload (Dridex)", "value": "0c74d7ff0fa2d63dc4dbffcaae5ca20e784ea694", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "31711f7d-2d64-49a5-afd4-d57006db7647", "comment": "Malware payload (Dridex)", "value": "fc7172d265a2b568734456c6e6991d26e8995510474b9e8f7a979b41dc18e8d06208cbdc5b7e29f784f55e37d3878481", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "e66a52fd-d817-4cec-b8d6-aff613ece230", "value": "B8F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "6c64dbfc-f5f0-4110-9c2f-d1491cc0d739", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "f3272f1b-aa34-43b2-9e1d-d2b488d974dd", "value": "3072:kA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:k3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495928, "uuid": "4a412f29-e955-403e-95e9-c956c37baf05", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495928, "uuid": "cff29668-4bcc-4514-9851-ecafbb73ef6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "5ee0cfeb-b312-47f2-92a3-45f47ec71dbd", "value": "53e64cf0560953a9cde20ea4ddcf6ff6e200a894abd812cd82748d00382b7356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c69e8a8-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516108, "uuid": "f89502ba-a8bc-4580-8633-20c27f3c27ee", "comment": "Malware payload (Dridex)", "value": "b2763682e11edfda75aa9d5679c31656", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516108, "uuid": "e85f37ad-f0da-41ca-a04a-ca9e44f9448e", "comment": "Malware payload (Dridex)", "value": "543d0e54b8adc89a109e41aac99c900d34cb6bb42feb5b92592d9b3dd16e56aa", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516108, "uuid": "c18e016c-07c8-4d01-8333-fad8a50a5578", "comment": "Malware payload (Dridex)", "value": "bc36fce8122f9d48d3ed7d8e36b99ee665a500b9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516108, "uuid": "0503f145-ba22-43b8-862b-1eb946b9b674", "comment": "Malware payload (Dridex)", "value": "7c1a2961cd8f07a8742a77143a008da75a5b3108e9959bd35caec4d38433686afc853b40c4e03f384fd7726eb30f5edf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516108, "uuid": "16d3e1e4-0eb8-4e55-890f-6e70c36ac660", "value": "0EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516108, "uuid": "fe992144-7fb4-40f9-8d91-80b977e9051f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516108, "uuid": "959b6d3b-ac6d-4896-b4ec-4a9ba5f6d135", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516108, "uuid": "1c42909f-7324-4b67-92df-52aed69915d4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516108, "uuid": "eda48c23-789d-4866-8f61-bc113fd4a7bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516108, "uuid": "31401fc3-8b87-4705-8b92-ff33ec9473d9", "value": "543d0e54b8adc89a109e41aac99c900d34cb6bb42feb5b92592d9b3dd16e56aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7bc63d-9dbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618472088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472088, "uuid": "738432cb-baf2-491d-ae1b-28f73e6707ca", "comment": "Malware payload (Dridex)", "value": "f7c8516d8ccbb67865b9c43ffd5a9b4c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472088, "uuid": "cf3bf550-6e33-4d23-8ccf-671578ae212d", "comment": "Malware payload (Dridex)", "value": "544797061b123e80ef475cfc3bd15d7b817c4667f25e44349323df5f166fa234", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472088, "uuid": "deb4d63b-0bab-4281-bfab-5cd2da228d55", "comment": "Malware payload (Dridex)", "value": "379dcd8d356da3fd8f68dc082f58c0d301c69e28", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472088, "uuid": "02207583-5d5f-44f8-98fc-9e667b8ee954", "comment": "Malware payload (Dridex)", "value": "17f7096502b93363e26b1cd1bc0c1ceefc5b476e537d0e5970ae5e26907ffdea9d1adcd94f39483996ce13afee2655e0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472088, "uuid": "50a0d1b1-bee9-4986-9797-327df4caffb7", "value": "B6F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472088, "uuid": "5aff6c70-0fff-4578-b906-a074640d410c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472088, "uuid": "8c84e292-285a-4da3-ad8d-fe801dc71122", "value": "3072:BA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:B3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618472088, "uuid": "d8e8ce7d-9f0a-4d79-842a-407994dd70ba", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618472088, "uuid": "bf99e642-0d3e-4531-a9bd-5762ad5f4f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472088, "uuid": "9dbdaeeb-932f-4119-bc95-81143d1daeb8", "value": "544797061b123e80ef475cfc3bd15d7b817c4667f25e44349323df5f166fa234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347412e8-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496633, "uuid": "6afa0f14-4851-4cee-b93e-5db06150c9c9", "comment": "Malware payload (Dridex)", "value": "44b4cdae123b52941852874805be6ba6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496633, "uuid": "76975919-9eac-4af1-87b7-3787da465f30", "comment": "Malware payload (Dridex)", "value": "548abb2e8911e6bcf9ed373183cf499bf8e6f663ed0986a36e55f9800e68ce81", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496633, "uuid": "8d880dee-ff22-4d01-9d4c-44d1c5bc1b16", "comment": "Malware payload (Dridex)", "value": "eec81d95ad10cad501d2fa3a89077821178c934e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496633, "uuid": "376e4c7c-b6bc-405f-b715-d9ef85763184", "comment": "Malware payload (Dridex)", "value": "c22084915b4c81705e0dc2717a0b36951f7d32bf997b7e5bff8b9d529dd2d7615d25a7f6f566ba2401acef2435c49b0c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496633, "uuid": "836b6637-b4a3-4919-a7c4-bd8dd4a82e8f", "value": "71F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496633, "uuid": "b3c3db62-28c9-48ff-8f58-12886a077dc5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496633, "uuid": "2420a021-ba7c-4a9c-a571-7d123f276f9e", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496633, "uuid": "d5b55c68-fc59-45b3-b408-d362e0a91272", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496633, "uuid": "d624cc7f-4585-427f-913d-4a75b7d4a6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496633, "uuid": "063f34c0-3846-475e-89f8-684639ed3c00", "value": "548abb2e8911e6bcf9ed373183cf499bf8e6f663ed0986a36e55f9800e68ce81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ca7b93-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516048, "uuid": "977df418-3e8f-4be3-9382-33fa83ce4ac5", "comment": "Malware payload (Dridex)", "value": "6cd801a907a5c34c200816eb93f88dfe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516048, "uuid": "f2188432-de7c-4a8d-80b6-68653dab294a", "comment": "Malware payload (Dridex)", "value": "54d472359d6048ee7dec3786e061d17aa0bb8889f85464164525fb2b6b6490b3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516048, "uuid": "4769fe00-477a-4485-86d8-733551246d80", "comment": "Malware payload (Dridex)", "value": "be43f0877b567a815d9d6821ecf44037c35ed99f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516048, "uuid": "3fe3fcb6-98ea-4713-9af0-558daa3dbf7a", "comment": "Malware payload (Dridex)", "value": "81414ebf50dc25c90c86945a9a7ec67104507b37b31fbb185b223e5bfd8feadc74be869a2e848536cbdb660911be45e3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516048, "uuid": "0abcdf20-5885-4de5-b452-00308a414d48", "value": "64F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516048, "uuid": "380d1f4c-f24d-4def-bde0-57d6face4ecd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516048, "uuid": "f37f1b3d-e13a-4595-a2d7-9ecd05e0517a", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516048, "uuid": "57166b17-0fe5-4c45-911e-63dcb396ccdf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516048, "uuid": "3c7ab16f-6f19-4b6c-808b-1228739df737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516048, "uuid": "93c05a46-16ff-467d-8ba4-aac5c4b695a9", "value": "54d472359d6048ee7dec3786e061d17aa0bb8889f85464164525fb2b6b6490b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97913d21-9e31-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618522139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522139, "uuid": "29d2e058-b1d3-4fd2-8add-505512d176a7", "comment": "Malware payload (Dridex)", "value": "d2e2dad9be773ae3a67480bea0d1e2c3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522139, "uuid": "b9901aac-85a8-4dae-98a6-b7509f873d89", "comment": "Malware payload (Dridex)", "value": "552b290462272bdd522cacb5f3877b2bb9fe8ae52eec85bb672310de7ed23505", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522139, "uuid": "8da11a71-f83c-4908-bdfc-7b6d3b3fd882", "comment": "Malware payload (Dridex)", "value": "3ac26f893135e8594e86f4b18ef4f2b19d33aef0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522139, "uuid": "976cb24a-2275-4089-9e65-c9474b383d6c", "comment": "Malware payload (Dridex)", "value": "3224fd8923bd2b0cfdc1a85f279a08bc673f11565a75f7810ad2646aeb61e90cba3c137362be012cf6d0c9cb9cb4ee2a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522139, "uuid": "7254d0a7-1e65-4ab1-8eab-81739d33eb32", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522139, "uuid": "18c43718-bba3-4930-b0de-92c4f026ba81", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522139, "uuid": "f7d60525-261e-41e1-9173-a4b622bc1d0a", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618522139, "uuid": "cf0fb0b5-b0e0-40ab-99a2-359df3e3db29", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618522139, "uuid": "90354dfd-3e1c-4703-9666-f5af3ccdba34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522139, "uuid": "ea04f036-cb0f-4a86-b53d-0cad8b0f30a8", "value": "552b290462272bdd522cacb5f3877b2bb9fe8ae52eec85bb672310de7ed23505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc144dc-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480834, "uuid": "6850aecd-5467-4254-87f5-033968fe408b", "comment": "Malware payload (Dridex)", "value": "bb3e2f98c56cfc9fc417dbf114e2f5fe", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480834, "uuid": "7073ebab-3771-452c-9e66-bffc3898e0b2", "comment": "Malware payload (Dridex)", "value": "553ed59342a9f1a00e10a0cf49a8a04dc31a5610fc914c02d191f3f6a9f5c98e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480834, "uuid": "78a841ba-5fd6-4e88-9749-f267a586a3bc", "comment": "Malware payload (Dridex)", "value": "37e9ede9b8a002b6193548d519e25cb255403f7f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480834, "uuid": "86c09a17-b9fe-45b4-8c25-a64611094bee", "comment": "Malware payload (Dridex)", "value": "8b5dd22e770735d2a45dc92e03eedfe067cc622849f9b6cca585c5dc506d6f39d9d1966419b8bb575082150f1aa93a01", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480834, "uuid": "b60c5ef8-6bec-4f8b-a6f5-8b4acd67ae90", "value": "65F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480834, "uuid": "649fb45b-dc62-4932-9ec4-556af9a93758", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480834, "uuid": "8f157c10-f7ad-4b8a-b512-03209f595c7d", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480834, "uuid": "c8ef4605-6d45-481b-a525-518a91d72e6c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480834, "uuid": "35835c39-a301-4259-9c82-94e5e102b433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480834, "uuid": "e31daf64-9a09-4a9b-9cec-837bd667e1e5", "value": "553ed59342a9f1a00e10a0cf49a8a04dc31a5610fc914c02d191f3f6a9f5c98e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82de4f31-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "d2bd2b1a-223c-4830-ae7e-da2df06871df", "comment": "Malware payload (Dridex)", "value": "c6de920efcdc5e7ec2e844dc74c9a7be", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "8ff03f1a-f875-4f7f-a9c7-ebfa2bc9de9f", "comment": "Malware payload (Dridex)", "value": "553ee519733bbc084267bf4bd0770fb348ee777cea41490984edbb7c8e883090", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "0fed86c2-1bc8-45d7-9191-0c87236a5dc8", "comment": "Malware payload (Dridex)", "value": "377fba2f7d0fde25486c549ac8c932aebf587bd0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "0c11dda3-5d6e-40e0-8aea-3adb4720a90f", "comment": "Malware payload (Dridex)", "value": "a2847672c81d83ced8e0a0fb6c26b6da8808c5bc6fafda764f04674e48910252ed2a12282b7e76e5ec546c7223c2e36e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "82d79702-65f3-4f1e-ba3e-3a206ff273a4", "value": "42F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "6fed2a8f-d46f-43bd-a7ee-34576ff93140", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "669143f9-90dd-4fe3-a0d6-1152c0a86c31", "value": "3072:GA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:G3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495905, "uuid": "b6a2e2e1-800f-43a0-991c-63e505252e03", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495905, "uuid": "2ec94bda-cb03-4554-afd7-a850e32baf89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "e9079690-4b80-474f-8595-d0a1a8bf33f8", "value": "553ee519733bbc084267bf4bd0770fb348ee777cea41490984edbb7c8e883090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aed38de-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497180, "uuid": "9a06f4b3-487e-4c39-91b7-bb52003ce02c", "comment": "Malware payload (Dridex)", "value": "367fb5d03f7ca65044b44ded2e0a2ea3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497180, "uuid": "9b0a2d75-1f13-4bd4-822e-4ea334222f4d", "comment": "Malware payload (Dridex)", "value": "55505e268eca1759dab0ef17e7a0cbe0f1a79125e9964dee6def4938f5e0139b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497180, "uuid": "c86002e6-62f4-4a31-83e6-ce5c63b85b52", "comment": "Malware payload (Dridex)", "value": "2e43fb9fb4164b630e560cb779f88a517e0a68f6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497180, "uuid": "c11ef5a0-b5b8-4125-97a8-161ed0c2548b", "comment": "Malware payload (Dridex)", "value": "17859d2183c086e9d14fb0f755880b1625b5cb62577446d012d1195b3345d815483feb596c826797fd66828530078af2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497180, "uuid": "027fe8b3-faa7-4949-ac03-205f7c65108d", "value": "E6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497180, "uuid": "ad1774b1-1fb1-4839-9b8f-32727d89d2b9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497180, "uuid": "dee71c01-606f-4cf2-ad7f-7abcb60e3fbe", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497180, "uuid": "f260a77a-6a41-4b34-a3f2-05eaff8ba1a3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497180, "uuid": "97455ce6-5cc9-404c-9354-375af484bbaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497180, "uuid": "5229ca58-d2e8-4541-af47-2758c819309b", "value": "55505e268eca1759dab0ef17e7a0cbe0f1a79125e9964dee6def4938f5e0139b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc9b34a-9df8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497615, "uuid": "3a76749a-2696-4505-941a-3a7a04d4eeee", "comment": "Malware payload (Dridex)", "value": "c4d2e9fbc7a873b943a5b05c8578fff4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497615, "uuid": "ae49b3dc-373e-413c-90be-843de6ab3b31", "comment": "Malware payload (Dridex)", "value": "5555a65a58f60a40308c173e7a7d90d53559f17141d41ea039a1163592d4829b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497615, "uuid": "a4af7286-2aa7-4cf7-bffc-86ead316ae0d", "comment": "Malware payload (Dridex)", "value": "6c27d7a04453aa93c376b10b15ada302b0ce10ab", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497615, "uuid": "89ccb683-936e-4237-8432-1675da0b7c03", "comment": "Malware payload (Dridex)", "value": "e7c6003270b5f128a9a4ccfcb6cbad4f368d38333c308f09a4e96342cdb90725e11d1ccf7777247ad92dc0f2eebcf528", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497615, "uuid": "31b7f95e-f81e-4b60-8599-c8d35cbf7527", "value": "69F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497615, "uuid": "34aad4ae-00e1-4e78-bb9b-048c42cd51af", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497615, "uuid": "823cb671-5c4a-446b-b811-ddada05b656e", "value": "3072:MiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:veAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497615, "uuid": "5e4eb59c-d8b7-4eb0-912a-6df81af7fbe3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497615, "uuid": "f8e56d70-d83c-49db-acad-79c02a032261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497615, "uuid": "85df0ff3-9f7b-470b-802a-fbb3038fa12e", "value": "5555a65a58f60a40308c173e7a7d90d53559f17141d41ea039a1163592d4829b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ba895b-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "e3b3980f-05c5-4b1d-b88d-d090f6dcf647", "comment": "Malware payload (Dridex)", "value": "bb7d44581f2d5d1f1927b27e4f3ef5aa", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "b43f4915-69f8-49db-b925-b24bb6aa9b6d", "comment": "Malware payload (Dridex)", "value": "556e07b56fee3d126e128277a969babaea398ee33678287fbe8e87a89046c85a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "7f75091b-3fbe-4393-a120-df6e9b36a777", "comment": "Malware payload (Dridex)", "value": "b9974e9224330802392df82e84e6818a73bed4ce", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497086, "uuid": "9cd4a62b-740a-4910-8eaa-b583f43e3239", "comment": "Malware payload (Dridex)", "value": "68cd8e2c7dbcae3c5600acd510b99ae963b5d34e3a2cd160f7707eb4a633c5a6f56e9939e691f03822edac96789f48d9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "e1594b60-4d27-41ae-9c45-d5ca0e0fec1d", "value": "35F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "d500ef8c-17dd-42cf-bdd0-1b8287612d32", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "daea6aa5-96a7-4e17-878d-8c9e6e3ab97c", "value": "3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497086, "uuid": "02390232-496a-45a7-a39c-4f16c7b6ffb2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497086, "uuid": "9d3ae0b5-e061-4313-915a-4be859523360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497086, "uuid": "460be4d1-c521-4a38-89f5-9aa2a047ac28", "value": "556e07b56fee3d126e128277a969babaea398ee33678287fbe8e87a89046c85a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43806f98-9e08-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618504389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504389, "uuid": "2258b0e5-bd65-403e-8dc2-b2072fa4580c", "comment": "Malware payload (Dridex)", "value": "3df595b4fd8406dba7ac00ec03d12e2c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504389, "uuid": "9126bdf4-d455-4dea-b55b-cc6b2ff69f26", "comment": "Malware payload (Dridex)", "value": "55a53546d7819284dc28d84252c12873a9a7f07b9d135727b03f88dbf59fbe67", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504389, "uuid": "93d699dd-fcc5-432a-a1f9-25d66e740b45", "comment": "Malware payload (Dridex)", "value": "51445a4fde5b5f6cb3ba05b521089dcb179415c9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504389, "uuid": "154673b7-28df-481b-a4cb-9e7e5817d11c", "comment": "Malware payload (Dridex)", "value": "7d576fbd5c109f23e5b2307d61a2099b7435aa4539d3578b45b73012cb630f0f5face587d2747da5e1d77d10cb82dca4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504389, "uuid": "e4ce6f3d-650e-46c3-90df-df712e2d69ef", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504389, "uuid": "a120b3ae-cee2-4468-8ee5-ad815a36b9c0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504389, "uuid": "6e91392a-1620-40ba-9e7c-603c3c89a324", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618504389, "uuid": "59fd642c-de02-4bd9-8f5a-606a857aa3ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618504389, "uuid": "8ce05107-04af-4a25-b4b7-c890b9a0775b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504389, "uuid": "120386e6-9047-4a03-9ef8-ffa558059d95", "value": "55a53546d7819284dc28d84252c12873a9a7f07b9d135727b03f88dbf59fbe67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d0fe02-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515957, "uuid": "bdc747cc-9655-4810-8369-2b54df0323a9", "comment": "Malware payload (Dridex)", "value": "8dc400f54599f026d7863c8b80f44d25", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515957, "uuid": "37f4a1bb-451b-4270-9975-b5cb85d25b56", "comment": "Malware payload (Dridex)", "value": "561d52ae441e53dddd9d5e8355cf940fbefb9b45f8794d3e93563ebaa447b1d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515957, "uuid": "22edc7d3-683f-45a0-b814-987ffc70a6bd", "comment": "Malware payload (Dridex)", "value": "edb81a0e1656a78ec0cd439229af820855fac894", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515957, "uuid": "dd036122-3870-4152-a16c-7c2a98ff9f14", "comment": "Malware payload (Dridex)", "value": "7cf2f7d0a9b1f6f72991c897c2192b7ccf693a8a0991bf640c01d4a45dbff2c28722e06b30ceaa0dc5b99bce82557b31", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515957, "uuid": "a8699102-d45c-42c6-9003-e0b9728f1038", "value": "33F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515957, "uuid": "241d964b-87e6-46f7-962a-832003d39a91", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515957, "uuid": "cb7d7ede-c7cf-4d92-b049-f2f934a57c46", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515957, "uuid": "a23a1f2d-0e52-464e-9dc6-71d7f97f9d37", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515957, "uuid": "3aa0b8bc-a4db-4708-b691-cd124576df31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515957, "uuid": "861253ae-f4f2-4286-959d-9ed3294583dc", "value": "561d52ae441e53dddd9d5e8355cf940fbefb9b45f8794d3e93563ebaa447b1d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda26ff8-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496058, "uuid": "e740a62f-0758-4905-948b-96d6bad8aa90", "comment": "Malware payload (Dridex)", "value": "a90a88e98a37b24d4a606067b1090ff0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496058, "uuid": "420a94e1-5341-4abb-a4df-bfa1706bfdad", "comment": "Malware payload (Dridex)", "value": "562398e4c5c108b3da4c441be0ecbd9c691736689cc482d11a03e2d1b9aae8a5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496058, "uuid": "756a4d32-ef24-4c8a-93a0-408919ac5cd5", "comment": "Malware payload (Dridex)", "value": "19dc030f69f2a566c5fb8532804d29e2f658bd51", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496058, "uuid": "203f7210-ed38-4c6e-b1e4-363ae907a34e", "comment": "Malware payload (Dridex)", "value": "701bedfa5754aca025bec0486362f38adbf374cc4ab947feb2a687c0dc20dae2dbe03e5cb489176562920c0dcb7ffba0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496058, "uuid": "d895059d-abb0-4ca9-aaca-61b46ac7e036", "value": "53F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496058, "uuid": "865969cd-d232-4a88-9f3e-6f45993aa119", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496058, "uuid": "0ecbc99b-28e1-4ddd-ae38-9698c399269c", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496058, "uuid": "7beaf0e4-55f3-47ab-85b6-3485b6be95ee", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496058, "uuid": "86e2d774-44a9-421f-9248-52b9594a038f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496058, "uuid": "b1f73436-e603-4498-bfea-f9aaa0efbc92", "value": "562398e4c5c108b3da4c441be0ecbd9c691736689cc482d11a03e2d1b9aae8a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868d624b-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496770, "uuid": "90f4acb5-4ccd-4324-bac4-c3bf8f537743", "comment": "Malware payload (Dridex)", "value": "724d462a152f0013e3bed529fe0866b0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496770, "uuid": "e083f475-536f-40b9-8690-5e3f2aed60a6", "comment": "Malware payload (Dridex)", "value": "56317ce16c70bc1bf58278cbd59a2c664dbb67e40b60e6eaec4de298b1413d22", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496770, "uuid": "3153b5e1-2d00-4c92-9a55-87bde688298c", "comment": "Malware payload (Dridex)", "value": "e71db2f10f5ec6561a782a38997f4fe853d5c73e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496770, "uuid": "e02bce0f-aecb-4302-9ec9-46d1a4fd28ee", "comment": "Malware payload (Dridex)", "value": "cc3a4879ee33f1f2fe38b10f4efe57989a0b38413be2b4002f509c7b1ecd904f60103d1d2e31611edd0e5804277a8d25", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496770, "uuid": "e6507b65-88a7-4467-b307-0b1d2b30c02e", "value": "CCF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496770, "uuid": "3715848a-aef6-4662-b7ae-3bf6335de15d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496770, "uuid": "bceb0b1c-54fe-422a-9254-894727170b02", "value": "3072:5A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:53J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496770, "uuid": "ef5e0e28-0c14-4af6-9351-51efbe7ea713", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496770, "uuid": "08ff54a1-0eb3-4ace-afdf-d167b241ddfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496770, "uuid": "e2da2f71-7f14-4b24-abed-55497b6a5af4", "value": "56317ce16c70bc1bf58278cbd59a2c664dbb67e40b60e6eaec4de298b1413d22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c5f3ef-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496741, "uuid": "a7a70fad-50bf-4a2c-8e95-30b1d52ce0dd", "comment": "Malware payload (Dridex)", "value": "297adf83fbd26800f8cce9eef4eddab2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496741, "uuid": "3e534001-64fb-4111-b44d-2d7cdc8490de", "comment": "Malware payload (Dridex)", "value": "5631933c3e259e9eaed3f51c9e69dc7e96cca4b2cf1b88adbb70aa23de3f56a8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496741, "uuid": "8ecc24c0-ef66-463e-9169-b2f3b72b1bec", "comment": "Malware payload (Dridex)", "value": "ad1f41a1edd08af57762905ce68137c67e0cf704", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496741, "uuid": "7b102d33-7434-4808-8252-a31ba4eccf6b", "comment": "Malware payload (Dridex)", "value": "0eac21e0e001b72a699106b26fa68d1c7bb3c56f273bdb810a0c67df6084c15fa91540bea375896e60323b2515fb6f7c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496741, "uuid": "46575b20-00c5-43a4-948f-527835608ce8", "value": "D0F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496741, "uuid": "2ffd9885-09f4-40e8-a4e0-d484accb16c1", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496741, "uuid": "95f7927f-3149-432f-801c-9591b763e7fc", "value": "3072:8A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:83J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496741, "uuid": "323bb68b-d503-4444-be21-6b1b7f4588a0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496741, "uuid": "d1b354e7-bf82-4e26-9101-d47722de195a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496741, "uuid": "2ea1cf5f-5a52-42e3-9d62-5fc2db272f16", "value": "5631933c3e259e9eaed3f51c9e69dc7e96cca4b2cf1b88adbb70aa23de3f56a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92967abf-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "cd5fd9e4-272f-41fd-b387-2be99c6d8850", "comment": "Malware payload (Dridex)", "value": "d09584288b2c3a186d44b05003133f8a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "772c289b-5b94-4f9d-8440-d8782f1780fd", "comment": "Malware payload (Dridex)", "value": "564603cadd2aae3035051e261b3f8c183dec90159c731674db614b58687fbc9e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "f1f6e3b1-7330-4c17-9b0e-281f414fce91", "comment": "Malware payload (Dridex)", "value": "e3f1a52a707fe4f73bf2323f96d60ef90a67c911", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495932, "uuid": "a8e6ffd8-415e-4f56-b774-ca11e9c66a1e", "comment": "Malware payload (Dridex)", "value": "c3f539520f2746419532623e26d2d4fe363713603ecb26a4e8f6c6835a5f48d9395d6287f0f14cac9d86d1e5cbc861b0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "5731f5aa-2ffe-473b-9c0b-998f4cc1fdd5", "value": "67F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "f8630871-2d66-4b4d-954d-836243dbcc34", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "7779f59e-4407-4a1d-8502-f376817a20b5", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495932, "uuid": "64a60676-3aa8-4c4a-9528-22f543f635a5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495932, "uuid": "cc1dc7b0-508d-460a-b6b0-09af174ca165", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495932, "uuid": "aa590a53-0b84-4905-92c2-7b31c17d5c32", "value": "564603cadd2aae3035051e261b3f8c183dec90159c731674db614b58687fbc9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83d479b-9d99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618456964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456964, "uuid": "d6d8b935-80ba-48f6-b4be-50a9885a12c3", "comment": "Malware payload (Dridex)", "value": "dfe4c4dc8b27305ec6895c7c8a18d876", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456964, "uuid": "48d3974b-7d3e-4172-9339-ff602907c952", "comment": "Malware payload (Dridex)", "value": "5666f803e8b4a504069e5ef8f8a7ad17ebec0790580052e25bd89c9d807ba602", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456964, "uuid": "dfea0c67-dbdb-41e4-8404-6994a287d939", "comment": "Malware payload (Dridex)", "value": "72b005ed1dd0611141f95eb490050fc4c048249a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618456964, "uuid": "ad80c29d-f689-4e1c-8e86-38dea760ae64", "comment": "Malware payload (Dridex)", "value": "e61f4cc59ac208f9aedae16078642f3ae8d796c78787d4ea31d32aba565c017c2819e9d584f8d74d735b647dabbc5ce2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456964, "uuid": "f61c5aca-73a6-4ec3-9b4e-723f3807f136", "value": "33249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456964, "uuid": "6cb5c31d-ba2a-4364-bbe6-3b1ac9c16ccf", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456964, "uuid": "7d2fc673-9af8-44f6-b351-c71c7d845b07", "value": "3072:S0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:RpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618456964, "uuid": "3103a2ca-f4ec-4dff-8183-a1ff69a01ab5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618456964, "uuid": "c0fb6b47-57e0-4a47-82cd-58e379252ec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618456964, "uuid": "e5ffbcbb-63b4-421e-9f68-bbfaeeb00343", "value": "5666f803e8b4a504069e5ef8f8a7ad17ebec0790580052e25bd89c9d807ba602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0b067f-9e32-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618522578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "de354de6-d901-4846-93f9-295e7d4e8a7c", "comment": "Malware payload (Dridex)", "value": "ab57eb8356bfe42c5503c331053786c0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "61550759-6b47-410f-9c0f-4902b32f02ec", "comment": "Malware payload (Dridex)", "value": "56a528865d7ff820f9957620b9e0dbf1f50823a497fb35ec59692cdfd6ec817b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "f33adb37-0311-43e8-a630-065021df21b1", "comment": "Malware payload (Dridex)", "value": "524d73fe9aea18ac28a279f0dbebd0a4343a6011", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618522578, "uuid": "16f61672-8089-422c-9286-7c85abb9e18f", "comment": "Malware payload (Dridex)", "value": "f6458c694b7c1e1aefb4a08d4f71cd55b331334e40dcc71aca0a9593b88233d0e3b598eebab60b28b6fde58c56ce75df", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "ae37f0ec-d24f-4bc2-93e0-c4313ceee060", "value": "13F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "9f1633e3-79ed-447f-a24a-a42f02f35917", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "fa88ccbd-3d4e-4cce-b541-fe875da271d7", "value": "3072:gA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:g3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618522578, "uuid": "13333231-dfeb-4b31-a382-a747ed65627d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618522578, "uuid": "09a25b32-4a94-48a9-b65e-397df7fde981", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618522578, "uuid": "f1047da1-dd1c-48ae-b2df-7a83e4a2ceab", "value": "56a528865d7ff820f9957620b9e0dbf1f50823a497fb35ec59692cdfd6ec817b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312a77fd-9dfd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618499634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499634, "uuid": "346afd54-5fa2-4da5-acd7-6aff79681ef8", "comment": "Malware payload (Dridex)", "value": "25e20799f31dd4ad0afe13d8ee90e184", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499634, "uuid": "26e4bfdb-320c-4022-ae0b-632fa573b399", "comment": "Malware payload (Dridex)", "value": "56a6e0e48aeee026889ae659c1f2aceade323e8d87cf8c77f2a8bfa08115028d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499634, "uuid": "2a391692-6b33-4ffa-9f0b-a84ddaa958e6", "comment": "Malware payload (Dridex)", "value": "428a5b03b809a142659b0fc6e020d31610387f9f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499634, "uuid": "96dbaaac-f87b-4ac6-b720-0e947c933823", "comment": "Malware payload (Dridex)", "value": "dc265650dcd83886e55714c27487fe98825d52e7adfa132f5976491e5ac4686057039fe90dc61d7e94e603f1b02b1b5a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499634, "uuid": "012a89b7-e7a6-436b-b175-da1121812653", "value": "A5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499634, "uuid": "7239f22e-f84b-45b0-ba3c-389b83ba14bc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499634, "uuid": "787f003f-4462-491f-9c20-7e494e1c4fc5", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499634, "uuid": "b5038aa2-cd2b-41d5-bf35-636723f76de4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499634, "uuid": "28ed090f-32d3-48b6-9518-510bde2e27a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499634, "uuid": "a90820bc-2e4a-47e3-8884-95116610bd12", "value": "56a6e0e48aeee026889ae659c1f2aceade323e8d87cf8c77f2a8bfa08115028d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e798acc-9db7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618469564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469564, "uuid": "e38ea3eb-ee6a-417b-ad0d-da9cca343237", "comment": "Malware payload", "value": "353d1fd18af7306adf9bcf830c8feb83", "object_relation": "md5", "Tag": [ { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469564, "uuid": "aa3f579d-91f7-4eec-9eab-bb2e4f0179e2", "comment": "Malware payload", "value": "56d0a1d000f4553cdd0a270d0bacaee05633bd2c28bfece6d7476a0e30ade599", "object_relation": "sha256", "Tag": [ { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469564, "uuid": "1961d1ac-75c2-4a61-b7b3-abb895b933d8", "comment": "Malware payload", "value": "b67528872b9e282408649cd5e9a9356a8d8b73e2", "object_relation": "sha1", "Tag": [ { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469564, "uuid": "420460b1-60b6-4f43-a05e-c0c2952e1b7a", "comment": "Malware payload", "value": "a5bdef73fef8a186697994fc34bfc35e4fa48d9b30dcde143e22902baed2f3e20f379e6377ed320bd51c9b104b90e3d2", "object_relation": "sha3-384", "Tag": [ { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469564, "uuid": "bfb20ec3-0748-402a-9fd2-3c55e933f022", "value": "BEA2C01AA436A3B6C0A3D8BDC80C01E086597052E741B48D3592E7DB7682AF337DD7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469564, "uuid": "998d6f45-a1f2-42d0-9635-2f06e202167e", "value": "384:TLgZDPTEAaxi9Jtm+77F1RGxn8TxAXqZDJVpteA5x/0UlM9zxpG08ruF42q+sl:TEqYn04F8n89AXqZtDtvp0xW0pFNsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618469564, "uuid": "b4d28dc7-24fb-41c8-8adf-0c21b7e1aee1", "value": 22368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618469564, "uuid": "71781803-4d49-4389-b14f-287b937f1e0f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469564, "uuid": "384c1bf4-8a16-4305-95a3-598c7de4784d", "value": "r84060.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b88bcfd-9d81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618446528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446528, "uuid": "2ef21c52-865c-49cf-9de6-f1e86e5686bc", "comment": "Malware payload (Dridex)", "value": "24863397848e3f051950c978ff085379", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446528, "uuid": "70272f74-53a7-4ddc-9889-913c84dc5723", "comment": "Malware payload (Dridex)", "value": "5705f53bb73d6f6f07d4bac4854865c7f9b51bbea725092401cebb973bbfa95c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446528, "uuid": "9f1a8303-41c7-4305-a779-891d35676aa4", "comment": "Malware payload (Dridex)", "value": "ca88b74922c8ba28469e244ee104f53a63e33728", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446528, "uuid": "f76165f3-10af-427a-b0c6-9e254960709d", "comment": "Malware payload (Dridex)", "value": "e67ded5dddf99880744c81dedb485550d65158de8de041fb00261afc153b02e012252e3eb008b566490cda40bc918863", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446528, "uuid": "c728a5a0-6383-49f6-9786-57f5818dd6b2", "value": "82249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446528, "uuid": "afd1277e-4375-4201-ad56-e9d4fd3347c8", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446528, "uuid": "6794f7c1-187d-4756-b5bd-91fa519c1bdc", "value": "3072:l0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:opepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618446528, "uuid": "92f296c9-b725-4121-bd0c-b8b2da5e411f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618446528, "uuid": "6a6ea1ba-07cc-4332-a191-9eef430f8600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446528, "uuid": "6de331f1-ba47-4300-8b5c-f551976d146d", "value": "5705f53bb73d6f6f07d4bac4854865c7f9b51bbea725092401cebb973bbfa95c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbea1f00-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "7ab0c0eb-2fb5-4f0c-8b27-612146eb2955", "comment": "Malware payload (Dridex)", "value": "2db46502608938f95a3452ab5a8493f0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "119ee10c-bdf8-4125-a429-eb96ca3e22a2", "comment": "Malware payload (Dridex)", "value": "5780b6eb9f3a9319364714c2db276736ea114870f68202a9abb0044c1bcc6d45", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "30afe5e4-391f-4e60-bb76-be7b2f899c8c", "comment": "Malware payload (Dridex)", "value": "7567127b753f365e39044b314b03ff395721cbb9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464245, "uuid": "e9c9e8fc-a462-46b6-af3f-e8030cb0c0e7", "comment": "Malware payload (Dridex)", "value": "50e4be1de543a59e361b4ea13dae4f0bdfd80ceeee9ef16af88435b7824e0f440368f23cd1162bc32b8b4b4c7c13d096", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "06bea4b0-5483-4eee-8056-a5f306f00c83", "value": "70F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "fb656995-92cd-4690-a934-080c30f3d4d9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "cec2d4b6-e8e3-4c99-9219-ca98ea9d6960", "value": "3072:HA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:H3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464245, "uuid": "97e45423-533c-4e21-b4a8-225c63e501cb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464245, "uuid": "4dc12fea-7a76-4f56-bbdc-a0d8bbcc673a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464245, "uuid": "3f48ca7e-fd75-4046-a2a4-093197f63749", "value": "5780b6eb9f3a9319364714c2db276736ea114870f68202a9abb0044c1bcc6d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c17bf4-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "663851ed-f5b6-4438-b162-b685373bec7b", "comment": "Malware payload (Dridex)", "value": "90db49a3b2321b9e4fe585a08100694d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "771caaeb-e568-4f62-905b-8adf91ef74cf", "comment": "Malware payload (Dridex)", "value": "57874c8b19ca99a6a1f4b41d178ee48652e9f69a111938ab6e1c46ef97126d1c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "57d274c0-d1ef-46d0-8a20-32f6eea129f8", "comment": "Malware payload (Dridex)", "value": "0799f1e8c72dc69aa953d0f0b6514d2b803dedc0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "154726c1-3eba-427d-9ec3-89c8480a3cb1", "comment": "Malware payload (Dridex)", "value": "cad851f423d34c69ec50ac43e539732e7104ff598f78453fbad6a8f89024af7e609a0ac15ef39ad3843d23a7c4370e88", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "870face6-a4f3-4433-b2fd-2d82512bc72e", "value": "74F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "b445920f-544e-46ec-a20c-15df054cfd8f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "d806614e-77fa-4847-adae-64d42851ae95", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495905, "uuid": "b4478f09-173c-41e6-9402-7734e7f144f2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495905, "uuid": "9c6689ca-0a90-4c53-b5ce-631d8d87d9f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "310531df-a1d2-4a6f-8e08-dd067e9933d5", "value": "57874c8b19ca99a6a1f4b41d178ee48652e9f69a111938ab6e1c46ef97126d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b2d5ca-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496316, "uuid": "cce56c21-6c7d-445e-ba8c-85a30ea9c404", "comment": "Malware payload (Dridex)", "value": "46ea8bd2b0f8310d6f37ff9bdc341c04", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496316, "uuid": "c766b8a5-1e10-4702-9359-2868e1eb57d8", "comment": "Malware payload (Dridex)", "value": "57bd0004085e59554028c15de567f44c002e38eb309eb3db92147258a2be14da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496316, "uuid": "a2a0ea63-43fc-44ce-b696-dda2766552ba", "comment": "Malware payload (Dridex)", "value": "3c0c149bdbc7ce2aa40676748df7c23264871584", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496316, "uuid": "dcad892e-2ed5-4a7d-904d-f8acfa374ec1", "comment": "Malware payload (Dridex)", "value": "3787d8b0b131a7d3b6e891e933c40d09c24731bc92d07fe8c3d52b48062ea1890726c12cdf588f33a62aeb462c47b0a1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496316, "uuid": "3996a8d5-a5fd-4ab1-8b50-69e585891fb4", "value": "DCF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496316, "uuid": "80104827-0837-4057-af0f-357f62e576ad", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496316, "uuid": "cf75e333-29e5-40a4-a478-3fdc0b8e10d3", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496316, "uuid": "88e8cf54-ca1d-4cd6-ba8c-313c7747bd0e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496316, "uuid": "98be1f3d-4f33-453b-93a7-37dd8e0e2d58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496316, "uuid": "aad9afc9-9e11-49a7-b06a-ec1dc9223d12", "value": "57bd0004085e59554028c15de567f44c002e38eb309eb3db92147258a2be14da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334fd549-9e45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618530561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530561, "uuid": "5b0c0880-3d6e-42b5-90e4-41fc193703ff", "comment": "Malware payload", "value": "71583f98be6b7c466744c0671a0f410e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530561, "uuid": "03768c4e-fe62-4844-ae9c-f37da1526890", "comment": "Malware payload", "value": "57e997b6592b88cd3d0e961b888305984d5f78ac67728a19642a17dacc9d818a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530561, "uuid": "b91087dd-4066-4e05-aa2d-40eb3399930e", "comment": "Malware payload", "value": "92eb12654f416f0e8bc8fb0defcc16124dc212a1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530561, "uuid": "f3684b67-a8ac-41a5-b08f-abb76fc6c6c9", "comment": "Malware payload", "value": "f5e01bc5ecf8147fc56da3c98da3e7c427b9d05d2d60be54bbb45f17f57076d15055166912bcef1a0da688da4febdc4a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530561, "uuid": "dcc22944-0080-4723-950b-a33dc102423f", "value": "1CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530561, "uuid": "471f807b-3290-4a0a-aaf9-359bf6e4e81d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530561, "uuid": "e97bc366-05f0-4d0d-88ba-243046db7d81", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618530561, "uuid": "4949a768-9741-4871-aa79-4e571d424b9c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618530561, "uuid": "9dd6dc0c-323c-4441-a859-2bdf03137b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530561, "uuid": "896a8ffa-497b-4449-8d33-2e5dbf3d6ac7", "value": "57e997b6592b88cd3d0e961b888305984d5f78ac67728a19642a17dacc9d818a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7e825c-9d80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618446051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446051, "uuid": "fe4b9bf0-92ba-4cc4-a58a-f5faf3d940b6", "comment": "Malware payload (Dridex)", "value": "3d12f4df16ca1573a828f09fb4aba00c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446051, "uuid": "01761ac1-7d3c-46cd-94e4-5d35141d4a1a", "comment": "Malware payload (Dridex)", "value": "580a83077412cc83ba32dd85ab65b5683c0bca550e85a98674a250630faa48ba", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446051, "uuid": "1673a59b-d215-405c-902c-26f9b5dd7a0f", "comment": "Malware payload (Dridex)", "value": "aed4bcb8888d48ff8e78f4218725aab3718b0f73", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618446051, "uuid": "1d7b21ce-92cc-47bf-b2dc-89bc8accafd6", "comment": "Malware payload (Dridex)", "value": "a8533eaced79c5f0fadbe6fd3ec17db8cdd9be9a8cdd0356ad025d794ef4d610c363d8263b74965087134fdd5ed87c23", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446051, "uuid": "a5f567d3-2d44-4900-8d52-f88607bd0d0b", "value": "CEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446051, "uuid": "bed661fb-e79b-4f91-9081-8a9deed8327a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446051, "uuid": "00e2c9c0-3548-4bd7-943f-e41193c6f298", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618446051, "uuid": "02378786-d5f9-4dcd-844e-cb340388e483", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618446051, "uuid": "0522ec20-eee6-4a57-a822-557eb2359c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618446051, "uuid": "b75fe03b-102d-4dca-9714-884a0531b4b9", "value": "580a83077412cc83ba32dd85ab65b5683c0bca550e85a98674a250630faa48ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdd4596-9ddc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618485532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485532, "uuid": "8db12384-9a9f-480f-810f-21362f8ea9b6", "comment": "Malware payload (Dridex)", "value": "7394ead37024369c5f8f5bd02745f7d2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485532, "uuid": "87f9caff-e6b8-4f01-8e7e-d59763c89920", "comment": "Malware payload (Dridex)", "value": "5848962e5d68d22dfb6afcb3e98fb31d8bfe3c9abf5d4777da376b3f6d60a71d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485532, "uuid": "56fa23fa-73aa-4be6-8135-7757b63113f7", "comment": "Malware payload (Dridex)", "value": "67ff26b9d97974e83eb9b9a4ebda59eaa267ade1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485532, "uuid": "555e943a-31c5-424a-95bd-da08028e6d3b", "comment": "Malware payload (Dridex)", "value": "af87986c3dd8926d2aa9c5baa916d50ad243911b5b88c323c5a72ed412fe2a7d5e0bfe1bc69d585ebe7053718e8cb680", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485532, "uuid": "23002665-6a81-4c8e-9201-cd9c377f7f3c", "value": "5B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485532, "uuid": "874f7dc1-a029-4108-9d07-e482ba26b68a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485532, "uuid": "3b3e5ec7-77fd-4200-8768-1dfa544870d0", "value": "3072:00DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:/pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618485532, "uuid": "eacb3228-665c-407c-8003-6d9dd1fb4bdf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618485532, "uuid": "be9b27b2-c1ae-426c-a3e9-1383e677363a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485532, "uuid": "164f9110-d5d5-4516-a64c-ca0597838bfa", "value": "5848962e5d68d22dfb6afcb3e98fb31d8bfe3c9abf5d4777da376b3f6d60a71d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a08d169-9db6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618469127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469127, "uuid": "e6f95a22-fcd7-475a-a01a-9e7ae9019117", "comment": "Malware payload (Dridex)", "value": "7bb49d48fdb3d5653d4d0209646a37ac", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469127, "uuid": "020ff62f-463f-4cc7-b27f-a52aea0212e5", "comment": "Malware payload (Dridex)", "value": "586c2f5c8b3696f695ad61c005bea20f092c7667aa91d2787ac5799acfb83121", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469127, "uuid": "d3b8b5c9-c61f-4968-ab98-4567e7c71d7f", "comment": "Malware payload (Dridex)", "value": "79081a28e12b0dc2d295d9909f8490c5743e9c77", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469127, "uuid": "40e8dceb-5c95-458e-9c82-041396af025d", "comment": "Malware payload (Dridex)", "value": "09d56af6eb190edd8fd4dce568ba4c1cb30b1ac5572e4eba45feb889a036bd5550bbe8ce36158a3c589b0f1b6d96dcc7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469127, "uuid": "28bfa469-8e60-40d2-b152-7fc8a03262ac", "value": "9D249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469127, "uuid": "87486090-a83a-4571-8ea4-55a5f646d8ce", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469127, "uuid": "d8c8f396-7ea1-4a69-a4f0-6d0842302f5b", "value": "3072:F0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:IpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618469127, "uuid": "5fb9a8e2-78a7-4811-9fa8-d113e5f0658c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618469127, "uuid": "cd5f35fa-8c49-40ef-b026-f4d357cf1b7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469127, "uuid": "33dc5510-cff0-49f3-a94f-97c8de654efb", "value": "586c2f5c8b3696f695ad61c005bea20f092c7667aa91d2787ac5799acfb83121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53b647e-9dac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618465066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465066, "uuid": "1c08fd50-ac3b-46b4-86cc-4ffba6f42a9a", "comment": "Malware payload (Dridex)", "value": "da8717a26c3c93de39977767da91fcec", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465066, "uuid": "54bcd4eb-25a8-45cb-a551-68b9cf5d103b", "comment": "Malware payload (Dridex)", "value": "5959776379c2c4f9eaedf26b14e065b796c20fe156c2649895a2110a5580331c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465066, "uuid": "78c0aec0-a693-49fc-ae9d-bfce1c6cfbe4", "comment": "Malware payload (Dridex)", "value": "924957c47904df4c753887d777982bd721249cff", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465066, "uuid": "628cf41c-f120-455b-81fd-907dfb11a13f", "comment": "Malware payload (Dridex)", "value": "0e9269328dbe62531838640f88b5b5ad691360a42c34d654472e4c5ced1999c90d9b47a9a4b1fe4572ec8015471b1755", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465066, "uuid": "46a5ea0d-e6eb-4bfb-a146-ed5e2a3f13a8", "value": "BF249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465066, "uuid": "2dcb87f9-0fe7-4929-8964-6cd528a661b0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465066, "uuid": "d6c560d6-d18f-4d77-aab3-f0a42cf5eea3", "value": "3072:Z0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:spepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465066, "uuid": "fc8f975c-9834-4460-b147-48641917d69e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465066, "uuid": "5257b597-4fb0-47f6-8935-6fcd7744730d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465066, "uuid": "d72e1991-b906-47df-8de2-e66796c2314b", "value": "5959776379c2c4f9eaedf26b14e065b796c20fe156c2649895a2110a5580331c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ce682e-9e06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618503834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503834, "uuid": "c4d3adaf-d5c8-4ae2-9737-aca5fef658cd", "comment": "Malware payload", "value": "8c43d10f3e5d0015e264c68e8d709b4d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503834, "uuid": "e7d60f2a-2aee-44ee-8477-49b43e5860e4", "comment": "Malware payload", "value": "5a0b7eabed4bafda0c9d8bb58d10e712cbb9126d11fefc5f7154a6bf16d04776", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503834, "uuid": "c9fb7b3a-c5d8-46b5-8558-a6fb6b32431d", "comment": "Malware payload", "value": "54d215a3bdef5fdf8341b57a90a1f6d95a4f2a9a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503834, "uuid": "ecab71ba-0a0e-4ff0-a7bf-d4018e3d4bf4", "comment": "Malware payload", "value": "b70e9b7af93c6cdabfbd52474be181fc0a174c69ada007150d30a94639ae29e56bfa137225ee5cd4fa00323a833aaa2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503834, "uuid": "c5c06cb1-77d2-4539-90a3-a8cfceae43d6", "value": "33832BD2B74ACDE6DE4983350DEB86532B13FC048F2647837594B31D7EB5EA06E02686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503834, "uuid": "8a53f22e-cb64-4aa0-9765-271a5adf9f44", "value": "1536:oFx71TB4e0P24Oq8i4Ck1f1bNHpVNR2xEtjPOtioVjDGUU1qfDlaGGx+cL+LIfdZ:oFx71TB4eE24Oq8i4Ck1f1bNHpVNR2xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618503834, "uuid": "cc0051ed-35f3-433f-bd62-06c5400d0694", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618503834, "uuid": "91e28fe7-9204-48e7-8cee-013764c62301", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503834, "uuid": "2487e41e-faf3-44b2-a0f0-ff63141fd67d", "value": "5a0b7eabed4bafda0c9d8bb58d10e712cbb9126d11fefc5f7154a6bf16d04776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9fbedc-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "d6350e7a-5fb9-4609-bed4-0de073f07497", "comment": "Malware payload (Dridex)", "value": "dd01bc1d76df8a22c864f972615cd413", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "4cf5f039-9501-4003-9647-bdb45d570466", "comment": "Malware payload (Dridex)", "value": "5a10e6105756abea607dbd3a1133ed9d5d2847c8b5b2d90a8d5938b455c72f61", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "45a6cb73-cde1-45ed-badd-9211610752f3", "comment": "Malware payload (Dridex)", "value": "9082e3edeab71dad167fda954077e458c290a4dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464169, "uuid": "c2ccbe2e-fa22-4683-9739-5f76fd5c80cd", "comment": "Malware payload (Dridex)", "value": "17face120417e3040a360c4384e3ca8c76cbea55d6732e4f96ef5727aeb853540aa55ed4c5889bd5e7262eb5b55c8b24", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "5aa569c3-81fb-431e-8bb9-67bb483cd401", "value": "BDF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "d210d92b-5a2b-4593-97bb-7a106c1a37ad", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "e8c7cb9e-84f9-4c41-a906-764732af46c0", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464169, "uuid": "d52b0b5d-4e35-4616-9e70-0f9fc80e3783", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464169, "uuid": "ac04a1c2-6821-4987-8b6a-9683a8a3e141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464169, "uuid": "dcddee66-e200-4243-9e94-0d15a8782bf1", "value": "5a10e6105756abea607dbd3a1133ed9d5d2847c8b5b2d90a8d5938b455c72f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b200af5-9dec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618492430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492430, "uuid": "8ddf4685-cb7c-40aa-8a2d-5c5d75819689", "comment": "Malware payload (Dridex)", "value": "59be8043d2f2d6394fcda471f010774d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492430, "uuid": "ae950b80-1574-4ee4-9486-7f4f07809a62", "comment": "Malware payload (Dridex)", "value": "5a7095ffc9c2ad6b8b8bb91e2c51e71441845c1cfd39008f897ca15a7360f973", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492430, "uuid": "dcba7312-b44e-40b1-95f6-39fe4641ccdb", "comment": "Malware payload (Dridex)", "value": "c5eb802629b4f8d950d783b79c25c27a381c6607", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618492430, "uuid": "4efd4186-0b0b-4610-9e49-1e19230075b4", "comment": "Malware payload (Dridex)", "value": "7b7f23e7e404801c71b8ddfc18172b6d264e727319a856e44557b706b95bd5908bbe4cd227494af3d976ea42749b74e8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492430, "uuid": "b659f074-17b1-4483-a9f3-f03a443ca612", "value": "66F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492430, "uuid": "fc9c2e2d-5ae7-4e7d-9966-a7425647dd87", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492430, "uuid": "eb6556c3-5626-4b8d-9e47-9442e5d0d673", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618492430, "uuid": "553642bc-3e4b-4aa7-82f8-87f901c4c83b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618492430, "uuid": "149fcce8-2706-47f2-b8dd-9d5db77da62d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618492430, "uuid": "8db0d36f-de71-4aac-9bf6-9390d753d691", "value": "5a7095ffc9c2ad6b8b8bb91e2c51e71441845c1cfd39008f897ca15a7360f973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10d5d3d-9e2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618519686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519686, "uuid": "81a6b42c-0dcb-477a-a8b4-519d6c99f5b0", "comment": "Malware payload (Dridex)", "value": "c280c6230f8a367f33796806bb3593e4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519686, "uuid": "9390f247-8138-4e5b-9337-7252d23b5ebd", "comment": "Malware payload (Dridex)", "value": "5ad357e43ad895b10ddf485e4bd86475bb098ca6bea5da1c4d0d3b0a62a940c6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519686, "uuid": "0a59c4c6-44a0-4a7c-ae3f-6eee741eb84b", "comment": "Malware payload (Dridex)", "value": "88da90beb0b8ab828941269a3723539b702119ce", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519686, "uuid": "dd905c44-9252-4095-8700-dec562214ed0", "comment": "Malware payload (Dridex)", "value": "2c26167affa3676e10b7d98d9f1b1f712054ed58e8da5873f846eca2e8133f42104533c1d6789a052e31136d089f6dec", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519686, "uuid": "efee003f-260e-43ed-a21d-0793e63bfebb", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519686, "uuid": "1e0377b3-2657-4f2b-8330-a283e758d955", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519686, "uuid": "00a3226c-60f9-4e96-afe6-b3eae66f7d77", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618519686, "uuid": "6e9c850f-d32e-449f-95da-d08945c20e0c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618519686, "uuid": "0c260749-f5a3-4eed-be0e-4dc46ceb6704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519686, "uuid": "1d813f75-642c-4ffd-a4b0-b7b4b2deebc4", "value": "5ad357e43ad895b10ddf485e4bd86475bb098ca6bea5da1c4d0d3b0a62a940c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e255cb-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480735, "uuid": "b6b54bae-ccfd-4d2a-b1b1-a688d64f1760", "comment": "Malware payload (Dridex)", "value": "e0eac25762af96f3ebf7f808c0b384f6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480735, "uuid": "5d9fed65-264a-4888-be6a-06e89fbb9ee2", "comment": "Malware payload (Dridex)", "value": "5ae01229da1cf85a647c1fdafa210d3fe24f7684a3b0faeeaaf74b7845e5e2d3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480735, "uuid": "a9c7d56a-a0ca-4680-8d2c-69f5b40189df", "comment": "Malware payload (Dridex)", "value": "92589eaa77d359107dc9e77a1cf5f7e89840c57a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480735, "uuid": "16a52149-7d9a-43cc-9afc-2e0f938f9c5f", "comment": "Malware payload (Dridex)", "value": "2068e2d45dcc768b031f60d69c1b09052941e323c8bce482d8de5012c7061f075ef6787f084962aec13b9efb16b9390b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480735, "uuid": "68f5046e-57b7-4aab-a40f-40c30f83cfe8", "value": "A4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480735, "uuid": "d1feff54-145d-439a-be3c-b1022fbba178", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480735, "uuid": "8655c5e3-2c6c-4d59-a11e-d43695068e8d", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480735, "uuid": "ccd68fd1-84e9-4c98-8c31-5a5f7171be18", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480735, "uuid": "19ad0f46-8f85-4504-857c-003ed6bd4c6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480735, "uuid": "7da6ad4e-a0a4-40d4-9cc8-68d511d46abd", "value": "5ae01229da1cf85a647c1fdafa210d3fe24f7684a3b0faeeaaf74b7845e5e2d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6634d08-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618499079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499079, "uuid": "ec53039f-a4e5-45d9-8ad5-9ab4cdfe40c0", "comment": "Malware payload (RaccoonStealer)", "value": "46c1325f35cd5958dea23230043a5e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499079, "uuid": "bb3899b1-4e39-40f6-8873-7d55fdf2a823", "comment": "Malware payload (RaccoonStealer)", "value": "5b5534877ef572fd9c6ae870ab966c102fee3a010c89cbb8baecc249fc03e508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499079, "uuid": "04506830-e083-4b9b-b386-be9d81adf52d", "comment": "Malware payload (RaccoonStealer)", "value": "796e8b3e485625d1e052696c651ad6dd93e911cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499079, "uuid": "3a0f6c37-0c66-43fa-978f-5fc63b479f00", "comment": "Malware payload (RaccoonStealer)", "value": "d36f0ddbf36562b70a8aedf3f1d9a5e690ea4539f9afb3e6ee4c211339861a870e8a3245d399c37c45b1d8deb2055eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499079, "uuid": "fdb7e758-4694-4b89-bdad-783d321103d3", "value": "1AB4E11136C0C033D4A7347589A8C7B62FBAF8716766968F6BC41A7D5F383E19A2170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499079, "uuid": "a2d4fc10-4ef8-4a16-82c7-8de027b2ba8d", "value": "2664b838a9541d474d829395b94a2f9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499079, "uuid": "c9081484-8fc2-40a4-bbef-83df9b36b543", "value": "12288:za8GNBlwv438xpKiZLRsrEIwMN1vYnQ8d/ntqQsuWTl:ZGdl8xk0R2VAQ5DTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499079, "uuid": "f06199c1-79cf-418f-8be3-85e67d9cb46e", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499079, "uuid": "6efa2aee-d3d5-4e59-9b40-22aaad085639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499079, "uuid": "18667f80-58de-4593-9734-f145cfc41382", "value": "46c1325f35cd5958dea23230043a5e84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb67dc6c-9e0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618506415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506415, "uuid": "9cda4a16-fe4f-4610-b99d-9518ceb1ef72", "comment": "Malware payload (AgentTesla)", "value": "ffc73a26a666a82c595a3c80fc258639", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506415, "uuid": "1bcd0cbc-6bb1-471a-bbd6-b7aa89e23f06", "comment": "Malware payload (AgentTesla)", "value": "5b581a16014e2da4a70c5e35b95366e09adea3c2b705f80fe68f18bb4e5cd215", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506415, "uuid": "d0aa6341-b5bc-406e-bc6a-bf81eaedb711", "comment": "Malware payload (AgentTesla)", "value": "b61d7a5fd1994c3dcccd2a556660b31be884f946", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506415, "uuid": "ea9bde37-0b13-4fee-8862-0167ee4cf411", "comment": "Malware payload (AgentTesla)", "value": "c261239f0fd4cb5540d49c5109cfd5a9aa4f185e567874befe89e113eb4edfae6fca5b3b774528d0baed4833099cc85d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506415, "uuid": "90704232-b569-4325-acc8-bc80bf135f0d", "value": "A905CFE125848605D47F46F44C9AC72033FEBD1E9927C5093AD7F1AD4A76AC38E17A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506415, "uuid": "90a82ad1-eddb-431c-8be5-d0c96dc34637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506415, "uuid": "eb809d3e-fef1-4868-b95e-828319c534d2", "value": "12288:h0XOOBZAzKtEqhw+jgUPQRtmcXIfKWCG59GfBDiNiCylf+xdH:h0XP82ONmJQRtmclQ9MDFlf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618506415, "uuid": "cd52c743-0d4d-403c-bdfe-78e4eaba3d1e", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618506415, "uuid": "f9ff3f8e-84c1-461c-9595-d959db987d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506415, "uuid": "47e2d21a-7f4e-4240-85ba-369c9869f2b8", "value": "ffc73a26a666a82c595a3c80fc258639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e2737c-9e0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618507636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507636, "uuid": "d61d4d32-f20f-48f7-8ab5-b46ff59673f4", "comment": "Malware payload (Formbook)", "value": "4071c5e2f3e94a1276801d76c124b186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507636, "uuid": "ac8e12d5-2e3a-4703-8f40-706453651938", "comment": "Malware payload (Formbook)", "value": "5b7770f02c562dffdbe0cd638e288adba8f340c7231ef30fa2860b7f4b9dfa80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507636, "uuid": "a38bfba9-c686-4558-af99-b042d3bf699c", "comment": "Malware payload (Formbook)", "value": "ba943442982765dc8ff137d479cadba5c8922889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507636, "uuid": "ca6deadd-f0e5-41da-a2ba-870298d387a0", "comment": "Malware payload (Formbook)", "value": "b6833999dbd925ac8a6f4be94238d5aac39971847c04ac99b2d5bffd4f3ec5d6b3f578546a8727691d50a90f4aec916d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507636, "uuid": "02662380-f03e-4097-9c91-6f0aefd921b3", "value": "64F4BF3037A99305D8BE5F740835828027BABA57FE01C75D6CD4129C9E73A57CB22BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507636, "uuid": "46cbb50a-bd1e-4176-a441-fff8cd81cf9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507636, "uuid": "1a7f288d-5971-4ff7-83e2-ed60693b469a", "value": "12288:ncRJsutkHCXr1FBBM1BgxIDW5v9kdUeZQxhPDDaA99TC2TXJEoSa9YKxz:biRBM/RoOtwj/CIJEjadx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507636, "uuid": "74c37c33-e3af-423c-9d3c-469c219d4c1e", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507636, "uuid": "f2d78748-ec41-4139-ab68-d6c2b1b87fb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507636, "uuid": "c44b52e9-858e-4103-9ced-3aafa80b2ce4", "value": "4071c5e2f3e94a1276801d76c124b186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9572f0-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495900, "uuid": "09312c71-0aea-45fb-9e0d-d1e7d4861dee", "comment": "Malware payload (Dridex)", "value": "4536b3943fbbc5ff7350db2aa456b9d8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495900, "uuid": "7c0741e1-3ae9-4824-8504-3c0e55214dfc", "comment": "Malware payload (Dridex)", "value": "5b84d2d4dd6f2314ae40503d24ff80d61294b687b78df1f7614a2b895eef6f62", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495900, "uuid": "9b3f9399-7a12-4b52-b256-063dc0aca342", "comment": "Malware payload (Dridex)", "value": "48f8d8f25fa894ae46af064a09278a9c22adb6f0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495900, "uuid": "5e24c5b4-1894-4ffb-992e-f0cca704d5fc", "comment": "Malware payload (Dridex)", "value": "9edab94b02c97e4c717d682dcf152cdf2878ba2dc9131fa186a68cf232b42247e0fb7684634200aac86f5fec1f55588c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495900, "uuid": "20437b46-f819-4b16-963f-4b98d84c529b", "value": "38F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495900, "uuid": "c3ece533-31b9-4c33-bddb-01610e70b87f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495900, "uuid": "f5276b83-0f43-4bad-bfe0-f5b6019795ea", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495900, "uuid": "fb7f843f-c701-441f-9b9f-15bd6b14348b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495900, "uuid": "afdb1b18-9e8f-4782-8cfe-c092bb3bcca4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495900, "uuid": "ce477cbe-8e9d-47ac-afae-c6742cc2c0a5", "value": "5b84d2d4dd6f2314ae40503d24ff80d61294b687b78df1f7614a2b895eef6f62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b91f679-9d94-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618454500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454500, "uuid": "0cb92078-e68b-4115-97b8-5ec631bd726d", "comment": "Malware payload (Dridex)", "value": "435662450d577e65bcfc4e1d266655f6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454500, "uuid": "ea1a8cf2-ab5e-4d01-9ccf-d552a13ffc17", "comment": "Malware payload (Dridex)", "value": "5ba9f0254ebdf93a07d8e92b2ef75a31584f8300ee2ab92cb496cfa640732039", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454500, "uuid": "832a1edb-ec07-438a-b82e-c66114b35311", "comment": "Malware payload (Dridex)", "value": "6bac8b29de5efd7a641fe9d701be71f52b537ce2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454500, "uuid": "8c0519be-db6c-4d3c-aff5-571330c343cd", "comment": "Malware payload (Dridex)", "value": "c17ccadaeff5775c09dbbec47f92fddd985c0031eb4d5e1f7b5984c5ca9cb333c808f9346c7ed68259db3242aa9680c7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454500, "uuid": "20d7f752-2357-48ac-b55c-6a65dd3e571b", "value": "C4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454500, "uuid": "3f83c68f-9c08-4a1c-85ef-309606102d56", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454500, "uuid": "0e4b318b-03ad-478c-9f87-c8b4aaaa3a18", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618454500, "uuid": "b12d2928-8db1-4018-8ed6-2726fdcb2d8a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618454500, "uuid": "4d500a69-d1fc-469b-bebf-946a23b5dfc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454500, "uuid": "58295e5f-6efb-41fe-86c4-d264f67c806b", "value": "5ba9f0254ebdf93a07d8e92b2ef75a31584f8300ee2ab92cb496cfa640732039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df941f62-9e04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618502933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502933, "uuid": "584a746d-a254-4fca-bb99-6aed1a087259", "comment": "Malware payload (Dridex)", "value": "8d5f6491a7668f8602620ff8f1c69bdb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502933, "uuid": "c11ddbb6-496b-41fd-80d6-3b1f803552f0", "comment": "Malware payload (Dridex)", "value": "5bbd05a1beb5e8aba6f2a287e3388794924895cf256afd09d7786337f2112a9f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502933, "uuid": "5b92f07a-d941-46b3-9244-0cb1944afa32", "comment": "Malware payload (Dridex)", "value": "97489f53918fb9d8c84115dfb24b3b30cffeb43b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502933, "uuid": "d8fdff1b-5f4a-40cb-b293-6462dc44de4e", "comment": "Malware payload (Dridex)", "value": "c156d8be34fc59c9f8b89c9613af7f3c68385d3ec5bd409d456e4979dc3907ab398afd552dc3864523136dabeb3ffc42", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502933, "uuid": "ffc37959-b5c5-4371-9312-fa0db37e8c90", "value": "F6F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502933, "uuid": "58b9cfc0-20be-4afa-8e5a-4a051790aa3e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502933, "uuid": "b0a82b56-6b39-451d-be95-f01e8e18bdb8", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618502933, "uuid": "ae898dd7-d80b-460a-933f-d2b8d42aa52f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618502933, "uuid": "047876e1-af42-4cbe-9d3e-8b8fca90d822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502933, "uuid": "00b69591-7e68-48fd-979d-3f8ca522f7db", "value": "5bbd05a1beb5e8aba6f2a287e3388794924895cf256afd09d7786337f2112a9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc6d0ec-9e13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618509102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509102, "uuid": "06bf09b5-79e3-4ac7-9330-d64b45cad658", "comment": "Malware payload (Loki)", "value": "db810dd2601bfd9bcf10ce7cca9a348f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509102, "uuid": "e859d9da-74f6-469b-a77b-690b99e4123d", "comment": "Malware payload (Loki)", "value": "5bc6d5322586c6db603d865677401fe5a68ab8d28eb6a5982261d2b899c49dc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509102, "uuid": "294749b1-dc82-403b-833f-d0e3b3991afb", "comment": "Malware payload (Loki)", "value": "c3ebece1d10677d04928c04eea5f92881dd9e15e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509102, "uuid": "93bac696-568d-4611-82c1-ca9cbfac37db", "comment": "Malware payload (Loki)", "value": "9f827f85da866cf31dca2814a30b37745ca116656861ad43494f1dd8867af6b83509454639c05cd26ef87e07ce82af93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509102, "uuid": "41c451ba-f875-4541-899f-b0d5446dd788", "value": "54E3025A32D6EC73F9405D350D6BB32AC8B7070411645AE70B908DBFA777E038FAA186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509102, "uuid": "e5a18b4f-87ad-4249-8b00-1efd4dd651ca", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509102, "uuid": "a9996b31-a329-4505-8083-bbe0d6dee828", "value": "3072:vyewmN4skJDIJLxneY5FrRb2ge8DSvRWyg9r1TmvzVL1iYCc9uiB2UoRk:vdbxneyrRNiRWyM1KvzVL18BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618509102, "uuid": "db269972-a03c-4479-b947-80a8b15fc91e", "value": 149583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618509102, "uuid": "c1827e8f-2333-428b-bb77-9a931ab0e113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509102, "uuid": "3fc49f37-4df4-4fd6-be2b-bd48f33abdc3", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1932d4a5-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497017, "uuid": "e0e39ad4-932e-4eac-8676-b4177e0fbc40", "comment": "Malware payload (Dridex)", "value": "ca9f95a1cfe88607606eaca6e687250d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497017, "uuid": "ed4e235d-cae8-496e-b575-47bb374404bd", "comment": "Malware payload (Dridex)", "value": "5c055683fb7bf39c4f3b01c5683d6d44c963e1e8620ce913a26f8331761a0a83", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497017, "uuid": "d57178bc-f474-4fa5-ae88-396762e97b79", "comment": "Malware payload (Dridex)", "value": "9e492da850b9d9cf376435129916792592bab870", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497017, "uuid": "3d4acbdf-b5b3-4033-8ae9-5f136624aac9", "comment": "Malware payload (Dridex)", "value": "2bea74e52c17e92a12857ed95fe6f244407c9b7601535a7ebbe6a9c91cd251a9b98f64b8681574611ec406fceac91b3d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497017, "uuid": "a657aebe-d5f2-44f2-8752-7e48eafe1497", "value": "2EF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497017, "uuid": "b1165e27-2452-434a-aba4-476f27c3d1ea", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497017, "uuid": "8aa329a1-d8ad-489e-8e1f-fe06033d0fa7", "value": "3072:LA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:L3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497017, "uuid": "63228da8-1773-4c5e-8922-8465e69ab2e0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497017, "uuid": "720fcf83-e3a6-434f-b5ec-fd62e8f78389", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497017, "uuid": "ab7783ef-068d-43e0-8afc-0b0ffc22e535", "value": "5c055683fb7bf39c4f3b01c5683d6d44c963e1e8620ce913a26f8331761a0a83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce93b4df-9dc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618475416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475416, "uuid": "4c9f3851-1bf1-421c-8a80-e76642ccbf75", "comment": "Malware payload (Dridex)", "value": "6923b4382dcd1a90e1781a59f3abbca0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475416, "uuid": "bb4d47c2-69e6-4036-83ee-92ed97776bae", "comment": "Malware payload (Dridex)", "value": "5c12b1360295531fa36aa119557dc9d9e5c38e94aa97c6656061c7a0196c4536", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475416, "uuid": "b03ff996-e205-4044-9bef-0a001a1df519", "comment": "Malware payload (Dridex)", "value": "6299c2862b9b5602ac19cfb530e3124a231ae447", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475416, "uuid": "691a1018-d6fe-43f5-aee2-fa3aeb22590a", "comment": "Malware payload (Dridex)", "value": "58b62542bb7e498014b9e929761cfcd5f7d5eff915b6be09cae34ae6c31b5204427928d47ffd22f2feaa0261c1880bb2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475416, "uuid": "9709cd42-8c75-41b1-b94f-b372977af1da", "value": "C6F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475416, "uuid": "3e0ae390-2094-4c15-9580-74c31c7301b7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475416, "uuid": "ed459df1-dcc8-4a8b-b439-8fcf07f00898", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475416, "uuid": "b1e1ae8b-dcdd-4e0e-a263-56542490b26c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475416, "uuid": "0f6268ff-c336-47c9-b397-5e658afdd065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475416, "uuid": "5c0d464b-3838-4f73-a92f-5b11bddf4576", "value": "5c12b1360295531fa36aa119557dc9d9e5c38e94aa97c6656061c7a0196c4536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f3958f-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618514698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514698, "uuid": "1b1998e9-d5dc-4d99-81c8-b11ff6500bc5", "comment": "Malware payload (Dridex)", "value": "dbee01b2bb07d04ff7c8f62e30b15f32", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514698, "uuid": "15af505b-8a80-4811-980b-8af82e641563", "comment": "Malware payload (Dridex)", "value": "5c23f94efa2398a6ffe92078234e09380002516db41ff57e056e7d793e224a8b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514698, "uuid": "c1848f2f-3c43-4ea3-9a1c-58336af6bac1", "comment": "Malware payload (Dridex)", "value": "e5b50cc705b7e65e19b080efb0cd874247fd891c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514698, "uuid": "ecda26f2-ea43-447f-8fef-4a54396d4437", "comment": "Malware payload (Dridex)", "value": "1cc1df69ba3db5ab3c891b1c84b7d43fc0409cf274956c60d7c9f4c6af16f7ca7a7aaeed4c0b8f731ec135edc2135690", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514698, "uuid": "2aa2f1d8-99ac-4099-9864-ea5cda453d52", "value": "31F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514698, "uuid": "e31c9210-205d-40bf-a301-4091091a0615", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514698, "uuid": "69df0119-dc51-40a9-a92a-f6e2bfef9c73", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514698, "uuid": "dcd1347f-3acd-4b88-a433-073bc48c0bac", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514698, "uuid": "283b7684-9a7d-450a-8086-ef46b371e813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514698, "uuid": "b903d637-1368-4249-923c-d485edba5e6a", "value": "5c23f94efa2398a6ffe92078234e09380002516db41ff57e056e7d793e224a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fab2e5-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480774, "uuid": "3f46e814-dc7a-40b2-bff7-2710683cda16", "comment": "Malware payload (Dridex)", "value": "89eca50681e11cc54e55d585f3d79a5f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480774, "uuid": "cd9d751c-1ef6-481f-ada6-d7d88cf47fd0", "comment": "Malware payload (Dridex)", "value": "5c56f3b6c8b2ea48646506955fdbe536f9699ab28c2f7d636ff0ce9232832fa6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480774, "uuid": "972cffab-0601-42c6-bf85-f0d5ecbd87a8", "comment": "Malware payload (Dridex)", "value": "03e2e4ee1d06653197efb126805633fc10b21a9b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480774, "uuid": "ed9b03a2-f557-4559-9ece-5803e1ddc714", "comment": "Malware payload (Dridex)", "value": "fe3bce3868246be87376b6f1f17cb57a780cd147be3ca5457f256b3b4b06c28aa594d016c07c27ca765b5a0682fa939a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480774, "uuid": "740c8518-0b8c-495b-ae7d-02ec37cc7da3", "value": "73F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480774, "uuid": "2f404627-bb63-42ad-bbbb-660c35b68262", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480774, "uuid": "ec3fe3be-690d-4b9d-812d-155845309734", "value": "3072:XiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:seAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480774, "uuid": "75f63172-e42a-410a-b992-2221bdde39df", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480774, "uuid": "a61e4dfb-e6df-4ba5-8ba8-28f596f40f3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480774, "uuid": "68c56c6c-6faa-46d8-8ced-9f9b66a8f533", "value": "5c56f3b6c8b2ea48646506955fdbe536f9699ab28c2f7d636ff0ce9232832fa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ffa569-9d90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618452850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452850, "uuid": "79c8c465-9c5d-4fcd-8dbf-b4c0f169a4a1", "comment": "Malware payload (Dridex)", "value": "d58eaa91772e8ad19d9ada61d81ce57a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452850, "uuid": "ca9daf0f-5b37-4ff4-908d-4a1685533861", "comment": "Malware payload (Dridex)", "value": "5c6c56db67650cf5fdbb70aa676a7b9f10a33f402e06aff188149a669ddafcd2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452850, "uuid": "b9fca9a6-6db1-450f-b70e-d38df97475e5", "comment": "Malware payload (Dridex)", "value": "603aa479284715a73ee696786a0cabe6622d5e5b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452850, "uuid": "309c81e0-79a1-4d48-be8d-3c11e7bad79b", "comment": "Malware payload (Dridex)", "value": "4d569e25b8dd76b2f43874b04b6160b28fc6063a7c8557242c87a5435e16a7ff5ffa8e8f999c7ac357f07365c982bce5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452850, "uuid": "2910aec5-9b1e-4668-83c9-fc8a61336b71", "value": "5F249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452850, "uuid": "12901ae4-706d-43fa-9be6-24d039203d25", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452850, "uuid": "83e8a394-80a0-47f7-84a7-ca7ca3f106c3", "value": "3072:D0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ipepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618452850, "uuid": "36922618-3cef-4f69-951f-9ae74905eb9d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618452850, "uuid": "8eb6106e-0176-447d-899c-1457900df629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452850, "uuid": "186fe428-099e-4bd7-88db-c184458c26f4", "value": "5c6c56db67650cf5fdbb70aa676a7b9f10a33f402e06aff188149a669ddafcd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1ae693-9df1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494822, "uuid": "fb99efb7-b042-4786-81c5-8c43428ae79a", "comment": "Malware payload (AgentTesla)", "value": "8cefe7cda37fc1e8ffd8b553f26ab705", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494822, "uuid": "9fb2f7d9-d20e-4a7c-ba30-e0a8bb2a22b7", "comment": "Malware payload (AgentTesla)", "value": "5ce274ecccde9392689129836ff7550d0aa46bbafb6628fb51c893fc2eb65ef9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494822, "uuid": "bcd6d6bb-c5fb-4f0e-aa3b-6df16e8250c1", "comment": "Malware payload (AgentTesla)", "value": "45f6d7a845d5ca9934a52ffbd82069f9107636ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494822, "uuid": "ac29b4ed-3c4e-4fc2-ac28-6496d88f911c", "comment": "Malware payload (AgentTesla)", "value": "e073a2724f7cf6f051d65ab2e043a3b714c82bcc79a3033ebba0381e477504c1295f53ee4b9fe1f10df37451eb4f5ee9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494822, "uuid": "0ef25d32-6e2d-487e-ae2f-16c3b5e10bd0", "value": "88B49D90268DFB86E42E1BF58860553053366D13D322D66F9DCCB9FA1EB0B82F85D253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494822, "uuid": "ab15c47b-8058-4f89-8688-3def150e4d05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494822, "uuid": "9a46fa62-e77a-49ab-baa1-5624cbd79eb1", "value": "12288:d2TaGLO/0DBq4IsZjPO/n48For61QoQr:ITxO8DBVD1PD3r6+oQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494822, "uuid": "2259e08a-b15a-4e24-8500-8226d84af8ea", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494822, "uuid": "9de0cf0b-0065-43c6-a404-82d8af17f13a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494822, "uuid": "c2e3bd8f-0140-4517-a9ea-13ae8367c80d", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ff4367-9e02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618502056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502056, "uuid": "979aafb1-b3c7-414b-8356-f5688062eda5", "comment": "Malware payload (Quakbot)", "value": "937f940caf972b6c393dfc47cf872a14", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502056, "uuid": "946a9e04-f9d7-47bd-9323-de02daf604ed", "comment": "Malware payload (Quakbot)", "value": "5cf03d4c4ed5a25dc90ecc5b2b4624c808b901a308e1eac4881e87460eff05ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502056, "uuid": "310515ed-bb9d-4de5-8aa4-e20f494fa93d", "comment": "Malware payload (Quakbot)", "value": "b1255b9b6cfbd7a5a4fe316f4f47126ac5059559", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502056, "uuid": "3b41f0b9-d012-445f-bc0e-a47b1c820e18", "comment": "Malware payload (Quakbot)", "value": "a29a4721e5bc3a0ad2f051b767d8ac6008977738c9de0e27a87fbf17f0f6a30c52205435ee41cef8671c6821b0768641", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502056, "uuid": "9f838a6f-9776-4daa-8c07-f7be5aead295", "value": "F565BF21E1A044F7D1732A38BD7B529858297E003F249B4B2BE91F4F1F396817F652A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502056, "uuid": "02a719e1-bc8e-499c-bed3-8216b973768f", "value": "5ec428896cb05f428b1caa5c82b8f88f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502056, "uuid": "4db7f192-27c7-4222-9d9e-a18859649440", "value": "12288:efv5C7QAlKsVF3BPwOuuV5NTaDARqHTXIeFpeFpeFpeFpeFpeFZpVzG7Dn/:eHs7ppFFy4+2SjFkFkFkFkFkFNE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618502056, "uuid": "f936bc03-a1ab-44b0-82f2-e8a3707abb71", "value": 1428445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618502056, "uuid": "34791d9a-3550-4c7f-b111-70fbd9122e63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502056, "uuid": "a953b9ac-28dd-4b1a-b11c-4e7135f0c244", "value": "937f940caf972b6c393dfc47cf872a14.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86723e97-9db4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618468424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468424, "uuid": "1c4751fc-a7b4-4eaf-b48e-8c8c8f2f6658", "comment": "Malware payload (Dridex)", "value": "56bd959f609a86f632180e9218fa5b08", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468424, "uuid": "b7cc9fd8-0084-4c3c-b289-51b77c3a95ca", "comment": "Malware payload (Dridex)", "value": "5d1bdf26d0581af605110124120fbbf49f36572582d5c13964adec75807ff9c9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468424, "uuid": "741f539c-6c61-4db6-ac3b-1c822ef3a9f0", "comment": "Malware payload (Dridex)", "value": "abad20ed156ba69e6c578f2ba955cd34befd8b93", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468424, "uuid": "786ae454-f819-4fed-bb4c-850f16f75500", "comment": "Malware payload (Dridex)", "value": "afe2b47b8950b5fdac852b0836b5547c1844f05662748faaf0ee3ab0a18a8c01efbb6aabc9240b1556747882dc43904d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468424, "uuid": "477c751a-2a60-4b21-8895-cd00b0105d3f", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468424, "uuid": "8d4af8df-522f-4869-9d44-63d398124e8c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468424, "uuid": "9c095347-4265-48fe-90c1-6ec1a694fefd", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618468424, "uuid": "ace03253-5e99-472e-a4b4-ce2ca74e3ca9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618468424, "uuid": "aa629fb0-c889-479a-ad69-e8b8f58189d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468424, "uuid": "e4744114-ffe6-4932-ac55-6e3c30d411fd", "value": "5d1bdf26d0581af605110124120fbbf49f36572582d5c13964adec75807ff9c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2e30ff-9df0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494017, "uuid": "bb9df26f-5a2c-45d9-8bd8-ede68abf2550", "comment": "Malware payload (AgentTesla)", "value": "061fc5a013c1eaee3ac66e518ae14b5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494017, "uuid": "9e34a98e-a448-4c12-b5fc-e249a31a9736", "comment": "Malware payload (AgentTesla)", "value": "5d25a93076101beeb74e46ab7d53ab67e0f99ae7b4b122e6583519b5bebccf4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494017, "uuid": "8941c89f-9098-4608-9b98-8eedaecb8872", "comment": "Malware payload (AgentTesla)", "value": "004c8c84b6882cffa2800cb505a161932e699d00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494017, "uuid": "9c697b2e-f687-483d-9349-391926c7cc60", "comment": "Malware payload (AgentTesla)", "value": "e6b3288aacb42d741c8221bbb2c76c31b0431e744671759ad28c509b171045f7668408341407be8c5ef8370e0b534b75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494017, "uuid": "43fd5bfb-e893-40fc-a3ba-30dbac4d47f9", "value": "EF255B9772F85E26F0BE4773806330C453FEAC47D726C6AD3DD154A82D62A81A62DF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494017, "uuid": "d0c70b5b-2840-40e8-a77d-dd6c4e3ebc4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494017, "uuid": "84e8e7a2-da5b-44b5-b967-b2803bf57de3", "value": "12288:bWv4L84l6wz4TbYXwNssVAvTnLIpotaWdsnwxYKHJuwqBKRq6ASS+:avWaTbYXHvTc/WdKwx3xTRq6vS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494017, "uuid": "89898062-047d-4e74-a7a8-98474c6eae4a", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494017, "uuid": "9482794c-24ab-4971-8c82-258cb1fd7664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494017, "uuid": "c791cb99-d336-4460-bd9e-241e93580733", "value": "NCCPLOO6HBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435bc3ba-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515985, "uuid": "70cb7063-97d2-4a77-97c4-06d5d9af16c7", "comment": "Malware payload (Dridex)", "value": "e7e96bd090ab62407e671e9c0bced3c5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515985, "uuid": "3507184e-1e1f-4e5d-a6c8-df3e3594b335", "comment": "Malware payload (Dridex)", "value": "5d5240a92af7b16ac541cefd6f17cde3f26a955b373bcecf2b64db20890d845e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515985, "uuid": "0b272af9-bc7c-4c16-8f53-bce2b0674bdd", "comment": "Malware payload (Dridex)", "value": "10797d77deb589e75f8260d2e90e179c97775ceb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515985, "uuid": "fec76b4d-bd63-4daf-bc99-9e095b5c4aba", "comment": "Malware payload (Dridex)", "value": "04c91e2e97a8ee0bb4c489d666301c704be2bc94ffd8460973288970b357c28c2b7da10d3c8715945fac6f54105a3ab3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515985, "uuid": "eb7355ac-0d81-46dd-977b-71c58b0bc006", "value": "05F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515985, "uuid": "fc7d75ea-7e8d-493a-8f12-5783aaecbf8a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515985, "uuid": "44c75afe-e81b-46fd-a2f1-300b273aad32", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515985, "uuid": "2dcbf673-9e1e-44a4-8b9f-86cade525eb6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515985, "uuid": "6b8afd29-5ca8-4e0d-971a-fac65647486a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515985, "uuid": "045681d0-64af-4232-b73f-f359a4ee7316", "value": "5d5240a92af7b16ac541cefd6f17cde3f26a955b373bcecf2b64db20890d845e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f511ad98-9d7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618445846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445846, "uuid": "4e84f9c9-1b1a-4d89-a03a-4418ec831627", "comment": "Malware payload (Dridex)", "value": "4e4dd85386bcd15392ae39706d272e0d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445846, "uuid": "a09beee2-8f5a-49c5-b5d7-23d9eebb7546", "comment": "Malware payload (Dridex)", "value": "5d913179f4b74fe83dfa3f07563549a67a6ebec676107ecc528e19f4f28cce65", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445846, "uuid": "10e38055-daaa-49bc-8368-930a5e138f10", "comment": "Malware payload (Dridex)", "value": "108ab7cb635857fda5d571c3fd2d2a33270b77d8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618445846, "uuid": "7405710b-41a2-4a01-9c19-624f3ec539a4", "comment": "Malware payload (Dridex)", "value": "6517f3930323c1a17f143ac232d1aaab2537f3740b62d097b2208286816f89a979c49531545c88dea16137ab656fba9d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445846, "uuid": "f994f748-95b9-4ce8-800b-de79310e4948", "value": "57F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445846, "uuid": "1be21d49-7a26-4abc-84b0-84189c4ad5bc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445846, "uuid": "79fd2e05-ae4d-4de3-b5a6-ec015a0ee2de", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618445846, "uuid": "21f2c5c6-f248-486b-a9b1-09afe702e0b7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618445846, "uuid": "73fdcd09-b17d-4019-9249-222f6cd8f831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618445846, "uuid": "20a04702-b354-493b-975d-a461dd1c1a2a", "value": "5d913179f4b74fe83dfa3f07563549a67a6ebec676107ecc528e19f4f28cce65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc5d20e-9d87-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618448897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448897, "uuid": "57ef7405-d429-4fad-aae3-240f03f434c3", "comment": "Malware payload (Dridex)", "value": "62e5460865e7eadba7b3fe21cfece2e8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448897, "uuid": "4d6addf1-a802-45cf-881e-d31c0d48a721", "comment": "Malware payload (Dridex)", "value": "5d9ddec76e06a758380360da4fc03f677daf95cb5f19682395cb95169ee52c0e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448897, "uuid": "a73a3145-ea01-4b2d-8e48-b1fdf1b62790", "comment": "Malware payload (Dridex)", "value": "94dc8418f4d41c7e4af975fc12945a52d2a6fffa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448897, "uuid": "d451d7f9-8268-4f84-a6cd-0fd2a0a76e33", "comment": "Malware payload (Dridex)", "value": "a40789fd9b1594d7263a2c0e8d1d22828788c83ca2a379151bcde57c36949c6ca4dce1582d3a1cf17a9703d1a125c6c1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448897, "uuid": "387fd999-d2ed-44e3-b7d8-e1e3121d68aa", "value": "44249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448897, "uuid": "29fc74bb-b0b3-4e27-8cf2-5836de7c612c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448897, "uuid": "4f1a3da2-7581-4e82-a746-4a3e0007b909", "value": "3072:o0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:jpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618448897, "uuid": "f1b5c3b2-67ab-4714-b903-27e40dd62e3f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618448897, "uuid": "91f96958-894a-45c8-85f9-665689b70087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448897, "uuid": "458c1cc1-b577-40f9-836d-acd578e372a1", "value": "5d9ddec76e06a758380360da4fc03f677daf95cb5f19682395cb95169ee52c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22803b0c-9d8f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618452364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452364, "uuid": "6feedfd0-665c-4f64-a2b8-a5992766b951", "comment": "Malware payload (Dridex)", "value": "c25ef2288b5753e98ee6340bb5bd5d1b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452364, "uuid": "aa1d30d8-a1b4-4287-b366-51c1e38d8e51", "comment": "Malware payload (Dridex)", "value": "5dd3140d843d1be9a8bfea5e32b7d11c99a3b35dd08a5b23926cf12c347e3c44", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452364, "uuid": "644f9df1-d479-49b1-8c14-40654630c764", "comment": "Malware payload (Dridex)", "value": "b3df0876b9c7791ac80a3771bc5e3f87f55eee3e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452364, "uuid": "b1099d4d-c43f-4656-a635-70863b006d21", "comment": "Malware payload (Dridex)", "value": "b489c9789679617dced9a4643b4fb5ebf359d483bc4c6fd4800bdaa8a9ac7e7f9b84085ab4cad03c8b3936ba16fd2dca", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452364, "uuid": "1639df34-bfd2-4be0-8d6e-cde4e536645f", "value": "4B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452364, "uuid": "2d72e9e3-2748-4bef-ad01-58716185c5a2", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452364, "uuid": "19bfefd1-66a4-488c-acef-b68c9b2fac5e", "value": "3072:p0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:cpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618452364, "uuid": "9a579324-0bee-429e-a31d-4808272aaf86", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618452364, "uuid": "ec3401d0-bed9-41e0-9099-1f13a8ef12da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452364, "uuid": "7c413494-ae63-485e-9c85-ec63d453d0e2", "value": "5dd3140d843d1be9a8bfea5e32b7d11c99a3b35dd08a5b23926cf12c347e3c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162cc13b-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497011, "uuid": "ef33ed19-b720-4fdd-b9f8-a50109301157", "comment": "Malware payload (Dridex)", "value": "976954c417aa80ff4c65101742bee570", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497011, "uuid": "dbc2c480-519b-4ead-85dd-337e90e5757e", "comment": "Malware payload (Dridex)", "value": "5e087b9bef58258dee2e46b695da929ae9b35f71829872a08809fd3e323032a2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497011, "uuid": "2b146b30-467b-421d-ab5a-4e553f26fab9", "comment": "Malware payload (Dridex)", "value": "c1c618fbd27d7d3cd2032266c0cc838127b500de", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497011, "uuid": "1849f27f-a75b-458c-b7ec-33be472b902e", "comment": "Malware payload (Dridex)", "value": "2ecf06a26e6a284247ab954e5e6d96b7487803ec290c870ad7f42ece5a168c0346f7d89ffd0af82d4556e1404cbf20e3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497011, "uuid": "9d39fcda-74a9-4d1f-907c-ff71fe41b4a5", "value": "E0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497011, "uuid": "2c5b39ac-569e-468f-baac-c3ebc6a521cb", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497011, "uuid": "92f12e43-3b35-4eee-8fb0-6eedf7abb23a", "value": "3072:niFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:8eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497011, "uuid": "3ff2fdfb-9c28-4c7f-bf7a-2c93c215a979", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497011, "uuid": "449e25d2-05ae-46c1-99b3-c558f3ec1176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497011, "uuid": "4d4bdb11-3f77-446b-80d2-4c0b610c1995", "value": "5e087b9bef58258dee2e46b695da929ae9b35f71829872a08809fd3e323032a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d024c3-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495909, "uuid": "3ed83d3b-0c95-4742-b3a5-4b0a9c3f2852", "comment": "Malware payload (Dridex)", "value": "c7c800ded81109e1f87456f1fa7b4ec8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495909, "uuid": "485c93e6-ef33-4cef-8e9e-b3737baf4398", "comment": "Malware payload (Dridex)", "value": "5e1e8576071a78472a9b4e361ca2679d9ca540ca159d4668fcdd4b0168fb8ce0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495909, "uuid": "4a592463-af9b-4636-a0aa-93d4fa5f14a8", "comment": "Malware payload (Dridex)", "value": "0811db0f1a94be03628f75a5679b9ec61085e0e1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495909, "uuid": "b336888b-aa0c-4ae8-9c61-6cf7d8ab3221", "comment": "Malware payload (Dridex)", "value": "b91d36b2c2fb07fd73db19249dc22dd5db96986bc0562ae7698888b893d3878f2eff12aafbc341ab20672ad089704fea", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495909, "uuid": "05cb6591-ec54-403b-80d6-9b44ae99ab5d", "value": "8EF3E00AED9FE988E84C55F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495909, "uuid": "dd7a6fbc-b8e2-4f51-9f9d-89d1ad261d2f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495909, "uuid": "dd6658a9-5b8e-44e6-aff3-928812c6cd9b", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495909, "uuid": "7bf78ad3-0452-455a-8662-f89f1fb4e529", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495909, "uuid": "69b9ee2c-325c-40b4-9cdd-d9db8f808e8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495909, "uuid": "14884597-c00d-4847-9e2e-34799698dbcd", "value": "5e1e8576071a78472a9b4e361ca2679d9ca540ca159d4668fcdd4b0168fb8ce0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ed3ca4-9dad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618465498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465498, "uuid": "c5d02f37-e0c8-4dab-8dff-3615c8e0011d", "comment": "Malware payload (AveMariaRAT)", "value": "26be3a515c42d2bc57e190143fe239f2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465498, "uuid": "2be561d6-45e1-4589-8266-e2f66e7e17f5", "comment": "Malware payload (AveMariaRAT)", "value": "5e2d71b05993c4b8e96fec7d0587625bcd45168d1c2deda8be007d7b18da8927", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465498, "uuid": "e877ec77-fd40-4f89-8ef3-c1c829d1ad08", "comment": "Malware payload (AveMariaRAT)", "value": "2049d1c5d7e389f134ce94dc7e3d64cb86a9ff6c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465498, "uuid": "da14faac-0c5e-4ef6-bf5b-20e87733ac81", "comment": "Malware payload (AveMariaRAT)", "value": "2c49b65851c1ea16b15f5e92e22eabeaa6541035b6a1716259b1708aa0873b4f914c00e83fee028588f8858bcb1a07b5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465498, "uuid": "d8d57646-b822-4e8e-a8c0-6e4aa5beb0c2", "value": "3815BFEC321079DFC917CD72C9681C64AA216CBB430BD207A0573AADAA3D697DF141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465498, "uuid": "2356add6-9345-4785-aa96-74331d324bc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465498, "uuid": "d2b760fd-8e61-47b0-8e9a-2edcdd536a63", "value": "24576:57y/8nwZ13a2yTW//rdXZe4dShoO5KjKw:0uwZ13hyq3JXZfdShoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465498, "uuid": "5c219cb6-d3f1-4c2f-b516-308cd396f8ba", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465498, "uuid": "31141c84-badf-4a7c-a42d-e0b42d0ae563", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465498, "uuid": "8e74b3fd-5e84-4765-a015-665374ab326f", "value": "perchase order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5534ed88-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "c30e63ff-e0d2-42af-a9fc-8e530a791bb7", "comment": "Malware payload (Dridex)", "value": "d09c1275d4c65a768025f3497e7358db", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "f7b90a89-597d-49a4-bb86-f36b52130fc1", "comment": "Malware payload (Dridex)", "value": "5ed452a931f0e50ddcf5e49c94079e8ba676960b126233879d60d00780ab1f55", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "614428d0-5336-4aa4-bfb0-881cda15f8f9", "comment": "Malware payload (Dridex)", "value": "885376b51cb99d755b82b482e77a56afaa3e4a5b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "7a235b81-ee03-4959-9567-5a64df48a84f", "comment": "Malware payload (Dridex)", "value": "bfcdbf3702271eede00b2c1b33348075353b74bfa24432ebe1b65662a0d0c25916adb506dff77a3cbe8fe5792c7fabe0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "ae86ec05-7265-4bb1-8844-57f3b8432e25", "value": "30F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "b0192702-3392-4b1c-8655-c6730641d982", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "393a52e7-17ca-4da6-a24f-8af88df4a616", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516015, "uuid": "22df043c-d831-4921-9502-406e9f13acc8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516015, "uuid": "2b787aaa-b974-44f8-ac0c-579b77c72017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "88c2ed03-b777-40b6-a0f1-42a2819fe514", "value": "5ed452a931f0e50ddcf5e49c94079e8ba676960b126233879d60d00780ab1f55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe74e292-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496113, "uuid": "4cfd3c20-2bf0-4e8b-bb3c-7ad053183739", "comment": "Malware payload (Dridex)", "value": "b004be37a58b284ee569cf09c0cca4a7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496113, "uuid": "86259095-07db-40cf-80f3-b6e69dbb5158", "comment": "Malware payload (Dridex)", "value": "5ee735a22af9f1bb9fde87b4dd348030e9ef4afa9ce7605c1c833799d7b04aa1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496113, "uuid": "f8e7e4e4-c39d-4a87-bbec-734ac9e1ab44", "comment": "Malware payload (Dridex)", "value": "a6cc6d1f498dcc7a4d530cabd1caab293006c15d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496113, "uuid": "662235e0-fcad-46d4-aecf-aac5854741dd", "comment": "Malware payload (Dridex)", "value": "71e930601ad80b98742ebb9be166a8b5cee908e4591ecb702ecdd122e67a02a06d483332325056a620f04dd5e26eb9a9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496113, "uuid": "122aa760-7734-45fd-b22e-d4abdab25351", "value": "15F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496113, "uuid": "ae818928-ea5c-4a35-81f0-da2aa7995f9e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496113, "uuid": "3945224b-fdf9-46d7-aee6-44d7ef6190f2", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496113, "uuid": "4bcfd5f9-2604-4014-99f1-e571838163b2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496113, "uuid": "70ab24a0-1c31-428a-bbfc-5c3eca72e90f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496113, "uuid": "8a4d021a-5042-4dde-aeb0-a98307b7ffb7", "value": "5ee735a22af9f1bb9fde87b4dd348030e9ef4afa9ce7605c1c833799d7b04aa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20298abd-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "0b620d5e-e0b1-4030-b9ff-beea536f3567", "comment": "Malware payload (Dridex)", "value": "ccb04ecd0388d7782c91c2abb8e4c075", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "fccfd3b2-7911-4b60-a30f-2474e2ad30e3", "comment": "Malware payload (Dridex)", "value": "5f1decbe76ad6d88233ed9393045e161f689ef0a1b8e67bac3cd37592648709e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "2a07fa0a-c15b-4689-b36f-78954cd925c6", "comment": "Malware payload (Dridex)", "value": "fd4d36392b20afab035d062ed293e9dbab1e73bf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498746, "uuid": "e7b727d9-4c1b-48f7-a4a9-da28d3ea5808", "comment": "Malware payload (Dridex)", "value": "fffa232e231eb7937ee839102c4450520c83081a2267ad9adf1996040db557ec141616ffdf9781385a527b4b605fd7c7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "6f07bd46-4a7c-429a-a481-cc2ecf2cc942", "value": "FEF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "f9cc8eeb-4216-44da-b9c3-9e4dd8a56986", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "d3b9c02e-24da-4101-94e1-b3b65d713622", "value": "3072:oA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:o3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498746, "uuid": "793b0971-10b2-4b88-a92b-0325096b07c5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498746, "uuid": "2a339a9f-1fc6-4f8c-8830-d6259ae0b26a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498746, "uuid": "9bf9efee-37ff-452f-8cf5-14367426998d", "value": "5f1decbe76ad6d88233ed9393045e161f689ef0a1b8e67bac3cd37592648709e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22c27cc-9e14-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618509809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509809, "uuid": "8913b9a2-55c7-4e71-99c0-ddaed8620c3c", "comment": "Malware payload (Dridex)", "value": "75f353da48c86a5413f642abb4383318", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509809, "uuid": "d97ca241-4db6-4057-bb67-885a38d6b988", "comment": "Malware payload (Dridex)", "value": "5f297eaa8fcdc13427adf613931d970ee10d8036e33182d669d5948049be549f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509809, "uuid": "832804ac-1880-4016-bd0a-0bb07b31e71b", "comment": "Malware payload (Dridex)", "value": "88544d087b0d19ca81edd36c1b54344fbf5de35c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618509809, "uuid": "96b2994a-3381-4ad7-b3d9-be7fe7e6c737", "comment": "Malware payload (Dridex)", "value": "935bdd07cb69d6a6367527c56621e52f810cba2c8e4a046cb3a354b896d033e0ed098951f713890fc7ff424fe65ea012", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509809, "uuid": "0e82652e-93df-4d6e-adcc-98d09c49b14a", "value": "F5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509809, "uuid": "262d557b-4027-4ab6-8ef8-a864fdd649a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509809, "uuid": "2ccb56f3-4945-499d-9b0c-34a272fb7172", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618509809, "uuid": "3614b34e-5e65-4e3d-8d30-7dc7df1f109b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618509809, "uuid": "ef3fb458-2050-48f0-ae8d-b1fe080452c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618509809, "uuid": "fea611a4-ba33-4bc8-a21f-791fbac8fa23", "value": "5f297eaa8fcdc13427adf613931d970ee10d8036e33182d669d5948049be549f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2704232a-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "3f53c239-2797-4abb-a407-d4f909cb4211", "comment": "Malware payload (Dridex)", "value": "678a47a5d11395513bb6d68b858fccbc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "48f6acee-be9b-46e2-a0cc-fba8426e2a89", "comment": "Malware payload (Dridex)", "value": "5f63a1a6f192ca0e82fbba1c04ae637dd557ad5c18fd3e7224e1d278b3d3cf1b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "19138503-2e84-4a7e-b5a5-1e4af8a162ea", "comment": "Malware payload (Dridex)", "value": "c84b3dc18e40168f62a9da36c9623d7c9edfc6b6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498328, "uuid": "5f845839-a1bd-482e-b375-bd687f91f59b", "comment": "Malware payload (Dridex)", "value": "0e8c4689c76e0af5a25c1080406427d8ad91b4ef75b49e226a4de2a41b3d128bcdcc10376833de94afdc3820d4a9203d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "c731ad16-25d9-4d98-a04a-ad769f46fcc3", "value": "86F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "3445f365-396e-4d60-b94e-2ee70b25565b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "080d6b3e-85c7-47d2-8200-c2f6552f760c", "value": "3072:EA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:E3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498328, "uuid": "fe8f35df-4d06-4746-a323-7237bb05c05d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498328, "uuid": "e02c45ab-1dee-459a-b911-0f2661734c12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498328, "uuid": "05f3aed2-9c87-4ba9-9fe1-d44edbc40dc5", "value": "5f63a1a6f192ca0e82fbba1c04ae637dd557ad5c18fd3e7224e1d278b3d3cf1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f96962a-9e38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618525106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525106, "uuid": "b8b6f274-26d3-4bd6-bc7f-c2308b367796", "comment": "Malware payload (Dridex)", "value": "8bf9b1b7ac61c2c3c8e64030ae33b11e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525106, "uuid": "03bcc1f8-b7a7-4f5a-b1f3-8803ce9b0bf2", "comment": "Malware payload (Dridex)", "value": "5f64c75681b500658cf82e241bd2acb3bed2af99a24cf0a20e78f6f9b235fb2e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525106, "uuid": "7d5f4049-bd22-4dbd-944b-03b74692fb79", "comment": "Malware payload (Dridex)", "value": "f88b353798678eed79c91a8585c2f150674011e3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525106, "uuid": "470ea5b0-1e1e-4458-8f23-be89afd6ebb1", "comment": "Malware payload (Dridex)", "value": "ebc9ecab94369705336af0cb18c94c311c88e550d3493557050c18d9193e62ffe92292a113c810f8d5bbca4fbb94f5eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525106, "uuid": "e2bcc6a1-fc83-48eb-85f8-d75f6b54e120", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525106, "uuid": "61df8c69-5a2b-4403-9d62-8abd411dc9a3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525106, "uuid": "7f0c31ad-920c-4efb-832d-2fdadab0aa43", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618525106, "uuid": "bcb47050-985c-49bb-883d-5a779b0b3448", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618525106, "uuid": "6f5c7342-1029-4b0d-8a20-ffb0046b724a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525106, "uuid": "3553ba12-8cec-480e-b83b-7f0ab8bcc0ce", "value": "5f64c75681b500658cf82e241bd2acb3bed2af99a24cf0a20e78f6f9b235fb2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8a6037-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498957, "uuid": "fc2c18a6-5cfe-44d1-8c1e-187e88c416b5", "comment": "Malware payload (Dridex)", "value": "600ad2686049c7a1b2ef1b8878978dca", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498957, "uuid": "73e3c21e-bbd2-46d7-a7a5-309c7871ad9a", "comment": "Malware payload (Dridex)", "value": "5f744c4a0c3cd2479bd3ecf15145f0e3505696e6bb57e55b5bc3c646c218af5e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498957, "uuid": "a4c2ffbd-cff0-4289-8378-0052f1db4c25", "comment": "Malware payload (Dridex)", "value": "f4a0f8910c7f4c49717aa6f3872d4ea8e2ac6735", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498957, "uuid": "22dbba41-8dd3-4f3f-8a08-f05cdec530d4", "comment": "Malware payload (Dridex)", "value": "9016a6ceb11087ea4c35fccc50125d9c932f121692c5a74f94f23a9cb4d2e876ca9e06d3b650499aca72a4dfeb938650", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498957, "uuid": "60609929-3f84-4eda-81b9-d0a95f051fbd", "value": "61F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498957, "uuid": "29e63a58-36ca-41a8-8805-cc7de041a78b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498957, "uuid": "a096f0cf-22f5-47bf-b51e-8606ea136649", "value": "3072:oiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:zeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498957, "uuid": "8c86a9d0-3f4f-4f61-a08e-833dda47720e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498957, "uuid": "ac5b80c7-cfc9-401e-a85e-29ae58cd8e68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498957, "uuid": "f5b4f23d-0372-4a8d-a140-085a79d673f1", "value": "5f744c4a0c3cd2479bd3ecf15145f0e3505696e6bb57e55b5bc3c646c218af5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24af82cd-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497036, "uuid": "ca2cac90-a1b2-4048-854a-cb612152e0b2", "comment": "Malware payload (Dridex)", "value": "cb56c0e8cc4f9567c630631826ccea2f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497036, "uuid": "07abeaa7-d8b3-419d-a772-f05bec0cd9b2", "comment": "Malware payload (Dridex)", "value": "5fa3e0f9b815933a117a424010c661bbe2891628ffa6226a4c5b9f0a7b80c671", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497036, "uuid": "0c38ac24-bc34-4887-8df1-7185ce7c0cfa", "comment": "Malware payload (Dridex)", "value": "94344a1f7b9e249e45d167a97df973c71f91b4ab", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497036, "uuid": "4072c51a-b8ba-42c6-b9bc-eeeb002770e2", "comment": "Malware payload (Dridex)", "value": "5dfa2adcb6260115f0242eeaee4eab0aabf459a8b19889521555edd537e4ee1b5d3602b0fefeaff17f098ce2d9127ddb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497036, "uuid": "60208fc2-a03f-4b5a-af5b-6af876314035", "value": "7AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497036, "uuid": "b6c2ede5-cf26-4f69-882e-b336642b35d0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497036, "uuid": "122b9a24-77f9-4697-8f8f-4455040827fe", "value": "3072:7A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:73J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497036, "uuid": "44f73351-e607-4e10-979b-d2aa8355b1ba", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497036, "uuid": "a5fce5a3-66b1-437b-a925-9bfaa0c92f3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497036, "uuid": "10eae194-cfd2-4034-a5c7-04d95dd8420f", "value": "5fa3e0f9b815933a117a424010c661bbe2891628ffa6226a4c5b9f0a7b80c671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f73cffc-9dac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618465003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465003, "uuid": "5ad8be2a-1234-44cb-97c3-c1e13a6aac66", "comment": "Malware payload (Dridex)", "value": "86c1bb8c454c7ead8f6dbdba3b6f5e7a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465003, "uuid": "5d550de3-0d2c-4d61-b5ea-451008850b26", "comment": "Malware payload (Dridex)", "value": "6084a966fba0cc06b2e71e6c69be226ed308fe07c62e6d7218f53c7c6fa98f75", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465003, "uuid": "916a244e-306c-4fca-9fbd-7e7c0f26f06f", "comment": "Malware payload (Dridex)", "value": "48fa1f3e398220da7f5c0ee14831ee3602971b10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465003, "uuid": "19236227-a625-4c7c-966d-c82d7b308206", "comment": "Malware payload (Dridex)", "value": "e8040d224c8753b5c50f92a20542f6def4488214b13f7bb176ccd633c7a5689634262839d0ab69f7c86f4676066748f3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465003, "uuid": "a8a4cf16-c6e2-4228-91a8-22cb525eca09", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465003, "uuid": "8bb13667-64cf-4295-b536-783415f7bb9a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465003, "uuid": "8f303f89-3051-4d59-b047-fd5192f53392", "value": "3072:gqmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:g7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465003, "uuid": "e575ca2e-1982-43e2-97e0-a9b9d9c5b89e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465003, "uuid": "27f07938-8c2b-40f1-82bb-eaed8337890d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465003, "uuid": "cde93d5a-dd92-4d10-ab6f-3f7200403988", "value": "6084a966fba0cc06b2e71e6c69be226ed308fe07c62e6d7218f53c7c6fa98f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a6b225-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495959, "uuid": "f4d85734-15dc-4764-b8dc-ade688be97cb", "comment": "Malware payload (Dridex)", "value": "376d5f67913c90e4ab27154deff182a6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495959, "uuid": "b7d613ae-6156-4ff0-867f-eb5d6f8b207c", "comment": "Malware payload (Dridex)", "value": "60eb16669a1ec4dea9b66f56385c96d6ca7eb3416ef1b3b261269bed4f341c1c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495959, "uuid": "539134fc-510a-49dc-bd4f-34dbccfd97eb", "comment": "Malware payload (Dridex)", "value": "fedced992e52bb4e606854e0929460391bcd9c23", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495959, "uuid": "635c8f1a-3968-4f5e-898e-9f7c93fa1a12", "comment": "Malware payload (Dridex)", "value": "b583c2bcecd4da143007d36b9e13e0a6a7314dc25adec34c3cb1b67a700181673bbc75db3b6880315b86a26cd9990f03", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495959, "uuid": "7e31feae-21e0-4dfb-b1af-44c0abebf260", "value": "E7F3E10AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495959, "uuid": "cb10ae14-b776-4a36-bcaa-a2e505d666a5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495959, "uuid": "3096ae2f-2c75-498f-9b27-8e93f71c0e4a", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495959, "uuid": "9c74e76e-f6f0-47ce-9901-605cdc1014ba", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495959, "uuid": "d6a61649-a39b-434b-8083-2ccc6e5dd209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495959, "uuid": "4950794d-5e56-44a6-a1fd-da9d22c531b4", "value": "60eb16669a1ec4dea9b66f56385c96d6ca7eb3416ef1b3b261269bed4f341c1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78edbd1e-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "fa9cb2d9-150f-4d30-b95d-08e30ba1fd4d", "comment": "Malware payload (Dridex)", "value": "b6cf6d2989637c83f6e042d53832aab9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "e80342a1-96e4-410e-9640-54a99495d46a", "comment": "Malware payload (Dridex)", "value": "616f8e4763e9479abf611abd3d86dd073aefb0b2f27b8f5be87bce7ed96feb2a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "4aa02cfe-a284-4b7d-95dc-cf0b0b17c8b5", "comment": "Malware payload (Dridex)", "value": "c850368ca92494f25756895c0a4bac90593f3b31", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "51e48d1f-bf74-473d-9d5e-2d3ef7a7b3db", "comment": "Malware payload (Dridex)", "value": "15e01f58ceb315942763188765db57ee833b24adce15841ae47401811f4bbc47aa849ad24a30e7d772bbb740a1bdf31d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "771f3c09-40e9-423b-99f3-55f5edbb568e", "value": "DBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "505ff9dd-bbed-4346-be01-c8c1dd0bdf0c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "055a516f-7517-4747-ab4e-bc4a5710c20f", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480856, "uuid": "0200ced4-b81e-4bea-b13d-9dec5e8a6d7c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480856, "uuid": "8efb61f9-5b6b-464d-8d34-6e15f26cc71a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "c08cdd58-4e89-4863-b00c-f947ee180a92", "value": "616f8e4763e9479abf611abd3d86dd073aefb0b2f27b8f5be87bce7ed96feb2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba38d3f-9e3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618527461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527461, "uuid": "3d3c5860-c32c-4720-b2cd-827bd6454c4c", "comment": "Malware payload", "value": "d7df0980835c52d02e7d8352d6342200", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527461, "uuid": "71cd4ffe-1a4c-45cb-9c52-9ebbf7b0730c", "comment": "Malware payload", "value": "619dbd3665ee37cc1fa25c234db3e60ce82596159de52c11d0ce1d179c5f1d02", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527461, "uuid": "57d3be78-56e2-4df9-8aa9-8455e15b58ea", "comment": "Malware payload", "value": "eb0d19112a68421d6dc3a39edc9c8e79180f8a92", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527461, "uuid": "d2a84b40-a21e-4cac-818a-e79e8a310909", "comment": "Malware payload", "value": "d3bd10f09b64f3053fb24743716fa1a600e178774bc86114e82ab3fa552a8680b24b6bafa627454fbc93621d394cb2b4", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527461, "uuid": "05055101-067c-4e52-b86f-b0293dabd2eb", "value": "5845605D3A50E1BEC456C87DCA788C50BE50E0A7421EFA8AD0D305ACA50E7D7BE1E4BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527461, "uuid": "e2484ebb-dc7d-4af0-aacd-e0a9bf6928ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527461, "uuid": "9ca48fde-d164-4df6-9272-b730848b60e4", "value": "12288:M+DjZeDrKkV9FOOlxEpVg+Yb92ioxQiwxqx6FB4T2evsL6xp1lnWXE+OPg51qRmn:MCqiLC90gZeT2tL61EXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618527461, "uuid": "f961db00-fd15-490a-b8a4-405b1eaea8b2", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618527461, "uuid": "56e057c6-f281-46fd-ba7e-86f4edcc896c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527461, "uuid": "8985a8c2-a789-4cea-a173-14db6acc73c0", "value": "Consignment Document PL&BL Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98988c08-9e2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618521282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521282, "uuid": "e1764ae4-3718-4d9e-ae97-7705b8aa6abb", "comment": "Malware payload (Dridex)", "value": "634779d476ef9dc73933b1b392f2dea2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521282, "uuid": "5d391cf7-94d7-4307-885f-c1a2362888f6", "comment": "Malware payload (Dridex)", "value": "61af7681860cf9f18e1de36bdb018e6ccf35d742b22d864ad5bc79c78e32267d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521282, "uuid": "5dcdb946-18ce-4986-8bef-9e874fff5e50", "comment": "Malware payload (Dridex)", "value": "a406aac1ae68f5947dd5cfb7781ce45de8999525", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618521282, "uuid": "f3cd2408-f891-41f6-b779-34f6e518a827", "comment": "Malware payload (Dridex)", "value": "ac12dbc1ef70eefa32f93631a97698e4dfad7a91976dabedeae3be326991e87691ba4b1d53794488ddb4941575abedc5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521282, "uuid": "b3a05f00-b6e4-411a-bd82-de83b86fa35f", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521282, "uuid": "a718e7d3-9013-4b36-abfb-11b72aa7f73e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521282, "uuid": "21aed6ef-f3fe-419f-8f8b-4fa151ae053f", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618521282, "uuid": "959340a2-2770-4025-90d5-47f1ce9a2f33", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618521282, "uuid": "a32e328b-e0c8-4e2c-9ccc-bb74f880dc3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618521282, "uuid": "406cff0c-9650-458d-8541-f0da9a5b40ae", "value": "61af7681860cf9f18e1de36bdb018e6ccf35d742b22d864ad5bc79c78e32267d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5a3915-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Cybergate)", "timestamp": 1618523441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523441, "uuid": "98737022-052e-4331-93f5-de218194e1f4", "comment": "Malware payload (Cybergate)", "value": "06e21af52a3e3e5173a6a53725b1c217", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523441, "uuid": "dd5d5720-82c8-49e7-a128-738492d98b18", "comment": "Malware payload (Cybergate)", "value": "61c2d5a213f1b68ef98f2800f02697650ccf28eb38ec07635f0bffcdf18a803a", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523441, "uuid": "9647dca5-3c9c-4b26-b227-ab49ec8252dc", "comment": "Malware payload (Cybergate)", "value": "273760ea9b8cf2b4e60e48ed7ea96ab92bb3fa1d", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523441, "uuid": "9c634d38-49b1-4128-804b-800cfc1a0993", "comment": "Malware payload (Cybergate)", "value": "a72c35587049f425700bad263a677074a33b17fb8621fe9297b8bd0135c9a9652069fb2f8ef87431a7416ecef05bb53c", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523441, "uuid": "a543b94b-466a-49db-9074-1127a1abd778", "value": "615423A784DCD6AEE1E10CB89A7CD4B4B9D8604622653BBC8E1EC3DBD4350D5B94630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523441, "uuid": "7f5a487b-b2de-41d0-857a-e3bf3230adeb", "value": "cba5bd52b3e624400ffe41eb22644b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523441, "uuid": "b87a8105-4c4e-4436-ad46-67e945b30da6", "value": "6144:+k4qmj9BDz1CcpraDKAobj6rSnMtpl4V1h9VC+1aMnKEw+2:h9+zEVDKomcX4V1h4Mnk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523441, "uuid": "36f53e90-33c0-4c7a-b75a-3ad11add5d6e", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523441, "uuid": "a38eb6c8-261a-406b-a30f-b8f40df9e036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523441, "uuid": "3e5d7790-72c2-4783-ad10-6148ba837ccf", "value": "06E21AF52A3E3E5173A6A53725B1C217.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1498da6e-9e12-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618508605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508605, "uuid": "545e6395-920a-4526-88bf-d7d75964ec5e", "comment": "Malware payload (Dridex)", "value": "9c0aacb98255436522b34949a884a83f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508605, "uuid": "70e0c780-1a00-4c5b-bba1-d1b21703626a", "comment": "Malware payload (Dridex)", "value": "61d176315c434de8cde9e91ec9de2db881e02ed28cce5fc60c48af09543f5f8d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508605, "uuid": "9ad34149-7f3a-4240-82fd-45efa1f2b102", "comment": "Malware payload (Dridex)", "value": "8161d38131401400e8719754e359284bac01bbcf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508605, "uuid": "8faed01a-e62c-4165-9261-91f036ff1efd", "comment": "Malware payload (Dridex)", "value": "3aae25d33296f07fb18c2d572a3a8849a4de1abc86cdd481bc0d3167ffc6e0e05bb1fd5dfcd68994cdedb44ccbb5d5d1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508605, "uuid": "5812e4b5-5aae-4e31-9f5b-113f22338261", "value": "41F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508605, "uuid": "083f50ef-4477-40bb-842f-fcdcac0aac4d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508605, "uuid": "978601d0-2c99-4846-920c-145efc328c04", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618508605, "uuid": "a4c8f526-92ac-4904-be92-240692f445e7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618508605, "uuid": "5c2a1c24-03c5-455d-a71f-934e04900176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508605, "uuid": "6c2e448b-aec8-4668-8487-7b75bfb78a35", "value": "61d176315c434de8cde9e91ec9de2db881e02ed28cce5fc60c48af09543f5f8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5acb001-9da5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618462033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462033, "uuid": "6a6b6c70-3124-47db-a3e9-997dc8bc2575", "comment": "Malware payload (Dridex)", "value": "52413cc88792c6498719d943428ac2b6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462033, "uuid": "59f93c22-4950-474b-a574-b6a30677358b", "comment": "Malware payload (Dridex)", "value": "6225df792a51c04b55a498386e56f290d5cf5912f47eae502930fabc3643e22a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462033, "uuid": "5f7b4132-63b8-43a1-8735-9f9946fab7b1", "comment": "Malware payload (Dridex)", "value": "904e19281fa94bb0765907fc53ae0e5355f0047d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618462033, "uuid": "6686d694-9699-4ef2-8efd-437bc037d004", "comment": "Malware payload (Dridex)", "value": "90bf70b7b618be60687f9aec7f7532fbdc22bd25f8dc3bad42376d8124014554a90a801c22c9625e95bbe125af80126b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462033, "uuid": "34ba154b-4a8e-41b3-a9a5-0d657817b5c0", "value": "9B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462033, "uuid": "d65450e5-8ed9-42fc-a7ae-68e528120b3d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462033, "uuid": "c288c988-21b9-4c13-bab7-3f1df75d3c0e", "value": "3072:v0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:upepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618462033, "uuid": "a55e6185-4b87-4584-b939-3e61fc0c684f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618462033, "uuid": "a9d026df-220b-46f2-8364-97eb6fcbc205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618462033, "uuid": "76a7c360-0883-43e0-9c52-4bcdd6c88d0f", "value": "6225df792a51c04b55a498386e56f290d5cf5912f47eae502930fabc3643e22a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3835e768-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480748, "uuid": "ff39b3f1-d708-4852-ba05-01fa8e2ff63f", "comment": "Malware payload (Dridex)", "value": "567dc9a893010a7642ff811b24f47f99", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480748, "uuid": "302936d0-c684-442b-860e-d1f9831cc50e", "comment": "Malware payload (Dridex)", "value": "6266b2ee7e3c9cb6a5dc3f282caf7ee5a6e7606ef2cb16e02e45cfca276225d1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480748, "uuid": "56d8875a-bebb-4673-8a85-052a1f0333a3", "comment": "Malware payload (Dridex)", "value": "56dd0339e20a2c3edd444e823b214b262aaaf2fa", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480748, "uuid": "896baf26-578c-4578-af8c-02dee82b068c", "comment": "Malware payload (Dridex)", "value": "7a01e931086ff787175268363688cf72b993af816904b910ddfc4cc747bf8cd656882563e15c1f768a82969c82a4ce9f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480748, "uuid": "c4320536-44b9-4790-a46d-998c2528b9e6", "value": "6DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480748, "uuid": "a1ef1852-e94d-4863-b08f-e72ae8ff2850", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480748, "uuid": "9af4f2e7-135f-4d0a-98aa-55528e3222fb", "value": "3072:biFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:4eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480748, "uuid": "ce0430a7-c09c-4853-82be-89baf823ac55", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480748, "uuid": "9720857b-b3c6-44cf-95eb-22f7bab9817b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480748, "uuid": "94ad1e22-8e52-424c-a10b-c5d197bf178f", "value": "6266b2ee7e3c9cb6a5dc3f282caf7ee5a6e7606ef2cb16e02e45cfca276225d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bba9c9-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480750, "uuid": "34fe23be-8867-445d-82ee-e17a5ac6dd3b", "comment": "Malware payload (Dridex)", "value": "059135688ec7faf3a0afa0f54b8c9761", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480750, "uuid": "9599e6c9-37d7-4007-a6b9-d78f4456bf02", "comment": "Malware payload (Dridex)", "value": "6279871203722723e8e27673a8943c382b946b443b9fd14c9e2f6c12d695d670", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480750, "uuid": "044af099-6b3b-464a-90ab-acec799ed010", "comment": "Malware payload (Dridex)", "value": "896985bdc0e2e19513a57749245c68d55c382114", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480750, "uuid": "2d274c12-1653-4711-8bb0-352b55e8d85e", "comment": "Malware payload (Dridex)", "value": "f873a84be6f4e72a0445002abc1b02da6f5e296d44e1161220503e645f04e685def23f97c923c63deafa2d156f3c4e89", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480750, "uuid": "6de91d49-88d4-4db9-b915-ac9863d5fed9", "value": "65F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480750, "uuid": "4b29f87d-eea2-4686-803d-c4d12a42045c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480750, "uuid": "81209a7a-2203-4c95-99d1-40a7d9fa9025", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480750, "uuid": "886a6bc8-349a-4b0e-a0af-6d34043c2156", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480750, "uuid": "29543120-b619-4e9c-8659-6dd58e5ce97b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480750, "uuid": "82e2e0cf-607f-457d-878f-857e2c9ef96d", "value": "6279871203722723e8e27673a8943c382b946b443b9fd14c9e2f6c12d695d670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a025c3a2-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498531, "uuid": "bd83b38a-03c5-4d20-a3db-bd195cc22cb6", "comment": "Malware payload (Dridex)", "value": "3f66b76983ea1039f9030229e4e8a0d6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498531, "uuid": "eb54eeb5-783e-4b0d-9a17-ac96849d55dc", "comment": "Malware payload (Dridex)", "value": "62c013699f5bfc73f8c3a32cd358ab67e492809a05f107b4e70fe14169d6b9e9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498531, "uuid": "688a89c8-70ac-4c93-a671-2ed1817a6c99", "comment": "Malware payload (Dridex)", "value": "1747eb0b8ba41abdcbd86a704f1bfa611bbbb3d8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498531, "uuid": "6249aa4f-36b6-4487-827c-1a4e9ed825ba", "comment": "Malware payload (Dridex)", "value": "55e8b025aa482f57c3c0832fc7530266e7c2a2c739c3a7b0b9f6915e8a908794013b08bced5d99623e4d820020fbf372", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498531, "uuid": "5070c2e7-c075-4d11-b0d8-7bc1a4d99f7a", "value": "0EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498531, "uuid": "d5f578d0-f16c-4d57-aeab-411afb49a505", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498531, "uuid": "6ea2c91c-ff9a-4535-bcad-a06f89a61005", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498531, "uuid": "bb7af5e2-8b00-4242-865d-135e919a20f2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498531, "uuid": "59ff81e7-aae8-4422-9163-36a38ed97ed8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498531, "uuid": "098342f2-8360-42a6-8bc3-edb587257cd4", "value": "62c013699f5bfc73f8c3a32cd358ab67e492809a05f107b4e70fe14169d6b9e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84ab75f-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618514544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514544, "uuid": "4b8a274d-3187-4452-8192-aa260bdb3000", "comment": "Malware payload (SnakeKeylogger)", "value": "eccc8b217fce57a90311fb1e89fe720d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514544, "uuid": "3d43d340-e335-4651-bde0-8ae0c7da6f6e", "comment": "Malware payload (SnakeKeylogger)", "value": "62c5eec2731540d927afea664112448c093f439d4db44a7783b3afa4dc6273d6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514544, "uuid": "91e5c189-8668-402c-a1e7-fc96edf9ea16", "comment": "Malware payload (SnakeKeylogger)", "value": "cbe3573ec97d7e331c2b1aa26bab854e85013568", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514544, "uuid": "ab4c004e-bfef-47e0-8e2d-b21bd8faf2bc", "comment": "Malware payload (SnakeKeylogger)", "value": "122ab81d4382afffb033258da4ce75b4c6041f848cd95213fbdcfaf0f78c9a117605c3ce3bd0365eb1e1a55ca6274a2a", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514544, "uuid": "6bcfc88b-c5b6-4fbb-8a9a-b1c69ae85caa", "value": "43A42305FAE8D757F823DA3C12B1D86F8403EE06AB18FD57E6E4754AB7347890225683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514544, "uuid": "06725612-3e93-484a-a6b4-4222accdacb7", "value": "6144:DUe68WNir6opx62srZqef4W+Q3WyUqb3iePOYBK6f+iWGJdYVHLPlUlIPf0Oeq3W:JhmWx62yf4JQMqb3DBrJdiL9uKReq9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514544, "uuid": "800cd4db-f604-46af-8e3d-0dbc86387768", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514544, "uuid": "ea5e3592-7cec-4250-b642-aba564ccc5df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514544, "uuid": "4ff7f784-de38-40fd-afe3-7852c9614935", "value": "BioMed specification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8010764d-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495901, "uuid": "77a92326-6554-4164-9f19-07eda1231bd4", "comment": "Malware payload (Dridex)", "value": "30a775744e494d9befcba4db78e7cc9b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495901, "uuid": "c53ffa10-784a-4ddf-9027-d565eb1efff3", "comment": "Malware payload (Dridex)", "value": "62e2efb4cd0d8184ec1942a1f2e5a8a5048e3a74711be42bf627572915f02e2d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495901, "uuid": "5348bdf5-efa9-47ab-8b4c-c17ab881d447", "comment": "Malware payload (Dridex)", "value": "6b911bee4e9bb13621dca6bd465abdd6041fdb0b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495901, "uuid": "b08c644c-6784-44fe-bdf2-4c528e82a758", "comment": "Malware payload (Dridex)", "value": "843d3f874805ca328cb55fac12e9c9d055829c20a998049dfc78c678623031fdf1b93b855c1a8d12ea46e5b75b50090d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495901, "uuid": "42a3f187-bd9b-40ee-a2c7-d44c0e68ee7f", "value": "ABF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495901, "uuid": "9182cef7-76ae-45be-bc04-eacc733545fd", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495901, "uuid": "ab4a3c5b-c334-4c46-aed5-0ed11230434c", "value": "3072:RA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:R3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495901, "uuid": "7a67ae70-fb2d-49db-994c-bbed72983b1f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495901, "uuid": "6e72f648-6b05-4a35-8d7b-8b7ba4a42a2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495901, "uuid": "c1c12a2c-08ad-4dc3-a319-b48735b7e6ac", "value": "62e2efb4cd0d8184ec1942a1f2e5a8a5048e3a74711be42bf627572915f02e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7820dfc7-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480855, "uuid": "70b1499d-9204-4793-b7a1-46f25dad1adc", "comment": "Malware payload (Dridex)", "value": "c41279011ebdb44cf19fd5d272e91ff1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480855, "uuid": "a08d2c0f-e50c-41ef-8e1a-36dbac1d9490", "comment": "Malware payload (Dridex)", "value": "633d77531cc53a9a60775ee832d414deaf4538a8dfe43b3eb1a3bcbf6194cea1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480855, "uuid": "9d82da56-9900-47d4-8dd2-96903c5625bf", "comment": "Malware payload (Dridex)", "value": "c23340fb9a483834a80fcbab5de08db087067781", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480855, "uuid": "82687045-fd63-4948-8efd-9862ed7509eb", "comment": "Malware payload (Dridex)", "value": "1e5421f6dfcf5fa54945f2b631f229750a3119a1f9cb5be5821574738fa28c8f61f5e1704f2b4eff1f0230b99687202f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480855, "uuid": "84dc26d6-0600-4a98-9f42-d084c00a4a53", "value": "4AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480855, "uuid": "893a436b-6303-47e1-8fe0-e81cfc9837bb", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480855, "uuid": "49edbc16-2242-4fce-aa86-b23df4886036", "value": "3072:NiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:WeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480855, "uuid": "902f9b9e-20ff-4fb4-a4a8-b64e8ddf6a47", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480855, "uuid": "7fc16775-ff41-4224-8a25-2845d3c5f3e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480855, "uuid": "c1d3be89-3395-4608-8ab5-4a66557d77ae", "value": "633d77531cc53a9a60775ee832d414deaf4538a8dfe43b3eb1a3bcbf6194cea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb13f60-9e36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524245, "uuid": "2be3194d-dd17-4cfc-a147-4f1069c641aa", "comment": "Malware payload (Dridex)", "value": "d2451fd55ed8c4e4e4b746fb1d113824", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524245, "uuid": "d541a3ad-f503-4f1c-b207-19c41e77fd15", "comment": "Malware payload (Dridex)", "value": "63f93d8fbcd57c63e8987349cf9ad40b1d005fa3e1cf7c474910ed663dd112ae", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524245, "uuid": "57b4529b-a90a-4193-a4fb-e18d4c2dad34", "comment": "Malware payload (Dridex)", "value": "43f2e1a17a54ae72e2bceacfdc8cbc18b61abc8c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524245, "uuid": "644a79bb-f241-4a70-9498-c26d23b91dca", "comment": "Malware payload (Dridex)", "value": "073eaeea42c2d98e79a9cdf2c6c80c74eec86ebf362a87e6500efa8caf39986495dd1520b517b0d182210323f69afe04", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524245, "uuid": "ba55f113-e240-4aca-a9d9-41deac856e70", "value": "D3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524245, "uuid": "fde7b977-0f38-4423-a691-ee931717e537", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524245, "uuid": "ed9b58f0-7588-4aa1-bfd9-9076da94354f", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524245, "uuid": "938e07ba-a841-4922-9af8-29a32d0d8365", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524245, "uuid": "5c275146-77ad-4d26-a387-9d9533f4bda6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524245, "uuid": "2b48ee25-2096-43af-9d92-369921250591", "value": "63f93d8fbcd57c63e8987349cf9ad40b1d005fa3e1cf7c474910ed663dd112ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965701cc-9d8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618450841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450841, "uuid": "59ec8222-634c-402f-818d-aad2e99ab3b2", "comment": "Malware payload (AgentTesla)", "value": "6bcaf1b1b833601bc00691a03ad2a374", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450841, "uuid": "ab89391e-2aeb-4212-878f-7797b75cd8f9", "comment": "Malware payload (AgentTesla)", "value": "63ffcd2680423128ba007fc38937dce83f0c4466f65e4f1021e84287b990c422", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450841, "uuid": "096dcf09-90cd-46c0-9818-40399e483b65", "comment": "Malware payload (AgentTesla)", "value": "b6bfaa884207310a5bafb3d1b5046ccba924312e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450841, "uuid": "3e994029-61b0-4b83-bb65-43b00536a3a3", "comment": "Malware payload (AgentTesla)", "value": "dd52af27e006aab22209d7370185269e350ad52795c67a605f25606823cac528d59b3b30858da496bcd1ac1dd6977d54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450841, "uuid": "9de6abfa-5edd-46bf-9e29-90ad9922d209", "value": "222501246A8DFB9AC45C87B9C46085750373AA37D39ADA1FD88C31C85EB4342F51D3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450841, "uuid": "d580e0d8-effc-4c46-8275-ae6fbc320dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450841, "uuid": "e714cd8e-34c3-42fe-94ce-bec57b5290f5", "value": "24576:L2TuoZXnP6c0fj42+KBACJCf8QsKiqm7l:LuuoZXPWjClCJCfnsTqsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618450841, "uuid": "a05bd559-4375-4776-8be9-f4c024775ec5", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618450841, "uuid": "344d6785-31a5-45ef-9ddd-514874076146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450841, "uuid": "ae71d5b4-3f02-42b9-9504-a43abcee81b4", "value": "HOUHENG 3 ETA 20TH APRCTM 50,000 USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dec04e-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497056, "uuid": "8e30c025-50a7-4db3-9af7-8815d22fd67a", "comment": "Malware payload (Dridex)", "value": "5f8410d9c3ffdce8b2bdf74f0347fb9a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497056, "uuid": "d34ed7af-356f-49bd-9c71-07ff6fddeae9", "comment": "Malware payload (Dridex)", "value": "640a658049ee627baef9dc2b61733eaf30e411e78b016e6be96aad6281f402ee", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497056, "uuid": "0667aeef-11df-48b3-b397-f84cd8e748bb", "comment": "Malware payload (Dridex)", "value": "3e7fa6bcc5319055f9acf2656e59b0aaa27c812c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497056, "uuid": "b6edee84-dd8c-4d74-83d0-f6f7dcff4fce", "comment": "Malware payload (Dridex)", "value": "ca4d388f131a7be25bd489a8a805a9ef38ba86ba2a2a737dda8397ee6a9b0783807d4735bbe62ca1af79eefff5700004", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497056, "uuid": "a05bc96a-1a6b-417b-b484-d16f5c18771f", "value": "B0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497056, "uuid": "e76ffd21-4fd1-4929-8a81-062df37d548f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497056, "uuid": "02015583-ed1e-432a-b3f6-00b6ed604655", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497056, "uuid": "e639165f-3378-47e1-9fe7-4e86d434aaaf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497056, "uuid": "a4c954f9-b32a-4eb1-b79c-86dd2c042877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497056, "uuid": "d849bfca-c09b-4da1-812e-511df1758357", "value": "640a658049ee627baef9dc2b61733eaf30e411e78b016e6be96aad6281f402ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c889b38-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "6b689308-fdf9-4971-9b1d-5df60325a237", "comment": "Malware payload (Dridex)", "value": "1abb5b2f313bbefd904f7f438eaec9bf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "77afa4d8-8dc3-46a2-ae18-ab0b023fdfc7", "comment": "Malware payload (Dridex)", "value": "640eefcd51abfede27e9e385564627a45e1c3c5648305672f68f3f32b005e4f6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "9e95c50c-9b3e-4255-ac80-6ecf6b45a47c", "comment": "Malware payload (Dridex)", "value": "fae7ae25bdba8fa03a9b0de844abd461f1cc0143", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "d648f5b6-d1bd-4149-ac4a-8c7779ab3151", "comment": "Malware payload (Dridex)", "value": "76664ac9507e78aefe4a5d62601bfd55e836fa2ae4ab2b48d78306e3f220e1a898dcae8cadcf2b50351eebc87c114991", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "57350ee6-f42f-4e2d-89c1-b511295c08bc", "value": "97F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "2672fea3-2471-440a-a5c2-41b7337fd06e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "37479a73-4963-4e11-8554-e4e9cabfd1fd", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498955, "uuid": "dccbcd50-db28-4774-a6f5-5533c07ee8cc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498955, "uuid": "eb5dc708-d413-4797-98f4-ca8f359b842a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "ca7d1b1a-53e3-4ade-8342-f5b9e5b90e25", "value": "640eefcd51abfede27e9e385564627a45e1c3c5648305672f68f3f32b005e4f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff92e6b-9dbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618471580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471580, "uuid": "f20c8e68-b30a-4aea-963d-a18b7c049d8f", "comment": "Malware payload (Dridex)", "value": "9a00320140a6fa59d59bd22408f582e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471580, "uuid": "c777dfd4-ae10-407a-9eca-c3bbb6bb5a02", "comment": "Malware payload (Dridex)", "value": "642e343be06fe49a4f92194f5bc90ae0261d8ecb2bf6a78e14e56ea406d41d24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471580, "uuid": "5a1ac0e4-254e-4fed-95d7-0afe82b82f07", "comment": "Malware payload (Dridex)", "value": "0e70c61aa98ac27292f3f3bc5f196e402bc36dfd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471580, "uuid": "a77a6202-3245-40a4-b64e-8b2875896101", "comment": "Malware payload (Dridex)", "value": "ad7abee4cf49b5d881f30df09b5ce35f42cc19f0d53fabaee3aa7b749f322e2ea371dfa46d711564205927f91b827116", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471580, "uuid": "f2fd8d59-d4e5-445e-b290-252a57d6195b", "value": "7AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471580, "uuid": "470d117d-a1a3-4b53-b701-2f6025e104fb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471580, "uuid": "b5d96d39-a164-430e-961c-fe44ca4b7b26", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618471580, "uuid": "bed443ba-4d67-4d9e-b22a-c565348ea9be", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618471580, "uuid": "9e1eb280-a5ea-4078-86c9-26708e96a8e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471580, "uuid": "3c9e8f2f-cef6-48b6-ab62-744d63be8bf1", "value": "642e343be06fe49a4f92194f5bc90ae0261d8ecb2bf6a78e14e56ea406d41d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3765a20b-9e07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618503939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503939, "uuid": "dddc6b34-8730-4d79-823e-44579620221e", "comment": "Malware payload (Dridex)", "value": "b0ac128b459bce80c46db9f413227570", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503939, "uuid": "fd80a3f0-52f1-423f-90fc-34a487093585", "comment": "Malware payload (Dridex)", "value": "6469b0e35863e82ed0cc9e881fb80eb7c09465f1ec477888e7524444e4964017", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503939, "uuid": "1c4624af-6a76-4c94-b631-3d8d3ab971e1", "comment": "Malware payload (Dridex)", "value": "e4d82409676b8ed6101d1382a3ee33a4f12b75d4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503939, "uuid": "24949e87-6454-449c-8258-b5f2acbfa4df", "comment": "Malware payload (Dridex)", "value": "1a5a8c31b8bfeb6725719682e43a201a63bd349a5b6a2da3833945188b355f5f891e283d6d07a147c1794dde8f998218", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503939, "uuid": "beadb9bd-739f-4a02-b85b-a18ed72b3e50", "value": "9CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503939, "uuid": "a8d50637-cdac-495b-80ec-50c823b8500f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503939, "uuid": "345a6774-522c-4e3f-8fd0-42e4f4177a41", "value": "3072:FA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:F3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618503939, "uuid": "4bce4ca8-33f4-42fc-bc1b-50a3135c2927", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618503939, "uuid": "50b5477b-afcf-4965-b385-9db116871339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503939, "uuid": "a21d84ec-2e62-48aa-a1c6-8d8e7a9c2195", "value": "6469b0e35863e82ed0cc9e881fb80eb7c09465f1ec477888e7524444e4964017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c3b425-9db5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618468771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468771, "uuid": "4211df87-1e6e-4a4b-8e13-309e9da099f8", "comment": "Malware payload (Dridex)", "value": "89564f59a92be75a0562c19924eba640", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468771, "uuid": "d4d35ba3-4991-43de-b536-32a30edc7df6", "comment": "Malware payload (Dridex)", "value": "6477c253a6f5a16dc2e80c543a770e590f30ab775589cfbb22fd0496eb2dc716", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468771, "uuid": "d23acbcc-0f80-4ad8-96da-2f11a62f50e4", "comment": "Malware payload (Dridex)", "value": "38aacbbd1e9656f0d80c1f807ae194c27f23e8ba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618468771, "uuid": "0c034267-ea54-4a4d-a5c8-c683b0279a0a", "comment": "Malware payload (Dridex)", "value": "777d4fdaf0bbd9792f593e881ebcf600a6c677f091890ce659b8eaeb093130ba6241fbe01ba5bd6e72696acea55d9988", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468771, "uuid": "b9eb940c-cb69-4c09-87c2-5d04fdd9f914", "value": "7A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468771, "uuid": "c05a26ab-a668-4371-9a42-bfdb2d7fe48f", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468771, "uuid": "65a4e0d1-ebc0-4fb6-a3a7-ca92a9d78e82", "value": "3072:O0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:NpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618468771, "uuid": "50a0cb11-2c2f-430d-a84b-3c0f97a13f86", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618468771, "uuid": "b50b55da-11a0-4abd-8bc0-119b708e2031", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618468771, "uuid": "cbb5876a-c644-4d11-8963-8018f3602298", "value": "6477c253a6f5a16dc2e80c543a770e590f30ab775589cfbb22fd0496eb2dc716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9b84d2-9e03-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618502232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502232, "uuid": "fd0254b0-2d0b-474d-8dde-20667dd93c4c", "comment": "Malware payload (SnakeKeylogger)", "value": "1cce3cca4df2243ca6aa587e24c70e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502232, "uuid": "78b7b471-04f7-4acc-8f30-08cf361576f2", "comment": "Malware payload (SnakeKeylogger)", "value": "6496057d0e5c99d2df87b6808d60e45283be77411c961223d8cf2474a213dcdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502232, "uuid": "28ae8f23-d7f7-4b46-9a99-9c7d6510110b", "comment": "Malware payload (SnakeKeylogger)", "value": "bf0f87373f37ff028ff8e69da4415f3d03fb97c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618502232, "uuid": "d352d5d7-1ad8-4b8e-8958-2fdcde694f5e", "comment": "Malware payload (SnakeKeylogger)", "value": "562572e8159a93f6200c22499b046736a1f0bb8592320990503e248e313de3f70399078d106e7a4213d15ffbdd27865c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502232, "uuid": "952a2909-708d-4eb0-8469-811f3ff133c8", "value": "E4B401896548C507D5494C34616E773C077BAFCA2856EF82AC87B2F7CBF3B48254B226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502232, "uuid": "30417dea-da0a-417c-97ae-75b1b503f4be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502232, "uuid": "0b7285a6-0be0-4a31-b3e7-4049db323b7c", "value": "12288:Cv56oAhHSvlNSIOUu07KgzlcEUs/BDowon8:HojvlyGTzl6s/lowon8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618502232, "uuid": "d5638033-1896-4384-95ff-157aee520b4f", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618502232, "uuid": "81d810f1-d6ec-4615-9cd2-0a03aff371ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618502232, "uuid": "ce1e4b60-1bbe-4903-8a97-3a4517108217", "value": "1cce3cca4df2243ca6aa587e24c70e4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ef728f-9dcd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618479267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479267, "uuid": "e8d5db12-771c-4068-b797-9e9b4a9f51ce", "comment": "Malware payload (Dridex)", "value": "4294c91f128af6d0ea55e1c6773ffcca", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479267, "uuid": "e9dd3c28-1695-4e25-acb4-71d2c2b95216", "comment": "Malware payload (Dridex)", "value": "64e214d38c668f78772ec544c2b78891084446bf6ce674350f6e25b49e70481a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479267, "uuid": "a2f7aedb-8231-4137-8b68-75562be6ed7e", "comment": "Malware payload (Dridex)", "value": "0d0f7139d592d035a98551d39b797dfe1b33d143", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479267, "uuid": "c47087fd-965b-417f-9c9b-fb038c6fcf58", "comment": "Malware payload (Dridex)", "value": "cc22fd354cb789a56e1c2145dd17484480fd1de745aea5cede3fdd5a0699984c9660424f90a6a1d9840fe7bbb6409aa4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479267, "uuid": "011b589b-f857-4ae3-8ea6-101198f830b7", "value": "40F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479267, "uuid": "83b3a511-a817-45ce-b84e-ff062a828b55", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479267, "uuid": "eaa3c6a9-24cc-45b9-9a55-a80e274622c1", "value": "3072:4A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:43J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618479267, "uuid": "5dcec9af-fd9b-40a7-9e86-708884eefcff", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618479267, "uuid": "9a642c95-321d-4ded-ae88-d29c3837aafa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479267, "uuid": "222c510a-32fe-414b-a824-a397127370da", "value": "64e214d38c668f78772ec544c2b78891084446bf6ce674350f6e25b49e70481a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b93ee0-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497004, "uuid": "cd5abefc-ac37-496d-a5eb-2758235599a7", "comment": "Malware payload (Dridex)", "value": "9a29ce4c948fa481c04f3ede150556cc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497004, "uuid": "827d1f32-1320-4c2b-9086-8a6200b66c62", "comment": "Malware payload (Dridex)", "value": "6518aea302a8ae07d4d8fea281394e5813e1b63d9c92598fff3a8ca22b7030df", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497004, "uuid": "a7c11d32-ba2b-489a-8bec-112122749c37", "comment": "Malware payload (Dridex)", "value": "c355d3120961d468d9bd5f1241f382cfb99a7498", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497004, "uuid": "82bc0f44-b45f-494f-af9d-c3a82736d8c4", "comment": "Malware payload (Dridex)", "value": "74cf9a7bca405b04a278bb5dcc3a301c90999f165378ffd33e109a8c88c165e6dca9dde9f3dc28c7cb8890770a0b68fb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497004, "uuid": "3fca7d8b-8334-453b-9e67-de2e5db16b07", "value": "A3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497004, "uuid": "800431cb-e1ae-4f2e-b26d-7ab7c286a3ca", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497004, "uuid": "4a935a22-4a61-458e-ad82-a2e42121ffcb", "value": "3072:XiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:seAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497004, "uuid": "8909284a-c438-49ab-862a-8a45b8f5c639", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497004, "uuid": "8934b70e-c337-436f-b01d-ed6a0d99dbda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497004, "uuid": "66b650c2-2e41-4d81-952d-86b977f7b569", "value": "6518aea302a8ae07d4d8fea281394e5813e1b63d9c92598fff3a8ca22b7030df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7433d5a-9e45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618530890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530890, "uuid": "4f3654be-2701-40b9-9121-cdc6b1021981", "comment": "Malware payload", "value": "2ef8c10baaca621c73aba57c56c40bda", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530890, "uuid": "ae41f251-20d2-47db-881d-65c9fb94c50d", "comment": "Malware payload", "value": "65870642f9eb9e09c887e447f13bb3597709de583f60240388ca5279eca539c5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530890, "uuid": "464c9eb7-70b9-42b7-a4ab-d4f59d08a0be", "comment": "Malware payload", "value": "30123590dbddce0fb0376a5f72e88711f8c0630d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618530890, "uuid": "3f08df6a-0125-42e9-8916-a048c8eac2e2", "comment": "Malware payload", "value": "96e2f22f7c28db4a63a526acea51a09c6d2a47864e4eca2aa7b574c1da9af4a715cd28bcdb98d83302c9d92b55e27086", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530890, "uuid": "1f5f867d-26a4-412e-abee-d31584070247", "value": "86F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530890, "uuid": "5bf36cd5-cfd0-4592-82d4-860ae9332315", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530890, "uuid": "ea6e9fac-4594-4cee-8a86-297da90d136c", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618530890, "uuid": "b412059d-4540-489f-bb42-541f445149a5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618530890, "uuid": "fbb283fc-2507-41a1-8bc5-50c3823464f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618530890, "uuid": "321adb15-d370-409f-8638-e50f8afa75cf", "value": "65870642f9eb9e09c887e447f13bb3597709de583f60240388ca5279eca539c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae7c71e-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "cdf89804-0253-41e0-9cd8-0b46a69de6ee", "comment": "Malware payload (Dridex)", "value": "ab86297406694ad2e4ee84f0e2832d8e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "3799971a-263c-4c3f-a3c6-598da34b5103", "comment": "Malware payload (Dridex)", "value": "659c6b69e80236b9e4404ac0dfb9d0c19a105aa2ac98f2c0c31d03ab98acc545", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "6d2f29b1-6a2f-4273-bd38-36f6a354420e", "comment": "Malware payload (Dridex)", "value": "0fee2df2ddecd72a966712e99e97d98c0b72a5ca", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464270, "uuid": "7ab07087-e5ad-4503-afcc-4e3bff524592", "comment": "Malware payload (Dridex)", "value": "0ddbee04a8a3231ce829e0d34a4a4a62d30daa71354af82e62c6e923b84f7b307af8bd34f1f0dcf1066b07d75252ee1c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "b89cebcd-e8fa-4c38-b52f-b82cf32627d4", "value": "6EF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "d205136d-926a-4f92-82e4-064967b593a7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "59d42b17-c958-4738-8e4a-0b5cbc90e700", "value": "3072:7A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:73J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464270, "uuid": "e334d0fe-d36d-4fbf-b1dc-e5621ef7cb39", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464270, "uuid": "d1b3ee58-ac49-435d-9e8d-d51c979159d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464270, "uuid": "d277db79-efa7-4f87-8704-29ffa5d1c7d1", "value": "659c6b69e80236b9e4404ac0dfb9d0c19a105aa2ac98f2c0c31d03ab98acc545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b974134-9e09-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1618504805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504805, "uuid": "9f08800c-f368-4247-80aa-5cc8244b2438", "comment": "Malware payload (ZLoader)", "value": "7f3d657326eb06657862da447782c4e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504805, "uuid": "2d105ec3-bc3c-4abb-9a7c-a6c5e31292f6", "comment": "Malware payload (ZLoader)", "value": "65a353b30e9ae115da1933c197f4b64a61ff981890b4841000fff5a17810c68b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504805, "uuid": "baab0731-5f06-4fc1-8acb-8a86f291705c", "comment": "Malware payload (ZLoader)", "value": "bce25cb8eba8590d63efa6bb5e41a512bcd4f79a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504805, "uuid": "ef764432-884f-4a71-a41a-20f06fb7bb9f", "comment": "Malware payload (ZLoader)", "value": "fa7f18ff60bc8c2c583be8680c8a1146219acb43641468529b2ed80acd0d3a099b00e178e34bbe05910f0aa6fc123995", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504805, "uuid": "a77cfc62-1920-448e-87c6-de1170c0107c", "value": "A0E4AD247580C072C5A224358E65E5F9496DBC209F2156CB73DC3F7F6B306E1AA32A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504805, "uuid": "b1e2af5a-b9e0-4554-a81e-26755ee4d55d", "value": "1871ee680e7135cabc1e519d428eefe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504805, "uuid": "43339be8-6d24-4c1a-9e9e-9c3e19992e42", "value": "12288:m9D8Diks/1k4R17DVu+PQYgzCNouGhKvuZkMSUxEMPEQIRAkwOBYSk8x3JVBKKZM:mG+kY9IYNouGhTxEnVdB7ku5VZrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618504805, "uuid": "fcc30f3b-2c3e-4048-bd3b-1b5de47d4f21", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618504805, "uuid": "82cd21e9-c5df-4892-a834-59f616436943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504805, "uuid": "145bb1af-860f-4d2e-9de6-7cffecb268d3", "value": "7f3d657326eb06657862da447782c4e9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3312e229-9e36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524118, "uuid": "7e2a3420-9b16-4dcc-9a99-4a004c8b5086", "comment": "Malware payload (Dridex)", "value": "9bd68643c73b4fe348d8e17906d58d01", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524118, "uuid": "729217ee-2f53-435f-a889-28aca26fd28e", "comment": "Malware payload (Dridex)", "value": "65fbc043e0ee2b91a96b266432a05d7b48e339f3598766e0d22e2c9585eced3f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524118, "uuid": "e414aba9-f0da-4d7f-8f65-25da096efb66", "comment": "Malware payload (Dridex)", "value": "e6b5bcf51b9d1c34ca06333eb293d24b10727ee4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524118, "uuid": "621316ec-cac7-4c27-ae06-0500bbb56726", "comment": "Malware payload (Dridex)", "value": "46a27e2c7f6d05b8998926307e8598ed18568e476ab91e31f9f3cb2e9cc28bb3224aa93f0735409df68b51784040cd54", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524118, "uuid": "3037ea7d-dcff-415d-a2b6-b066360b88fc", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524118, "uuid": "29c7fe4b-7df5-47eb-86d0-e9edfd264011", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524118, "uuid": "cdbd3127-68df-4b02-b892-10dc0f4b092e", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524118, "uuid": "c3659239-7c57-4588-972e-09e3639bb7b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524118, "uuid": "9d955748-172e-4935-94b9-82c1f641c619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524118, "uuid": "5c4eec21-1e7c-4da4-abcb-37d6c9198e9a", "value": "65fbc043e0ee2b91a96b266432a05d7b48e339f3598766e0d22e2c9585eced3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039199ef-9e02-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618501705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501705, "uuid": "7dcd87b3-ce69-4614-b54f-7472ec5aa3e3", "comment": "Malware payload (ArkeiStealer)", "value": "fbd2322563f846e99e8a5a29ade98e79", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501705, "uuid": "d8186e04-d428-4879-8622-61bc6976a145", "comment": "Malware payload (ArkeiStealer)", "value": "6628c29bfec486169109380eb7ec9ca15cf02a73164e6019ec3f71e82970ee96", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501705, "uuid": "ca17530c-da7a-48c0-a485-f98607941612", "comment": "Malware payload (ArkeiStealer)", "value": "ca98b3f73ddf0403e559668bcb4c434370ac2705", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618501705, "uuid": "22994c85-7328-4d9f-8903-9da14ef78007", "comment": "Malware payload (ArkeiStealer)", "value": "88efa20e2fddd1a8aff714ec612b7b099fad8a27a9daa4056a861deba576adcd6bd6eb61c8662fa1b920def343daa7c8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501705, "uuid": "6a7b8b8d-17b5-499f-aea6-2c36d30b6ca6", "value": "B144E000B6D6C0B3D90606750811C2B99A36F8344F78EEC77BD54BBA5F296E5863F386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501705, "uuid": "83a21186-5c56-4196-881b-931f37a7b2d6", "value": "584c5603159e17e81307fc57f15dc706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501705, "uuid": "0553ef03-210b-47a3-991d-68b3e435aaa3", "value": "6144:V943ChX8L+cRJ9C8ZBaQkJ5tpth3UMAk4y:o3Ct8ScR7jBatZ3x3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618501705, "uuid": "547d0fb7-1ab8-442f-a737-b769f37d4023", "value": 275690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618501705, "uuid": "7d7402e4-b064-4a0f-a8c8-3f31fd4d9f94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618501705, "uuid": "7f9a2d37-4708-44ad-be72-57363f75b35d", "value": "fbd2322563f846e99e8a5a29ade98e79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a18735-9dbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618471595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471595, "uuid": "9742af55-8c14-45b0-afb5-93ca4dbc2b21", "comment": "Malware payload (Dridex)", "value": "2c7c8f1eafa5ad6ae029726b272366c9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471595, "uuid": "3e670f8b-b756-485f-88a9-25b371db05d7", "comment": "Malware payload (Dridex)", "value": "6647fe4a3b73b0da5d478870f22e0797165424c389a660bf71fb45cfc3d03fde", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471595, "uuid": "f92d6259-4327-42fa-a584-d4541688add0", "comment": "Malware payload (Dridex)", "value": "2442ba556ef22e586e733433e246ff64f115ac7f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618471595, "uuid": "10867486-1336-4213-ba9a-363955e12e99", "comment": "Malware payload (Dridex)", "value": "0a3ab4be2cad191df68f097d0b53268b06e3e83304f96d6e55cc93c1911418682048815a2b9c9286672e1d63e2d1d0a6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471595, "uuid": "dc6565af-0cfb-45a8-a3a9-533cc81aa364", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471595, "uuid": "c8eefb1d-f584-4860-a123-e778f1cf0eb3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471595, "uuid": "2236c3be-e601-4556-9827-8f5f6ecdbcb9", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618471595, "uuid": "9665dac0-184a-4aec-a00b-ba1aa9cacfa5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618471595, "uuid": "a8a2079a-b8d7-4801-aff3-bcd630db3a99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618471595, "uuid": "39af2e96-c271-42e2-b443-776c0abd9ad9", "value": "6647fe4a3b73b0da5d478870f22e0797165424c389a660bf71fb45cfc3d03fde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfbce3c-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "6aa00c58-e706-429d-908f-fef064a2fac1", "comment": "Malware payload (Dridex)", "value": "3d974c85802cca685bd05b9398c3a9dd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "d2fbfcb4-e3dc-4929-aa1e-e308cf5e832e", "comment": "Malware payload (Dridex)", "value": "665f6501df67bc3db628702d741bc12c5ceca6fb265ceeaba00da864aff9cf0b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "edf33810-bedd-4169-bf8a-3cb5cb72a299", "comment": "Malware payload (Dridex)", "value": "b13db09420ccea03d4a972a0fea1a3f8f1aa5ee5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464222, "uuid": "b8a89f91-58a6-4d36-870c-f77b649c4688", "comment": "Malware payload (Dridex)", "value": "184f2fe90afdf8eced83b0f0e9d924bb4b521e82179d81fad5a2016867769d9316d30d816a6975d1ee0a95d6f97f6f12", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "8e6e894b-aab4-44fd-893f-598f81f52fe0", "value": "69F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "5274fc72-264d-4df6-8474-5b9996bd4deb", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "85ae0e55-cb39-4b24-8998-c2fbf30f6952", "value": "3072:HA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:H3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464222, "uuid": "e6c42ff3-097e-464a-a03b-10153bfe7e93", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464222, "uuid": "a5fa7fb4-08ed-4bf9-b123-5d767f1d17c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464222, "uuid": "41f39597-bdff-4c81-8863-59ef978cf68b", "value": "665f6501df67bc3db628702d741bc12c5ceca6fb265ceeaba00da864aff9cf0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddd30e1-9dd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618482126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482126, "uuid": "afe0dcf9-6d23-4a15-9aa1-25e93b3aa0c1", "comment": "Malware payload (Dridex)", "value": "3ec9135715528d11963a00a5c6c0e1cb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482126, "uuid": "f141ec2b-c5c6-4dae-9fe3-74935c540ea0", "comment": "Malware payload (Dridex)", "value": "6698fc11dd07f67faedd2191f2a68769e70015d83349a5bcaafa2da82966f1f0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482126, "uuid": "59929d7a-b131-4933-b3c5-53a4ef5d78df", "comment": "Malware payload (Dridex)", "value": "08bd3965f7325dc4be20ca41e4ee9f5a5516dc6d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482126, "uuid": "9fe5a38b-0c8d-4713-b050-aafecc867087", "comment": "Malware payload (Dridex)", "value": "2bbdc4d52f5daecd70ff4789acc480a945ad4e367ee233160b98d31be4c99b91944c7f0e399c84192afb549886d07776", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482126, "uuid": "6acb038a-0c58-4d6d-a410-be3e55ed8ebf", "value": "F6249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482126, "uuid": "e6806aa8-5935-452d-a2eb-8d164efa8f79", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482126, "uuid": "ac2829a0-f38e-4644-bd3b-0e2b1506ccea", "value": "3072:a0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:5pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482126, "uuid": "9ddc7273-17ef-41d4-ae7e-2227dca183fe", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482126, "uuid": "9943b00d-55f7-4d83-8f26-075583a732de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482126, "uuid": "0a8d5616-78d2-4d4f-afc5-0bcd8f9ef35e", "value": "6698fc11dd07f67faedd2191f2a68769e70015d83349a5bcaafa2da82966f1f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cae9be-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497378, "uuid": "5215acdf-f984-4716-a10e-6149ef805ffe", "comment": "Malware payload (Dridex)", "value": "7d6fc94b9108c1dfd2813659a26af991", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497378, "uuid": "0a4eb416-b83b-4f8d-8b3d-bf1e05cfe23e", "comment": "Malware payload (Dridex)", "value": "66bda79db7d5bd16924063c631e7bc90e6873926ecc372e8134cffa88ab410d7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497378, "uuid": "c6d84ee5-52a7-45ac-979b-fff4ac6e3ba2", "comment": "Malware payload (Dridex)", "value": "6eade9f2c73041a8069bb0b8a2ecbb498556c39b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497378, "uuid": "873a8b04-ec0f-48a9-92a7-21a7547d42d0", "comment": "Malware payload (Dridex)", "value": "6259f61d9a3013fc32aaafaeeb7e3201beec3070ae2e87609f83d19470555bc786b2cc3ecdc806687df69c7a00c34b15", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497378, "uuid": "68f9ff67-b8b3-4aaf-a499-f7e9e35d5074", "value": "0CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497378, "uuid": "be5f1ebe-dea4-4511-b240-34ec0fe275ac", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497378, "uuid": "7e1641dd-a776-49b9-938b-5636834f2960", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497378, "uuid": "5a545bc7-5b30-4596-a4b2-8892e3c9da30", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497378, "uuid": "fb836aec-e012-4359-a58f-6ba01a66d073", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497378, "uuid": "982530f7-3b08-47c9-bd3f-0f98725a4270", "value": "66bda79db7d5bd16924063c631e7bc90e6873926ecc372e8134cffa88ab410d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1fb258-9da1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618460296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460296, "uuid": "39ae9865-d337-4d56-ac78-8edbddcfc711", "comment": "Malware payload (Dridex)", "value": "2d34063cf83bcedba3d9ad26cdcad533", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460296, "uuid": "01b988cc-98d4-4c4a-8f30-e1d36fe89a81", "comment": "Malware payload (Dridex)", "value": "66dc16c1d8bfa13c7df79a9d6a57b17ca95e2c80d29c644449175da08a232688", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460296, "uuid": "f18b0d94-43dd-4242-9807-08a6a8339097", "comment": "Malware payload (Dridex)", "value": "624a46f67149a4fd3c04679e1564ae6e764f28d4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618460296, "uuid": "b1c598f6-468e-4ac4-b8d1-8f660165ef61", "comment": "Malware payload (Dridex)", "value": "14f6b139f7b597927de2060915aac7c36c0c64722729028594586ca6f43aa1c67a1ee5782a801034665f0eee01189fa1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460296, "uuid": "baa30b36-f66f-4d9e-995f-5f00fe6a754e", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460296, "uuid": "22be067d-1937-40f5-bac4-abad3fc0cc2e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460296, "uuid": "5e4ed305-5a73-4215-97ad-0b6f9c8dfdb9", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618460296, "uuid": "756f67fb-a0c1-42c3-821c-f1a5b1b0d29a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618460296, "uuid": "0be16640-2f5c-4e0f-821a-236e90a250c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618460296, "uuid": "c606196b-d7e0-4bf3-bb0c-0659ec4087f5", "value": "66dc16c1d8bfa13c7df79a9d6a57b17ca95e2c80d29c644449175da08a232688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaadb57a-9e07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618504240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504240, "uuid": "e3034b04-0cd4-489f-ba18-123216013fd2", "comment": "Malware payload (Dridex)", "value": "d38317d85130dd444b4b5f7c5a9d256b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504240, "uuid": "26a4092a-649d-4b91-9199-2ded7053eae5", "comment": "Malware payload (Dridex)", "value": "66dff5e2e2eaddd5f0a4711f2d9e552ee4ed3499f5c81e452ea6039d2a92909b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504240, "uuid": "c383d0de-0697-44f7-856a-b97f9e2d622e", "comment": "Malware payload (Dridex)", "value": "323bfcd159870a3b0d5ab903c348b9f01dc9351f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618504240, "uuid": "de63067d-5a92-4c29-afc4-7469f31d5c4d", "comment": "Malware payload (Dridex)", "value": "c52db1f0c593d4b7ea2da9b832b88760900204e17a1fada5db245aeca882a1ba59127bfc32d760a261c36bea2bd1395b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504240, "uuid": "5a532430-c537-4a09-a554-21255ccc6189", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504240, "uuid": "8766a7c3-5e06-40d5-9706-ca78de11bd19", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504240, "uuid": "ff168c47-e707-4ee5-be2f-05756a5d7a68", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618504240, "uuid": "aa189e74-0c04-47c3-a3b2-6d1b1b09db05", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618504240, "uuid": "f00bb61d-db18-4d54-98db-fb11bc8c5443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618504240, "uuid": "6c71d471-7d4f-4913-8545-b4ba48665600", "value": "66dff5e2e2eaddd5f0a4711f2d9e552ee4ed3499f5c81e452ea6039d2a92909b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f38711-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496712, "uuid": "aea06bd5-ff2f-44be-bffd-bdfd49f9b633", "comment": "Malware payload (Dridex)", "value": "f3fdc38acadeff5ca22d361107719452", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496712, "uuid": "a896ee42-2163-492d-adce-787dd7b388e1", "comment": "Malware payload (Dridex)", "value": "66e16e87c366623e80410ef348f9c2b33d879987c10d19460e0879281e0e1ef3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496712, "uuid": "0bc59e5e-b00a-4972-97d7-99c5da433fd2", "comment": "Malware payload (Dridex)", "value": "1df4d52e382b41968d178614ad54dd8d701c6a6d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496712, "uuid": "56874546-62a7-42bf-af10-c5045d71dda1", "comment": "Malware payload (Dridex)", "value": "a3c1fa924c7ee7ab77ed8c9fdd09439215fb6312df5932cfb39a1b7da15b85472de1569174e3d9eda1c8eaf472690b08", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496712, "uuid": "74f21127-87ba-457d-b61e-402f4287ff5f", "value": "55F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496712, "uuid": "4304f031-0d02-44f7-93e1-c016d80f1e87", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496712, "uuid": "ba4e44f7-c2a9-4ae2-b6dd-cf37d428b224", "value": "3072:fiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:UeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496712, "uuid": "ab1368d5-573e-4c8a-a8c9-2b8f6835eef8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496712, "uuid": "944ccea6-87af-4f17-a011-470430992adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496712, "uuid": "f8be9d18-98c0-4973-8658-63660dd0feb3", "value": "66e16e87c366623e80410ef348f9c2b33d879987c10d19460e0879281e0e1ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48db9717-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497096, "uuid": "8bc145c2-785b-4740-9ab0-8da4b16ee130", "comment": "Malware payload (Dridex)", "value": "70290941759378b7c80983c0d69614f1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497096, "uuid": "5beeb855-d7a2-4056-bf74-41664f66dddd", "comment": "Malware payload (Dridex)", "value": "672ddcd2fd8d35aafebcbaa4211990ef4d40f41cc4b5a1a833b410f2c63e9e54", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497096, "uuid": "15c0d7dd-fe54-4b9b-b932-7304cd07d6a2", "comment": "Malware payload (Dridex)", "value": "9e6931955bb72f9d0b12be1b09756a338151e38e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497096, "uuid": "8fe50c9b-1449-4323-a2f6-82922d32716e", "comment": "Malware payload (Dridex)", "value": "60fb0867c8c3c18c4610219e6b3b1ce2dbd84ae52dded9d954d6f9921ad7dc55ef7a859714708e3fc08a90e22fe22d93", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497096, "uuid": "0935049d-2692-4918-b2d4-b7b0c39f98fc", "value": "8EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497096, "uuid": "5be02fff-cfa9-4069-990e-af6caa1326e7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497096, "uuid": "737fb0e5-384b-4cd7-bca3-c1dd3b7a1f05", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497096, "uuid": "06a4a1e3-4a87-459f-9220-5da5fb13ed88", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497096, "uuid": "266a0ee1-6800-437a-8d3e-5653a777c656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497096, "uuid": "c0bc0a68-e748-403d-b588-24fa6b28e149", "value": "672ddcd2fd8d35aafebcbaa4211990ef4d40f41cc4b5a1a833b410f2c63e9e54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed94675a-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496084, "uuid": "8a383230-fbd1-4c18-a544-464552fb0a1d", "comment": "Malware payload (Dridex)", "value": "255554216281fe764c2a81c1ee49d9f1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496084, "uuid": "6574fcad-152f-4c85-8e24-433afdd979af", "comment": "Malware payload (Dridex)", "value": "67afdfe19d36ea32cd02d3f5f1d0a74d4f8a17e817b346d01b3a4a9a7552325e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496084, "uuid": "7d99b700-2ab7-4b89-a312-d1a2a09769a5", "comment": "Malware payload (Dridex)", "value": "34bfd7cf8a9b9cd613ed8952c1e4c270054e0f95", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496084, "uuid": "79243c8c-3f32-4321-a0ac-57516e6c29eb", "comment": "Malware payload (Dridex)", "value": "849490957d4ded09a764523ca9dcec80abafa359d5750d4b985a43f433bbb516d34147cfc8ef85ffe584514fb2b74d9a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496084, "uuid": "203389df-fa4e-4942-afe5-48393579a2a8", "value": "68F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496084, "uuid": "fbfd11e0-1f06-4eec-857d-9371c0026a22", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496084, "uuid": "9d9329b4-2246-4377-9f9e-4dd9945a10ff", "value": "3072:diFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:meAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496084, "uuid": "4fc1e024-1693-4768-a022-f730390c99f4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496084, "uuid": "db5660d3-f8d5-4767-905c-2a52467d3bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496084, "uuid": "f53753f8-6f8c-489e-a8bd-e2848ab905a5", "value": "67afdfe19d36ea32cd02d3f5f1d0a74d4f8a17e817b346d01b3a4a9a7552325e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d44bae-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "cff43c9c-738e-4b86-9c0a-d3b26ec30c68", "comment": "Malware payload (Dridex)", "value": "ca0d69bc3e63f98dbfaaf387ff115fb8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "951b26ee-cb2c-4146-b8f6-e37866a904c5", "comment": "Malware payload (Dridex)", "value": "67e747709a538c3ce178c4fd0fddf700aa7ca767675c3ce825366ba674834c37", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "27e3e903-ef5b-4f95-84bc-2e6528e43263", "comment": "Malware payload (Dridex)", "value": "59557f0e518bd9ab497b180ce931c9c84fcfe660", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464319, "uuid": "b6b17e17-94d3-461b-8e66-6cf8b4e24bcb", "comment": "Malware payload (Dridex)", "value": "2c0b95d313ef2a0a1dab1003f6191597f6eabce4da878dbb0a61a90c1ca616131c4c3fda102151b13bb3d8a078add6b2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "91448ebc-e6ee-46bb-94bf-42a19185b115", "value": "E3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "4d9ffae2-6a1a-4d22-87ef-93c77b517de7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "59606429-8166-47fc-ab15-149e416af01c", "value": "3072:cA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:c3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464319, "uuid": "478b5bec-58ed-48a4-97e3-06451819b546", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464319, "uuid": "fe1eddae-9462-4d12-9531-3e189d42fbd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464319, "uuid": "72fe878c-a58c-42ac-bddc-81b4a26ed55d", "value": "67e747709a538c3ce178c4fd0fddf700aa7ca767675c3ce825366ba674834c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ebca20-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "24b7160d-d360-43e5-86f8-ee51860128ed", "comment": "Malware payload (Dridex)", "value": "46da389acc90f9388ef426fa801b9b93", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "ff4f4e8d-6614-429b-be01-14fa5a67902f", "comment": "Malware payload (Dridex)", "value": "682d1dc31265e08f5d7ce7d2097717182c46d9463696a95988f78e75d9895a6a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "735c4202-1f29-43dd-aa97-1d0e23621fc5", "comment": "Malware payload (Dridex)", "value": "1fe026d0d4e32cf20d248f0e817362fc3c7a56ed", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480856, "uuid": "8aadffc2-b286-43af-af08-62e6fa07e09c", "comment": "Malware payload (Dridex)", "value": "4927b14c8c46ecce1b555a09d4ab01173c93a10cf90202cce8e5b0b71e5fc6b5e594139f7ddc48c4bb554c8778b3db54", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "9b10236f-18f4-4e4b-90f3-4f77834f4108", "value": "89F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "6f7f4651-9dc7-4b71-9ba3-2681b039dc99", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "cc869026-25ac-4772-8207-9ed398f2b249", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480856, "uuid": "335cc903-0ba2-490c-a894-5a3b26a43b77", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480856, "uuid": "085e808b-0553-4915-9036-101819d7d120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480856, "uuid": "c62890d4-50bd-4ad8-a896-ed8d2b8a061f", "value": "682d1dc31265e08f5d7ce7d2097717182c46d9463696a95988f78e75d9895a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383d9d3f-9dfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618500075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500075, "uuid": "725f7144-dda1-4a49-a3d6-05f5e1973de6", "comment": "Malware payload (Dridex)", "value": "22cbf92c95c3235957f2dbf0ec948fcc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500075, "uuid": "ebcdd89a-fec0-45c2-b7c8-6e43413ae612", "comment": "Malware payload (Dridex)", "value": "686f43307b85ea88eb3263a47f3134ed983e56b3e9e60a37efe325670f108a28", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500075, "uuid": "a3b327ee-1c46-4f94-b585-3358a4dbefea", "comment": "Malware payload (Dridex)", "value": "4eb4c3d4daa59e2317f761082cee4a9e8521e574", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500075, "uuid": "4d4f7f67-339d-4a96-81d9-262930a3acd6", "comment": "Malware payload (Dridex)", "value": "08a587e0d102a7189c973357204c43247376a79a6c876b1a6c48c1bbdb4cf8f53d42f100b7fd2f505fc68a0e67a23cd9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500075, "uuid": "8684a7c8-098e-466d-a036-aaa6916b8adf", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500075, "uuid": "908237ca-cbf0-4006-8a8e-e9c50498b64e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500075, "uuid": "d45a6095-e07c-4906-97cf-965d6d7bbe49", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618500075, "uuid": "7b67f50b-640b-46af-8aa0-db702bd8f906", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618500075, "uuid": "3937a80a-d1c7-4bee-af30-0e2e4e306c8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500075, "uuid": "f01281f0-fe0f-4e04-8b18-148576185cf5", "value": "686f43307b85ea88eb3263a47f3134ed983e56b3e9e60a37efe325670f108a28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903eae38-9dc2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618474453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474453, "uuid": "96a05eef-dadf-44c5-859c-7bbbe293931f", "comment": "Malware payload (Dridex)", "value": "1f24d55547af86aba9cf7027130e3ad4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474453, "uuid": "cdad011e-4ffe-4872-925e-a869eebae4f9", "comment": "Malware payload (Dridex)", "value": "688213afb0b67d8dbc7ed8d4e7ee08a4230abedb18fcca4fc1d00ce0bcba0955", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474453, "uuid": "7e347153-0c6b-47e1-bec3-eaa5962a62e9", "comment": "Malware payload (Dridex)", "value": "1a8784cb752f962feebda546cd1602549899bf8f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618474453, "uuid": "7e4eac07-757a-4ac3-bb4b-4962223e7f0e", "comment": "Malware payload (Dridex)", "value": "d6e489780943d957fdc2729cebe6332001958cd059bb1a1a5dc5141ecd9b6ab859af983af390225549c53859cffa6673", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474453, "uuid": "f00f62ed-beae-4b29-8f4d-2594ec401791", "value": "17249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474453, "uuid": "72a99e40-2eb8-438c-8c5d-9d0a8ea09d1e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474453, "uuid": "b768fcc6-3600-4c7d-af14-22946d012495", "value": "3072:/0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:epepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618474453, "uuid": "bf2924d7-5a41-4c93-b821-f38acb03869e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618474453, "uuid": "0960d236-4d0b-491e-b578-5ca96dbc22e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618474453, "uuid": "03c9ef63-48f2-4c3d-976b-e1b9c3d85263", "value": "688213afb0b67d8dbc7ed8d4e7ee08a4230abedb18fcca4fc1d00ce0bcba0955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551c600a-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618516015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "9a9cc859-bcb6-4fb5-a96a-6ba8cae08340", "comment": "Malware payload (Dridex)", "value": "5881ec72a43cd8f988b374faa6306569", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "c9e142f4-d159-42f9-87b0-0bcc21f5b0af", "comment": "Malware payload (Dridex)", "value": "68a7e7800b802d96ce259d6bcac05e9cfae61f9aa332ae0b7fa5dfa092793a6e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "2d1e04e2-9411-4862-98d7-9761499985f6", "comment": "Malware payload (Dridex)", "value": "d948d010794b642f1038febdee356e0c84a87f1c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618516015, "uuid": "ec68855d-df2f-41e5-96c4-0b7ffbf822e4", "comment": "Malware payload (Dridex)", "value": "26e4661151c6cca73193f84bf550e52f27dc5b7dabdceeaf92e3aab7df5e675c48dee4b778fa0dfc0c0f4a1b961c36d2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "89a3f07d-f7e5-41db-a3ad-de02cce72c20", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "cf163d22-1489-474c-9a17-6e9ed0627bb0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "360613c5-b5f0-4699-bf69-b0963b4551c2", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618516015, "uuid": "023620cd-ec56-4f0d-958b-14c342b49e54", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618516015, "uuid": "5200e27c-627f-4148-9cd2-fd7e14e29593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618516015, "uuid": "b41ee91e-c727-49dc-8561-2da082a8315a", "value": "68a7e7800b802d96ce259d6bcac05e9cfae61f9aa332ae0b7fa5dfa092793a6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccb63b0-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "16d0db9a-2597-4d26-adae-a91cb8724211", "comment": "Malware payload (Dridex)", "value": "4f4d466b0ce0374649f07b52674cce3d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "64acb3b6-ab1c-4d4f-adae-f3780d7ce3e8", "comment": "Malware payload (Dridex)", "value": "68f91de63b395974948804c18997e49f70ef611703e3ecbd31df1f7d48aaa6f3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "991af3e4-878c-4821-b6b2-11a003c617ea", "comment": "Malware payload (Dridex)", "value": "928f850c6f642b4e987f050e9b73b407a662d57d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498955, "uuid": "26222344-d911-43e8-b77a-814c0dfe382c", "comment": "Malware payload (Dridex)", "value": "d6ed2a903d85ebacee009b1ac72cae6e2cafb41a1c62b5f76a8e7aaaaa34c3f71d10c8e96e5d5716046879e1e6381af9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "3fa95c7f-615b-4872-b2f8-726992895516", "value": "29F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "43140b21-de05-41bd-afbd-81a4c4f0d8df", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "6e5b42ff-dc92-4fc7-88a8-2b186828fb3c", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498955, "uuid": "bd235420-9eab-4f27-a816-1db158a63399", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498955, "uuid": "aaa4772e-f927-48fa-8c7e-b197b3ec2cb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498955, "uuid": "dafc4af2-fc43-40fd-9e45-8a23708bd844", "value": "68f91de63b395974948804c18997e49f70ef611703e3ecbd31df1f7d48aaa6f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6506d87-9e2b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618519694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519694, "uuid": "b01ba3be-c0ef-4317-98b9-1d8d615bd786", "comment": "Malware payload (Dridex)", "value": "bbca33feff7a8d17df90b07d38f43859", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519694, "uuid": "bb9dc191-fdc9-42d3-af54-3a01b130171b", "comment": "Malware payload (Dridex)", "value": "6911a2d2ccb03076ec6912882ef4ad9da41f8249f778ca6656d694996b0d7c79", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519694, "uuid": "7adabf28-1267-42b7-8841-10a42c8a44ab", "comment": "Malware payload (Dridex)", "value": "7ee0851a964d184b083b982e2bcc8e241e0e0a87", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618519694, "uuid": "58f33bb5-0283-4a71-979d-8d61a0ecb67c", "comment": "Malware payload (Dridex)", "value": "81cf0ab52e4152fbbc6f2bbe3fd01ccc990b691c9312fa92275ecf11daeca49b4a97f265542e8cd7de53148938640fb2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519694, "uuid": "b5a6fe43-d6b3-43c0-9bff-a8f475f78b7d", "value": "72F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519694, "uuid": "e642991a-abaa-406e-a8ee-0cb62bc9a6ac", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519694, "uuid": "4b096efc-6857-4a4a-81a6-c2c71f242b25", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618519694, "uuid": "a5674ed2-0825-4d0a-9237-9ea152acbb75", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618519694, "uuid": "51baeb2c-c1c6-4a92-abe9-bd245a43a545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618519694, "uuid": "770cf817-f339-463f-b61a-85f0bca97b15", "value": "6911a2d2ccb03076ec6912882ef4ad9da41f8249f778ca6656d694996b0d7c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68601733-9dae-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618465796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465796, "uuid": "25af1e89-59a9-4e56-918e-aafae792666e", "comment": "Malware payload (AgentTesla)", "value": "166aa1a2cbd533c30393e30168660e8b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465796, "uuid": "eca44f5f-29f6-44b1-9a9e-a3b518159a3e", "comment": "Malware payload (AgentTesla)", "value": "69194d64960f6ddbdcc748818b968edeedfc68540ad179a3cb4f3f13f2368f06", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465796, "uuid": "c2c5666b-9026-4fa3-9bdb-a5170dfec875", "comment": "Malware payload (AgentTesla)", "value": "eee622d7a593d0fc50ee09776b34fd065d088117", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465796, "uuid": "626e54f4-c021-4f11-8e33-c4e3dcaa91a4", "comment": "Malware payload (AgentTesla)", "value": "7bd5a9d60d27c0580039f545f90f951f10cfaf8322e1b0d7d5ff51e24db57c9e87321a62718ad73efec360642a37dda3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465796, "uuid": "cc0416c2-4853-44d9-8c54-d3728bcc3386", "value": "459312CB614C4EC883D885AE34A9CF8C0597D5AC5A7D1C316A25DA80FC5DDB601DECA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465796, "uuid": "01a62e30-2431-4505-bf71-aa8a545c126e", "value": "1536:iQ538t1TuYoQOwqX4ZwqVIU290Pq0SLJmm2Ka19X2n4dZCBGdU3R9fgUBb3iulek:h538tduuOGOqVPC0vm2ZHUzfgUfAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465796, "uuid": "fbc70594-af53-4b5c-bba2-54f688d8dcdd", "value": 96460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465796, "uuid": "c248439c-20f6-4170-9467-4ad34357675f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465796, "uuid": "7630ffdb-af49-4c5b-9409-2054c5bd6bcd", "value": "po_5467_FROM Art-Sea Industrial Company Limited .gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8277d4-9dc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618475275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475275, "uuid": "e8b21a31-c596-4e45-be3f-e65d6af1254c", "comment": "Malware payload (Dridex)", "value": "dbf6c660ac46d2d1425357389b941232", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475275, "uuid": "fe0b6abe-0efe-4b32-9ce0-e93c585b59ae", "comment": "Malware payload (Dridex)", "value": "692518ebff67ffc447d1c0e0d4cafc5651fab0a10545439612cf4ecda5251c24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475275, "uuid": "3fca460c-f93e-4533-a757-c770782c9e8a", "comment": "Malware payload (Dridex)", "value": "7c0d652ab26e33125eeeaf4b0275d2d50cd2c02a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618475275, "uuid": "b65ab483-e23e-497b-a1aa-9e269cce49bf", "comment": "Malware payload (Dridex)", "value": "06012b08c0c1d611d20ea8ca6e140a2977fe64fe912e6026daf722cf4c221a781a0c0810c428d7a16332158c9a5a575e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475275, "uuid": "5ee94ee1-7a21-4f76-a5ea-35d503bc576d", "value": "AD249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475275, "uuid": "0c74f23c-1a99-4ce8-9918-25ad852c3a0e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475275, "uuid": "18f74c56-6c68-4aa6-bd6a-5a4134b9c07c", "value": "3072:X0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:WpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618475275, "uuid": "d8505f3f-7f3c-4336-9d99-8bafc38b4b81", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618475275, "uuid": "d0ee2837-0a0a-4087-a4b3-a412162f68d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618475275, "uuid": "e1605d8e-fd12-4593-a736-8d11d8c4a483", "value": "692518ebff67ffc447d1c0e0d4cafc5651fab0a10545439612cf4ecda5251c24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5323acf3-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497114, "uuid": "20b39b5b-5c95-43c6-8aa1-b7475b890ec0", "comment": "Malware payload (Dridex)", "value": "6987183fa5ae8cc9d46d67cd4350a773", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497114, "uuid": "575b71f0-f64c-44b3-9c2d-6aa4fa387e99", "comment": "Malware payload (Dridex)", "value": "692dd46a7eb308a2fdcab4d321600c2671136f10a956b4e3bd0fbeefccccb798", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497114, "uuid": "b168bd37-c39a-49c6-9f52-3ca1e18c5564", "comment": "Malware payload (Dridex)", "value": "54934aea03bb2f5200d0f39a38656c10e7b250de", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497114, "uuid": "63de8e38-6378-4952-9dbf-328c7371e81d", "comment": "Malware payload (Dridex)", "value": "f1f839cdca6a7716ba327ace434377d55676188029663e67be406484353963145af2d98d0b3274bee6672eee75f8d94e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497114, "uuid": "74b0b567-0473-4610-b281-6c6603d47e3b", "value": "4BF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497114, "uuid": "7b240cf8-8ef2-4a18-bc34-0de5c173fa1d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497114, "uuid": "78726d5d-f634-4cb5-b717-05ff67ecbb69", "value": "3072:UiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:XeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497114, "uuid": "3c748b5d-6def-46e1-84cf-2152a37665a3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497114, "uuid": "f27c9e0c-e757-4b14-b578-45ad208fbbb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497114, "uuid": "ca873761-acf8-4fa8-8b63-12dd9910a69d", "value": "692dd46a7eb308a2fdcab4d321600c2671136f10a956b4e3bd0fbeefccccb798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebca8c1c-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "33f93ffb-6eaa-4b49-84a9-7f0b3caef4af", "comment": "Malware payload (Dridex)", "value": "a3f42db8c3353894e92aff92939141b4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "a62f9028-4c27-441c-8c5d-5e2fa7350242", "comment": "Malware payload (Dridex)", "value": "695ab092b85b60e91c3efcc94aebeea778cc2e156da309a2e33d8ea453dc5c4e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "9522babf-de86-4a06-b3de-41c11ea2987a", "comment": "Malware payload (Dridex)", "value": "48e3f8befef3572b4c8ca601c469c84196161a03", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464299, "uuid": "d782c62a-5e0c-41dc-884d-a816049fde7f", "comment": "Malware payload (Dridex)", "value": "30fa3e2a9776222fc9006e72961e313f337b1652dfeea62d1cfa710d5ce7cc0aa75975cb64fc54bed518ae67db3c165f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "553e8fdb-553a-48de-a7d8-eeac2ff52664", "value": "C8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "64072bb8-12d8-4495-97e2-9f528194f7d4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "93ed3758-2dfc-4a4a-bf6e-aeded7e5de5b", "value": "3072:CA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:C3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464299, "uuid": "21c70555-9e56-47e6-877d-98fc72d470e7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464299, "uuid": "b4416667-506a-494e-90c8-16b6c4d39971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464299, "uuid": "ab9b64b8-75eb-4c3c-8c80-0a00f496c6ee", "value": "695ab092b85b60e91c3efcc94aebeea778cc2e156da309a2e33d8ea453dc5c4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffc132d-9e38-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618525160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525160, "uuid": "1a3a25cd-efea-43b3-9909-86bdd0c5a30a", "comment": "Malware payload (Dridex)", "value": "c0c41fed98b8de073cda9dd2867afa88", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525160, "uuid": "c00a61c3-09c7-4c56-aa07-baa92599c09b", "comment": "Malware payload (Dridex)", "value": "69d39fa6f9abbd07e5ae5c1038bf04ba28614e5459bc6bf4b074df0bc6fc0989", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525160, "uuid": "bb135b04-c07d-4b28-b0b0-794022a9dcfe", "comment": "Malware payload (Dridex)", "value": "17c87846ca7141d677ebf19475e93706731505a5", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618525160, "uuid": "a4cb86e5-6d9e-4d6b-982a-7a6e48548995", "comment": "Malware payload (Dridex)", "value": "e2a444bf4446f15f5f6f38e9243c59582b95f6dc150dde9560f197e7c63b023789714efc9266d85cd8c9fa9b9776035a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525160, "uuid": "93aeccb0-62a5-4f13-aa56-f55fd9b3cf4b", "value": "BBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525160, "uuid": "43409ea5-3e5e-4a7c-a86f-36c0c399ef16", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525160, "uuid": "140190ab-6bf2-44ef-8f63-967386269907", "value": "3072:slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618525160, "uuid": "67114774-b608-4249-bd8f-2937a31725e7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618525160, "uuid": "9d8fa1b6-47a7-492d-9bd9-f4d7a0782fe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618525160, "uuid": "1037d266-8f41-4aea-870f-2feeaf690133", "value": "69d39fa6f9abbd07e5ae5c1038bf04ba28614e5459bc6bf4b074df0bc6fc0989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4116326e-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "ed2c7763-2832-4ac7-a5aa-2b603242d3a1", "comment": "Malware payload (Dridex)", "value": "6933d905b898e44dd69b6812419abcc3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "7d79c37d-64a7-4f9f-86e7-deb63ce0817e", "comment": "Malware payload (Dridex)", "value": "6a108a49e003116e566e4038c1d20516e93b0048a619c197f913bafbecaff8ef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "5f790321-91d6-4ea5-ae38-d7cc5c8fdc27", "comment": "Malware payload (Dridex)", "value": "916a3a40f3011055521a95a1bf8dfe3ca3ab8dec", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515981, "uuid": "0e8e00eb-bdc0-45d4-8df8-37b3330a05c2", "comment": "Malware payload (Dridex)", "value": "00b4f0499767e1489aab27548735315589e63d6e0cf25da3edfafdbd330c629ec5fcf641591295557bcecfc2b5975564", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "76d8fc2f-5d71-4274-bc5e-a61ab7e08b60", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "76c4db9e-81c4-4f3d-a654-a069d70db68b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "d34a46e4-c209-4a98-9408-a0ac0f491e40", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515981, "uuid": "4176e99b-7e6f-48e2-b349-c509311c4df6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515981, "uuid": "ffbf7e2c-318f-4084-84ba-6adde0520b78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515981, "uuid": "d16a37b5-12e7-4469-a60a-139c0e9c5985", "value": "6a108a49e003116e566e4038c1d20516e93b0048a619c197f913bafbecaff8ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31307c6-9dad-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618465546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465546, "uuid": "22373094-a6aa-4901-9f0a-da0dc4ce2633", "comment": "Malware payload (Loki)", "value": "545bb14e67de604b9ef465a6bf7dfe32", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465546, "uuid": "9f4f1e65-8c27-4004-8f15-7945a40eccca", "comment": "Malware payload (Loki)", "value": "6a172e3279f979ef10abf62b75791316a939af3d8614800230de5525705dbd4a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465546, "uuid": "2c741a0d-cc00-4811-ade1-027ef5d4422e", "comment": "Malware payload (Loki)", "value": "593c1cb4b7420a283488f49fade70a0715a590a0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465546, "uuid": "5e682c48-6eec-44d8-a547-49f98b60e239", "comment": "Malware payload (Loki)", "value": "aeb807ca71d6d610eea51414d6051b25a06dd7aa4be8d57959faa74dec81db970b9e4588b252f39025d82cb1b222c23c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465546, "uuid": "21dcd031-fc14-4bb4-b6ca-94004e78b16c", "value": "12D43391EC3AD83FCF031C5EB2D63E497839FA24911541F015785A8A806F259EEEB9B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465546, "uuid": "d7d1249d-b6b9-4551-8fff-00ba382b62c1", "value": "12288:Vt0/Gcyd9wngtVi05fC5OI8Kx/S0rk+X8X8Vm/G193Vb+rl2mAPdlVH:V+ybwgtVT/I8Kx3XPU+193mAP1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465546, "uuid": "f2b56eac-4fcb-42ff-a835-145ec3cf889c", "value": 646953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465546, "uuid": "da3591f7-9ca3-4de1-a5f7-211bed4d5692", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465546, "uuid": "c5388903-77b4-4f30-844d-255a39020277", "value": "PO-414707_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785ef89e-9dbe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618472695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472695, "uuid": "6d771a28-4a01-4129-9bcd-487c01ebfaca", "comment": "Malware payload (Dridex)", "value": "21c6af2b1b87f26538bddc05512a88e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472695, "uuid": "b5abe3bf-13a1-4198-9deb-272cfd3bd621", "comment": "Malware payload (Dridex)", "value": "6a412b357c5717af2cf5d1b98bf5adf968508d754a21af3270c45231f09b76fc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472695, "uuid": "e6abe8a0-04d7-46e2-b3ae-b9ed4c3438a7", "comment": "Malware payload (Dridex)", "value": "1593e8cbdc7a0fc964f06f8bf36dc65cebf01725", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472695, "uuid": "55631693-1acb-429b-92f7-d43f2b7d3caa", "comment": "Malware payload (Dridex)", "value": "5069e3e150d8a23f84c115b6b9e34b10e21c2dfa6790802405ea8d3edd20ba46efb04dd7470d5a401764ea72c4cecc68", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472695, "uuid": "3e736fd4-ef28-4d38-bba5-f65c37b60bc2", "value": "A1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472695, "uuid": "25658e17-2f92-44ec-a60f-71e66d7dfcd8", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472695, "uuid": "a1e7b692-b003-4a6f-bf80-1d1000cc5796", "value": "3072:+0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:dpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618472695, "uuid": "086de845-c4d4-4915-9d53-e8c25045d1c8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618472695, "uuid": "9f3bf4f0-90dc-47a2-ad13-42209984c315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472695, "uuid": "ab467f63-9b9e-4679-8c41-19456fe411c0", "value": "6a412b357c5717af2cf5d1b98bf5adf968508d754a21af3270c45231f09b76fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84badf34-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496338, "uuid": "389ca283-9493-4b7d-a2b7-7a58c2a27e58", "comment": "Malware payload (Dridex)", "value": "112bdb076c791f4e72420b6625e038ae", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496338, "uuid": "3e314e2b-ecd8-4ad3-bb0e-2229573398f8", "comment": "Malware payload (Dridex)", "value": "6a9c8adfc76593db4d984241ed4237d7c28cdcb5248966cf4178f8e529cc422d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496338, "uuid": "d0903254-8287-47ca-91a9-9394249d767f", "comment": "Malware payload (Dridex)", "value": "0e5e6a04b47f57835e5bd5f70064dccfd9ef4826", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496338, "uuid": "2aa2e4a5-edd4-4341-8524-bf89a3bafb55", "comment": "Malware payload (Dridex)", "value": "2d2edf663ff4f927a46fc2f27181ab96bcaca1aab2c27729615765aabceee5fbf9c07419c8426c327aa1971084a18147", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496338, "uuid": "83bff787-295e-410f-ab2b-fadb59cf48e8", "value": "4DF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496338, "uuid": "2f52d9db-957d-41a4-8c06-2e5223cb876c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496338, "uuid": "b66f20cb-150e-4ac4-a025-b7fdaad6e596", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496338, "uuid": "f8a2ca4c-9470-4988-af95-6cbe5baf99f8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496338, "uuid": "62df042e-e8cc-4861-8651-08d695be33d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496338, "uuid": "ac387d20-9aa3-4a56-9d7d-74445b67b3d9", "value": "6a9c8adfc76593db4d984241ed4237d7c28cdcb5248966cf4178f8e529cc422d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6885b3a3-9e34-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618523349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523349, "uuid": "a5cab277-a991-4790-8e13-40b8a0427ec1", "comment": "Malware payload", "value": "f50e89488b82622b4dd1a35a599a56ec", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldFinder", "colour": "#B8E733", "exportable": true, "hide_tag": false }, { "name": "Solarflare", "colour": "#A2BD30", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523349, "uuid": "c8f737ca-0676-4885-b923-281a9ec32820", "comment": "Malware payload", "value": "6b01eeef147d9e0cd6445f90e55e467b930df2de5d74e3d2f7610e80f2c5a2cd", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldFinder", "colour": "#B8E733", "exportable": true, "hide_tag": false }, { "name": "Solarflare", "colour": "#A2BD30", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523349, "uuid": "0844c2ca-2e4a-4821-937a-00edad6c8e73", "comment": "Malware payload", "value": "90b76eb47c0a6a7ccb2017b55cee6df88b55b6bb", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldFinder", "colour": "#B8E733", "exportable": true, "hide_tag": false }, { "name": "Solarflare", "colour": "#A2BD30", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618523349, "uuid": "444f3ca5-5bab-4630-932c-366560c2081e", "comment": "Malware payload", "value": "e61330032f9ad8ca6a64157bf1a21e4bbe9ee57a3c678f6737a6abfdcfe2a9d618be82d30f9eac836777ac61efaa609b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "GoldFinder", "colour": "#B8E733", "exportable": true, "hide_tag": false }, { "name": "Solarflare", "colour": "#A2BD30", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523349, "uuid": "0f8d9704-5577-45c5-b372-29ac56ea7649", "value": "029533734AD05AA3C22A91F46F49E02B486A62524D4E7B40FEC76B73C1F72AD5C4B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523349, "uuid": "814a6f14-aca8-4ece-9088-4ecc9f740d94", "value": "e58ab46f2a279ded0846d81bf0fa21f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523349, "uuid": "d449987d-00e3-4fb5-ade4-407126b54749", "value": "49152:BuGmlb/p27ls7+X1PgDd/oGKt4A2sPNrEUxw5acD:Klbh27A+Byd/IQs9Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618523349, "uuid": "755d152b-b4a1-4761-9b46-2f2e7d8c447a", "value": 1939968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618523349, "uuid": "7cfc30bf-d97a-4dbc-931e-26a9342789cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618523349, "uuid": "440e89f6-697b-4775-afad-59fc5472a6c9", "value": "6b01eeef147d9e0cd6445f90e55e467b930df2de5d74e3d2f7610e80f2c5a2cd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18303df5-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497015, "uuid": "1858ea14-3b37-4c6e-9e8d-f7a711da2859", "comment": "Malware payload (Dridex)", "value": "9aed646d6780174b2b7015c4d0b23f4f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497015, "uuid": "df28ef9f-2f64-40a7-8a17-f8cce421f955", "comment": "Malware payload (Dridex)", "value": "6bc33151b717ee9da7594c600adf47c9fe6606381a38326b3d1760f611b00143", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497015, "uuid": "5de70929-1a7e-4101-9f1a-a671df34b34d", "comment": "Malware payload (Dridex)", "value": "a5cdb4c70668a9152b1e6afb655209f0970c2d8a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497015, "uuid": "8e5a6ac4-bcc6-4090-b077-aeb8cd8b62af", "comment": "Malware payload (Dridex)", "value": "7a3dc0cbc898e2cce22c79cd135c1f32a7d10a42c3357665343e81397a80d32881bafc8a6bf243be9e80fe9ca4ef4410", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497015, "uuid": "902820da-8ea9-47bb-91e3-b00eae339fec", "value": "AAF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497015, "uuid": "fe049a27-2bf6-4729-b62e-b7bd7e673cf4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497015, "uuid": "d3d62173-5b7f-49f0-b475-7eebb697039d", "value": "3072:uA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:u3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497015, "uuid": "b10114db-5dd8-4757-a749-af6926168448", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497015, "uuid": "7d6d4ebd-eeb9-4291-92ca-cb83cc80c769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497015, "uuid": "fac2168d-f221-4cad-a996-d5e4dd96d7e7", "value": "6bc33151b717ee9da7594c600adf47c9fe6606381a38326b3d1760f611b00143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670db33d-9d85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618448185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448185, "uuid": "97f1c8d9-5a80-4783-9415-bac913e428ae", "comment": "Malware payload (Dridex)", "value": "9fe38ba4d671c8face95d36d2bda3269", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448185, "uuid": "5e58c808-f71b-4105-8c4a-832c2d4284d6", "comment": "Malware payload (Dridex)", "value": "6bef463b9d8354dd8176f3cfd5eb8179705d5dc275116a5fb32a687faed067fa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448185, "uuid": "ecb1061b-548a-4e65-ab94-106d95bac929", "comment": "Malware payload (Dridex)", "value": "9afca7d4b318ff7a41ec94cba10ddec243822bf3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618448185, "uuid": "8303f241-2de5-437d-b91e-dfcb4cabeab6", "comment": "Malware payload (Dridex)", "value": "aeab5ff325dc8f5794b42579d859f7beb1f412b9640dea4b38bedc8e705076852e9f6b4a628902433b6c1a5b5cb8ddc0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448185, "uuid": "ce5ade4b-2e45-4919-a781-b85f617a6df5", "value": "1CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448185, "uuid": "37c96372-a98c-4649-afb9-e954d5d02c7b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448185, "uuid": "c8dcc627-95a6-4dc0-bcf4-50cee672121b", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618448185, "uuid": "e45d8ded-776f-4bd7-8f20-cb3052fafec6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618448185, "uuid": "d2c56300-c094-4ffa-85e1-660644b050b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618448185, "uuid": "430658e8-87fc-41e4-9199-b33b9ee46ef6", "value": "6bef463b9d8354dd8176f3cfd5eb8179705d5dc275116a5fb32a687faed067fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1f5569-9dda-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618484590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484590, "uuid": "a2cab5ae-0990-4a13-8895-3bed59fea43d", "comment": "Malware payload (Dridex)", "value": "2e0f1fcfc5e11145d435339d4b924bd4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484590, "uuid": "e6eaa48a-3f24-4938-8d07-31f1a0898fd5", "comment": "Malware payload (Dridex)", "value": "6cb3acc20de2d5cf8de0740b348404f3034693bf90f8b045d9851c95968b033f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484590, "uuid": "ed4f58a5-d021-4834-9f7c-19df03083c47", "comment": "Malware payload (Dridex)", "value": "09409a3381916c63cec65efd1360219e0b2aec93", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484590, "uuid": "7edc76cd-7d78-48a2-b63b-428392346660", "comment": "Malware payload (Dridex)", "value": "a7165482566280bd01dccdcfbec905e34d11bf514bc0275e414470b373adf4a6d39179c02f48556364f1180b7fbfed03", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484590, "uuid": "0ba2d826-91d5-4fdb-b07e-fd330c14d72a", "value": "CE249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484590, "uuid": "2a970189-ce80-4ebe-bb89-f82e072c19cc", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484590, "uuid": "5172743d-c797-474f-9385-0255dbb9a92f", "value": "3072:L0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:KpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618484590, "uuid": "f4034fe0-87a6-4c39-8bf9-575788683bb9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618484590, "uuid": "f7f79c81-35a8-4620-89f8-bdd681491d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484590, "uuid": "c16084a8-9504-42d6-b6bc-5304bb29e0f5", "value": "6cb3acc20de2d5cf8de0740b348404f3034693bf90f8b045d9851c95968b033f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b40301-9e2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618520604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520604, "uuid": "5724b828-f6e1-4722-aa54-e61a8c02887c", "comment": "Malware payload (Dridex)", "value": "91625375154e93b33feea2b2a931baf2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520604, "uuid": "6227f34a-4068-4d1d-b77e-54c1373aa5ae", "comment": "Malware payload (Dridex)", "value": "6cb501f5406b34154a7de5edd098bd57377a28c8b3f06dd296dcec63a69670b0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520604, "uuid": "2b8930c5-52e8-4ba1-93ce-64ba8b132edc", "comment": "Malware payload (Dridex)", "value": "2c3d295224d5a8ef018c6ae0f4711117d49fa7d9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618520604, "uuid": "95276061-3d65-4275-82f8-a442241bb3a9", "comment": "Malware payload (Dridex)", "value": "264eaac46d4694e8460819d69b4070ff7a34283b3eeb4f34a197768a5b2fa7508adda9f1c2a86ec095062a1abfc96a1b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520604, "uuid": "95941120-a6a6-4b21-b39d-937a7761ab89", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520604, "uuid": "19101e36-62a1-472d-a29a-0fec8f099cb8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520604, "uuid": "0a67c66b-de24-42fb-9242-ab77c245931e", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618520604, "uuid": "2ec293fd-6b1d-43ed-a28e-20319e5f2379", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618520604, "uuid": "1c704150-adcb-4a5f-af79-f59ccac0873a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618520604, "uuid": "40b612d3-5160-44a2-8a16-8243ac7c18e4", "value": "6cb501f5406b34154a7de5edd098bd57377a28c8b3f06dd296dcec63a69670b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5447807f-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "f2ecc203-7b33-4726-8780-0875e2c88915", "comment": "Malware payload (Dridex)", "value": "6803675e1a4be18bf6ab3f94445e1528", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "849d3de3-7a1f-40ea-9086-337358c0fd81", "comment": "Malware payload (Dridex)", "value": "6d191231f86363e288173b51cf367e4193af0f56797a1c5d30876bfbf3534f86", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "1ef36f87-a446-4795-b66a-4af484a4f725", "comment": "Malware payload (Dridex)", "value": "f1051536e122645f66c7a3021de9cfb2086a56ef", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "4cebef50-6b9d-49b3-b7c4-da33cd24bc7e", "comment": "Malware payload (Dridex)", "value": "334f64663481c04803648c701f8205a51381d668812eeccb2790a1f1269725c5a9938fb006edeb06b8d5955529918d3d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "f52f063a-be1a-4546-9e5e-254b40ddb80e", "value": "6FF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "882c584d-4eac-4cf9-a597-5d360f1f9ce6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "f2e23e2e-53bd-4e88-9406-e7933b362530", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497116, "uuid": "d2c7127a-4415-481c-813c-d09d518b2979", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497116, "uuid": "5b30f456-751e-47da-8c29-90a765190380", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "94a7e204-2185-4d9f-bc26-55ce1cf9d740", "value": "6d191231f86363e288173b51cf367e4193af0f56797a1c5d30876bfbf3534f86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f867a305-9de7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618490519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490519, "uuid": "9aa4bfd3-9c18-404f-8165-c041522373d9", "comment": "Malware payload (Dridex)", "value": "40f83fd0be5dcbc7cbf0b46be6c8467c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490519, "uuid": "ae933127-7017-430e-b93f-8e931190823d", "comment": "Malware payload (Dridex)", "value": "6d378b67c13ede91d3d5bca1939007ae7a18312e31890e69638e9deb124a6efb", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490519, "uuid": "ff782e5c-b107-4112-91a4-d24bdb6a2e04", "comment": "Malware payload (Dridex)", "value": "7a5f54726e6b1c9559941cbabba2e127ba8b6089", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618490519, "uuid": "44da4ca9-0255-4a48-981c-1de783c2b0b0", "comment": "Malware payload (Dridex)", "value": "3806d084d767f88735040470458077f44852c686eab26f63e92c27da2216f3a21c298a30b5f23fbef4e43442ad350fcf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490519, "uuid": "ff9a6375-f298-4199-b94c-0b2162e528ed", "value": "D7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490519, "uuid": "fffd3a17-ffc5-4879-97f2-df3b57939ed3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490519, "uuid": "3a5283d4-dee0-457b-960b-98bc07fd5eac", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618490519, "uuid": "70565d5e-d490-4d2e-a33d-4a6af596bd5c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618490519, "uuid": "88fd8c6a-657a-4cee-aeca-cec8119114bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618490519, "uuid": "4cc08772-04a9-4a4e-bf8f-3b4ce03e8857", "value": "6d378b67c13ede91d3d5bca1939007ae7a18312e31890e69638e9deb124a6efb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f85221-9d8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618451265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451265, "uuid": "3d7f25c1-7fd9-4fa2-b3f8-2cf869b6a324", "comment": "Malware payload (Dridex)", "value": "72d79b89c0bb0e9a8b10d2a013505dfe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451265, "uuid": "ee63896b-3df4-4028-bb19-0e72cf19d72a", "comment": "Malware payload (Dridex)", "value": "6dc37f4389cc69df72d098e85ce8b8432d383a5321ab295afc67606f0861909d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451265, "uuid": "035b62dd-b1d1-40b8-8f3c-a0566e28fccf", "comment": "Malware payload (Dridex)", "value": "d6eede26c4e3d7a37a2fdd3c21b303d82c641a47", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451265, "uuid": "0cff4a3e-e1c7-429e-93b5-6abe714f6800", "comment": "Malware payload (Dridex)", "value": "1c2b4600fb83b333b9cac607088c4494a2da0ee3e3ba2c9dc74fc3d05f1f6329e1679133d9269208bab3836c9b263f99", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451265, "uuid": "0bfa91e8-85bd-45ac-a5d0-79fd8951738d", "value": "D1F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451265, "uuid": "bb4fdcb3-143f-4776-901b-009b866758ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451265, "uuid": "dd2cfb9f-1c7a-4d82-b5a5-f3f35146ddc6", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618451265, "uuid": "b37dcd79-9a0e-4f44-9b66-5f562f842662", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618451265, "uuid": "518e217f-4a4a-481f-840d-d4ab9f5dfe82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451265, "uuid": "223c732b-9df8-4559-9f2e-fc834fec73f9", "value": "6dc37f4389cc69df72d098e85ce8b8432d383a5321ab295afc67606f0861909d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb9fe6a-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618514637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514637, "uuid": "c40f137f-d4e4-4c23-99d9-26393e533554", "comment": "Malware payload", "value": "6ef9814f86ae3470b84477ec002b26e7", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514637, "uuid": "406e2f33-dc55-4b6d-9ac1-5dced54073f3", "comment": "Malware payload", "value": "6dc5f9185bfdbe3ab1784592e41fd39ff1c8df47a7dfe937bd02d7d028143941", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514637, "uuid": "feeac97f-3e6b-4114-af3b-875fb90a34c9", "comment": "Malware payload", "value": "0fc6a5e7b7d125c9529cbeb4af288eb2dbdf8757", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514637, "uuid": "a0e9490f-fffa-4313-b07c-5414d06eb254", "comment": "Malware payload", "value": "ae4ff7b93574f3173974cfe3986555802ba49558cdddf81893321d1b09c42012195b77ae63518678bf0a2d2813e48ff4", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPPasswordStealer", "colour": "#3EF239", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514637, "uuid": "30e552c2-e82f-4e9f-8d77-30d983762767", "value": "72F09E3902D0F2D0045451C1F3B69C07D248814A19E7F1F887EDCD7FE06EE4565E1E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514637, "uuid": "2bc6ba79-a744-4f06-9337-a0144b10aa5d", "value": "12:NyDvqpxuP2rEBf79PenVo+ageTFeGeTzvuDvG:oDvoxu+re79PcowOFkzuTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514637, "uuid": "8d9891d2-22ad-4123-83a9-5148861793ee", "value": 506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514637, "uuid": "484379f7-4984-4ddf-949a-4478a3f89d5e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514637, "uuid": "2432b62a-5eab-4f51-a300-b9bb7074c1c8", "value": "Q0UaATsq.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2236e674-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "d906930e-ee4a-44c6-a270-d92bb18de478", "comment": "Malware payload (Dridex)", "value": "39e4acd32e7097abf8cecf38a5096f8a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "13ae4b03-fdd1-4cee-8a24-0425e3fcc1c5", "comment": "Malware payload (Dridex)", "value": "6dc7ae58868bd78a082486679747ff7cb5c8de8e6d24a201f6bf638e77c2492c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "3b66b54c-b422-4642-9674-1e5fac573ab4", "comment": "Malware payload (Dridex)", "value": "9eb7ba788588d27deb64f4f71f433f2722b05fbb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515929, "uuid": "8dc78149-648b-4027-9222-db8afa18cf25", "comment": "Malware payload (Dridex)", "value": "fa7e7cb556461bcc1be6c0327133208b715eebc449a9d7533e15e91f8ea11a56c84610527ff2d615258cf36a874084a4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "96a129c6-6bae-49c3-a95e-58c9a83bb250", "value": "3AF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "fccc322d-5425-4068-858e-d0e6a72ed4fd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "4f59a3f1-6a14-491d-926e-e7a2ab296621", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515929, "uuid": "e6200e11-fa38-4080-ad5d-7409a283ebf2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515929, "uuid": "16ccae0b-dcb4-4ad3-ba3f-39c05c49bd86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515929, "uuid": "8e2db76c-2290-448c-8048-0592c0ad3bd5", "value": "6dc7ae58868bd78a082486679747ff7cb5c8de8e6d24a201f6bf638e77c2492c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e54ae23-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480812, "uuid": "30cabd8b-5ed8-46c2-89dd-ac2d5470d3e3", "comment": "Malware payload (Dridex)", "value": "b6414c2ad7a4370c7aeb3db9ad824f2b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480812, "uuid": "85c04614-76ec-40e1-9f60-a9a5dce6339d", "comment": "Malware payload (Dridex)", "value": "6e1a1c0da9a55270362556075819e554c32598f7b93f9a3e3fa65b4375627f00", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480812, "uuid": "827b5946-f134-4ff5-8f62-7e0c135a1142", "comment": "Malware payload (Dridex)", "value": "868b62f416006c675a1022cb3869d32570b98f9c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480812, "uuid": "c1aea60b-7556-4533-ae0c-87b5adbe89e4", "comment": "Malware payload (Dridex)", "value": "b99fcc5c9665e3ab46917e438d7ef0b05b1a4b8570e2a57d3aeb0638f22396fd1c0f3bba3c9c9b60a93b52122e2f2b2a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480812, "uuid": "e0c88565-cdb9-4e5c-a0a3-ff07c9ea9fa7", "value": "96F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480812, "uuid": "335bb006-3608-4b11-a1e5-4517b1a40cb8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480812, "uuid": "a48c2925-5e95-45a4-be87-6783d081e955", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480812, "uuid": "5b1574b1-a40b-4b04-ab62-1effe58e5388", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480812, "uuid": "c8856344-e3f9-4e91-bbfb-9f619961bfab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480812, "uuid": "57213462-ebbd-4966-9e8b-6887ba7619e7", "value": "6e1a1c0da9a55270362556075819e554c32598f7b93f9a3e3fa65b4375627f00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dc6946-9e3c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618526938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526938, "uuid": "9964f264-1990-4b37-ac7c-cf6c6250b878", "comment": "Malware payload", "value": "c32bfc4b47206ba19b2073190fe3d868", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526938, "uuid": "0fd4a558-192a-4e74-b1b8-0faa271f9d67", "comment": "Malware payload", "value": "6e1e24d357f8b83705b1f1506180c809e42a2db79c9d404af6e53329da228722", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526938, "uuid": "ccef42e3-4cd8-46bf-b2b2-29bcec7f6021", "comment": "Malware payload", "value": "4fa8fff510ba38dab0c4c558d7c440479dbfda4e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618526938, "uuid": "4447b361-ca94-4f0c-98e9-f74b6022a36c", "comment": "Malware payload", "value": "ec5425a4b62fa0b5ce24e8ced7988ceea36f0f3d00db8c45a4bcb2ed8d98819bca6524c138695e23d7c4c115feb2339f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526938, "uuid": "93967d08-5ec0-4373-b6e4-f15c972cc32b", "value": "4CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526938, "uuid": "ebd63abe-c178-4b51-8e07-f3432f948a11", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526938, "uuid": "6ec3209c-ec41-486b-b7a2-3d6795840447", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618526938, "uuid": "8975b3c2-6b96-4134-9684-8ed2dc87a0ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618526938, "uuid": "590b52d3-2832-4749-8a56-03a36a06ced5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618526938, "uuid": "25d35fce-ee29-4bd1-b7f6-1259f20566df", "value": "6e1e24d357f8b83705b1f1506180c809e42a2db79c9d404af6e53329da228722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54936d83-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "a6510e0d-5b51-46f7-b3d7-1fd35b813cae", "comment": "Malware payload (Dridex)", "value": "2888f114d30be6199acb72e8db219680", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "02b5ed7f-e030-4942-889a-b41bc8258e05", "comment": "Malware payload (Dridex)", "value": "6e459fbb1ba3edc50454cd3202dd2104e873691f7d1a046d83b6b79645dd692e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "277939e8-56d8-4ac1-8616-ed008c818a3d", "comment": "Malware payload (Dridex)", "value": "0ff72a2c434ecc2ccacca4d8a5546c1c04b96292", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497116, "uuid": "f31fd9d2-8595-4e61-903d-f8f367f44fb3", "comment": "Malware payload (Dridex)", "value": "414cfed82dc537df7c3fae003c6b1c8a8b6dd59d94432109c41f941db4511ae3bffbbf9a96d013f14d89422ed8147754", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "0577a1e1-dedc-45b3-b9e9-48ccb0a922d4", "value": "15F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "37e61b53-ddc6-495b-abec-53cc6808307d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "c5c8e546-fe57-4952-a1c0-70bc22a1ce42", "value": "3072:EA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:E3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497116, "uuid": "8b817c50-c014-4b78-9164-b9d496de56a3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497116, "uuid": "43a270ad-415a-41e8-9872-e80b4204c291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497116, "uuid": "fe9031dc-42dd-421e-8ff7-cc47dd02554f", "value": "6e459fbb1ba3edc50454cd3202dd2104e873691f7d1a046d83b6b79645dd692e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57873c21-9df1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618494544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494544, "uuid": "2e5480cc-3e1f-4418-8d32-e00ff77826dc", "comment": "Malware payload (AgentTesla)", "value": "bb450d869397269c5714084133f41ccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494544, "uuid": "4fcc7598-970d-4121-b47f-62b108f73c34", "comment": "Malware payload (AgentTesla)", "value": "6e70bbeead5ea30617a9e9265e453fb52bdd6c73fcaafd086859d1907f10fdf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494544, "uuid": "aa65e551-ef70-4cd4-8558-89248df0de9b", "comment": "Malware payload (AgentTesla)", "value": "8905ee9cb73921769fc77e5f014381a9d1a15d44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618494544, "uuid": "3e30b702-3221-465b-813e-233102d624c8", "comment": "Malware payload (AgentTesla)", "value": "cb9cc7c520f83ac036f4de24c2a63d11cf7b760aad07550cbddcf5ef25b7d91b63bd4dd369d1a598873765f86ce39d30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494544, "uuid": "9b2a4cbc-f0ff-4816-ba6b-54f26d52c6ae", "value": "7B256C88B544B59ECC1A8B318974CC3056227D6BD73AC50F50CF3DAB7B7E697EA140A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494544, "uuid": "228a6871-ea0b-4250-af91-3fefed99b66a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494544, "uuid": "c59cb7d1-c69c-4b2f-9ff2-d4a22d8969d4", "value": "24576:hQoltDzLs3xbzdEm0YmbmsJsNk8pMog6dQI3x1q:yE3Ls39W1b6XAm53i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618494544, "uuid": "3c3b58d6-d9cf-4c55-933b-04fb849a29d4", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618494544, "uuid": "364a4883-0ecf-4e9e-8b8d-73297c3678f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618494544, "uuid": "dbebf217-65d1-44c9-aa6e-30391c13dd1b", "value": "Goody b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f18bcf4-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496785, "uuid": "f4721668-3471-47b6-a4c7-b51de222fe75", "comment": "Malware payload (Dridex)", "value": "094a338bea68167cf5af1151688b937e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496785, "uuid": "ec97d19e-5965-4b24-ad7d-9b96a946f3ab", "comment": "Malware payload (Dridex)", "value": "6e74db03f28ee2ba1d7672c3f375f5a06948766c7fdae281b9780bdc093893f1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496785, "uuid": "623bba3b-6123-421f-803b-f1198b6d6093", "comment": "Malware payload (Dridex)", "value": "c5be7d4c0dc8d1a7fcbecb2264d9c26877cafab9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496785, "uuid": "c2fcb348-9efc-4029-a211-ee554fca0b1a", "comment": "Malware payload (Dridex)", "value": "29926cf238ff6056e1a503ec90ee9f3e0e66c9f1ca9d68526834b04df01cdae93c6effcdc2a9fbda980818d8939df9ff", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496785, "uuid": "05449e04-ff96-454c-b07c-9796a510a517", "value": "F9F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496785, "uuid": "350c213a-1a04-409d-988e-fe5d2be7e3c7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496785, "uuid": "bd92c4c6-1177-4968-9f1e-7868ea0fac6a", "value": "3072:aA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:a3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496785, "uuid": "8e3bb695-0042-4669-9ab2-2fd7ae7fbf11", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496785, "uuid": "a19ca69d-10b9-453c-8881-a10a2a7fb36b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496785, "uuid": "fbe8f49f-d1c0-4f1d-9554-38f29b37babd", "value": "6e74db03f28ee2ba1d7672c3f375f5a06948766c7fdae281b9780bdc093893f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a1fb38-9dbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618473143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473143, "uuid": "9165a8c1-648c-42d2-86a2-b9681bbb328d", "comment": "Malware payload (Dridex)", "value": "320233d1a7d7e024a476b5bcbbe800b9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473143, "uuid": "ac285bfe-a751-4484-8980-4360ddd50127", "comment": "Malware payload (Dridex)", "value": "6eaab20853fff2214dfe1c6521d8298fb162e2edb9d474b37e28dc1cb2bd9a95", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473143, "uuid": "49ab2ac1-8eef-434a-8ff1-05e245cbb25e", "comment": "Malware payload (Dridex)", "value": "5a79b024c0e3ea80d6eb4b9888f0a63a0cda42ae", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618473143, "uuid": "934ed538-1446-44aa-b3a9-284593f092b3", "comment": "Malware payload (Dridex)", "value": "1ec7aade33803578d3fb11f57469e66bfa37c09fd8745c27749df4db7541fea62647e978a650c743ecaabf9a5781d05d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473143, "uuid": "be70294f-bc0e-4a28-b505-c538e9cb6365", "value": "A9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473143, "uuid": "9cf28eb3-c24a-4aa3-a6c4-e56714968c67", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473143, "uuid": "a67d02b1-294d-4614-96c7-35a7185ad193", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618473143, "uuid": "e20974b1-83a5-48d2-8b95-2a07f231d3be", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618473143, "uuid": "49a18010-66c6-47d0-9d6c-c5b94a058c2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618473143, "uuid": "41f1a543-53a3-4e25-824e-274cb22d0071", "value": "6eaab20853fff2214dfe1c6521d8298fb162e2edb9d474b37e28dc1cb2bd9a95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9a0720-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464196, "uuid": "dab703b6-04ce-43c4-8820-80f7f2c45e2d", "comment": "Malware payload (Dridex)", "value": "aaf33b0e8123d544e61fe91d99e623b0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464196, "uuid": "e871eca3-72b2-478a-906b-41a5d4771eaf", "comment": "Malware payload (Dridex)", "value": "6ecc1aea1e75b82828c3693e7d7148c8ed8e882be9c819723459d500e89cde24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464196, "uuid": "d51cf799-b1c9-445e-92d4-b671dc9aafab", "comment": "Malware payload (Dridex)", "value": "533ef1e672c8a5b3dcb840becfb83f747f450e38", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464196, "uuid": "a350e9d6-5712-4a37-bd80-59a7e6e3fa8d", "comment": "Malware payload (Dridex)", "value": "cac2b72104f098b17915dd92ef888f716add86f2bcdcc872ce6c1b16790a6c0fb85e830ea66d3516b15a29d2745183b2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464196, "uuid": "4d3277a7-98d5-458a-bae5-46afb51a9fae", "value": "88F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464196, "uuid": "f062dbe8-ab52-4803-bc61-eb9d27d1f2ec", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464196, "uuid": "daf2cbf3-4eb2-493c-9ade-d70b0610e174", "value": "3072:pA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:p3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464196, "uuid": "fd20228b-9849-434d-9ff5-5476665d8bd5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464196, "uuid": "78708b8e-785d-4497-bbdb-b3455a8b789d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464196, "uuid": "78faadc6-e71c-4052-b043-9a03801314d3", "value": "6ecc1aea1e75b82828c3693e7d7148c8ed8e882be9c819723459d500e89cde24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a537ddc6-9d8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618451295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451295, "uuid": "35f68039-7023-4382-abed-aaeeecf6ea35", "comment": "Malware payload (Dridex)", "value": "1751f1fe5e7d4b1207ed1f1a36ea2ec7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451295, "uuid": "64046233-3449-4e31-8ebe-a88c881dd9fa", "comment": "Malware payload (Dridex)", "value": "6f12c8b7a1b39223a7900857098f087f695acdc2519adedfac82907a74aa2727", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451295, "uuid": "11eef64a-1dfa-426b-aa5d-0e67fe5742dc", "comment": "Malware payload (Dridex)", "value": "2ef34c61c379b468121df21d799578ca9c9b187e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618451295, "uuid": "2a0d01ee-aa09-4701-92ad-55eba1b1b20e", "comment": "Malware payload (Dridex)", "value": "944d85b6fee4e928ce207084be278edf6f8107556a02cc3e13af3c9002b933fdfdab23f82967d3ada086047af027146d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451295, "uuid": "45469ffe-7a76-4786-8e3e-27c8c937544a", "value": "D1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451295, "uuid": "26e65e3c-db3a-49c0-a699-aa29de8fde67", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451295, "uuid": "cd7e3dc3-6a29-46d0-a5ed-6be9af0b13dd", "value": "3072:H0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:mpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618451295, "uuid": "c54db843-362b-4687-b30c-29d16fe95cc6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618451295, "uuid": "e8d70155-7993-4472-9440-9d6553f6b765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618451295, "uuid": "62831898-b26d-4db9-a967-df80408c7cd9", "value": "6f12c8b7a1b39223a7900857098f087f695acdc2519adedfac82907a74aa2727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3a616c-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496351, "uuid": "df11c39b-c99a-4001-ac36-6753b2fc0511", "comment": "Malware payload (Dridex)", "value": "edce384bd0bddfc77666f295f2895650", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496351, "uuid": "aeb321d1-80a6-46e8-87b0-73d16622afd0", "comment": "Malware payload (Dridex)", "value": "6f2765ff49e078860d594dc3aecccd2bf7bcb8c01e0f3494abc8dfa3e5a2f055", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496351, "uuid": "a4f4960c-a501-4465-9eab-c72a92a54d19", "comment": "Malware payload (Dridex)", "value": "472fac47a87dda113e0490b44762ede53dde8664", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496351, "uuid": "0122954f-fcbc-4114-9a61-ef1887b40896", "comment": "Malware payload (Dridex)", "value": "0f0b3708e853549910fa673a9296556f2200916713a7ba8d3334f8ed2e010c3c3d646d0598e38e2c7cfb53a63407e16b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496351, "uuid": "40dab5a3-a70f-435e-ae20-4c47489d6382", "value": "41F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496351, "uuid": "84257083-e74a-4128-92fc-1bdfddb82872", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496351, "uuid": "a5814b59-fe29-4757-8627-45fb385e4e68", "value": "3072:CiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:BeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496351, "uuid": "a34f7a88-0ae9-4c9c-8b5d-3726f0be8992", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496351, "uuid": "d59819cc-9c5d-4ce3-9324-eb5d5290377e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496351, "uuid": "bab639c1-1c57-45ed-a476-373521b91c2c", "value": "6f2765ff49e078860d594dc3aecccd2bf7bcb8c01e0f3494abc8dfa3e5a2f055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdab1c8-9ddc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618485774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485774, "uuid": "635f7117-eba8-4af0-a3d4-e467bd33e7e5", "comment": "Malware payload (Dridex)", "value": "3b52dd121bc406e2c72c087377d54b6e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485774, "uuid": "67d05621-0a72-4d7e-96dd-ed3328426375", "comment": "Malware payload (Dridex)", "value": "6fa076c0baee3c061d7bbfe024044ec93d3f0cbd866a583b77690bdf5f7982f1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485774, "uuid": "f84f09f2-96ae-41ab-aa83-552a123c146d", "comment": "Malware payload (Dridex)", "value": "e523fd77ec020da0f5c0020643546bc1b3b1841a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618485774, "uuid": "012d3ed3-adf3-4f95-918d-ef9f4aadfa97", "comment": "Malware payload (Dridex)", "value": "67605d8de8f83d80f0e5500316c900ea3de6f270721e695c08a942e494aed545ce8b9cbb1ea2630b956a86ee6c921d53", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485774, "uuid": "4aaa79d4-2464-4bce-b0ba-e45d478a4944", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485774, "uuid": "65ff91fc-4cb3-4c60-916d-fa98222f1ea6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485774, "uuid": "121ef13e-6940-490b-a8d4-b81816c6ab02", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618485774, "uuid": "b12adb1a-52b4-4b2f-a8cf-dd5945a0af86", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618485774, "uuid": "d60fd2f8-2574-4940-a056-2f9c0985933f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618485774, "uuid": "e7bb85ea-43e9-4843-8472-e716177c7855", "value": "6fa076c0baee3c061d7bbfe024044ec93d3f0cbd866a583b77690bdf5f7982f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7ac229-9e37-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524641, "uuid": "68120d4b-b23a-4816-baa2-fd5007b28364", "comment": "Malware payload (Dridex)", "value": "c623348e0d1b153dd0f7c577a64ca0d0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524641, "uuid": "c7727029-86c8-461c-9323-660af8645030", "comment": "Malware payload (Dridex)", "value": "700e6128bf8607abc21a6a7a7cf4b097d6984b355655019ed2c2f179a3668841", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524641, "uuid": "2216f169-8f22-4691-af1e-0d9198cddfda", "comment": "Malware payload (Dridex)", "value": "381e1b2dd8fea25f8f32afc19b2e9d29457f2571", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524641, "uuid": "1cd313d9-9566-4ce2-b3b1-8a04cfe9d7ad", "comment": "Malware payload (Dridex)", "value": "ed19f7cac4b00dd2fd008e6f984babaaf827b7abe4f6a916bdf55d89637e7aa0849982ca7af0fd05c32350fdd707a12b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524641, "uuid": "f2b5de5f-000e-4b85-b53a-8deb273670ad", "value": "CFF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524641, "uuid": "141cc766-b23c-4ec7-8288-195d41018273", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524641, "uuid": "e2f00c65-3a0f-4d18-b5fd-78e5790ef6cd", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524641, "uuid": "645138db-12f3-43ac-b375-dbc572fe09fc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524641, "uuid": "ba792755-760f-4fbf-9379-39eb760ad727", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524641, "uuid": "0b4c7603-4fd8-4961-9d7e-faf16de8c22a", "value": "700e6128bf8607abc21a6a7a7cf4b097d6984b355655019ed2c2f179a3668841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a6d2f4-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496022, "uuid": "cdb3fca3-4dc5-4c24-b793-fc4bb1085df9", "comment": "Malware payload (Dridex)", "value": "4ce49e54963ce4d47640301f34aa43de", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496022, "uuid": "13ebc483-837c-480b-995e-ef876b3d7baf", "comment": "Malware payload (Dridex)", "value": "702f5538267646dc563846066e6534c230f0a6383e24e0d2bd3e2d136c73f525", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496022, "uuid": "fe1c04da-7b4f-47d7-a6f5-14012488a7ff", "comment": "Malware payload (Dridex)", "value": "d59c1dead75dbb0ff579e183fcf3a3f48b7d32bf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496022, "uuid": "2ba3c432-422a-475f-829d-7b4314bf9a5c", "comment": "Malware payload (Dridex)", "value": "4fa578a5199e5ecfff9c3f9e0f3770e70c216f07625859f94c00814f97eed3703e99c3d71c97bd2a408126d25539a845", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496022, "uuid": "16315c9a-d73b-4a62-b0f9-4f4d49a70426", "value": "FCF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496022, "uuid": "5d617a56-22a8-4bc5-966d-ae8ed27fa459", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496022, "uuid": "02137bcb-4f4a-48b1-8a7e-649bdb876d25", "value": "3072:jA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:j3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496022, "uuid": "b0177c81-f8dd-4557-8fa9-881433b90602", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496022, "uuid": "55d192ea-a062-4091-8ece-6595456cdbcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496022, "uuid": "0e6211a5-277b-4d5b-9c58-a6fdb3015e85", "value": "702f5538267646dc563846066e6534c230f0a6383e24e0d2bd3e2d136c73f525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642db240-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480821, "uuid": "09748416-340e-49a1-8488-479c3182517e", "comment": "Malware payload (Dridex)", "value": "c09821afe6d8dec8300ad3ef9dc8df22", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480821, "uuid": "5c2503b5-bcb4-4453-9530-ef69b42b827f", "comment": "Malware payload (Dridex)", "value": "709cb434ff5a55f34a5686e2613cf12f2a83ae91b8d782756741cee8a9843f01", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480821, "uuid": "9a860398-a808-4c9d-86d6-9ef251f9c6bf", "comment": "Malware payload (Dridex)", "value": "dd9bfef4d0ed9e82b84b840e8348cf414fa81c2c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480821, "uuid": "9fa1f8de-12bf-4d0a-807c-32f1f36d5e42", "comment": "Malware payload (Dridex)", "value": "6a0baa3177bf4ddbce359f2bcc739d633718f2af9b95d00481da0b8281c5e448620090f7177990cadcdd9c4a69180295", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480821, "uuid": "52dc7c7e-8c27-427c-ba10-7f3b460a37d9", "value": "5CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480821, "uuid": "097c6f0d-fd3e-4543-b694-c9a09d064300", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480821, "uuid": "a4212b01-fb7b-4e7d-a76e-d20b05267b0a", "value": "3072:GiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:9eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480821, "uuid": "c06035b4-0774-4270-9daa-06e8472b151b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480821, "uuid": "bf96e3bd-a82c-420f-aa5d-f5614695a9bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480821, "uuid": "f7b439f2-1c77-48b2-b02e-d10acd90a296", "value": "709cb434ff5a55f34a5686e2613cf12f2a83ae91b8d782756741cee8a9843f01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2564ab6-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495958, "uuid": "8a0c925e-8ace-4d1b-9770-06835810e5f0", "comment": "Malware payload (Dridex)", "value": "0eee2b59bfa710c17286871e24dbf30d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495958, "uuid": "8d99f5f8-a19d-483c-a690-3ec4b7d5ae70", "comment": "Malware payload (Dridex)", "value": "70b8cd69cdb94278ba80346e16abb9016150d705ccbbcce60f5bbc8ac964f84a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495958, "uuid": "275ff19a-1af5-44de-830f-c91bec64ce8c", "comment": "Malware payload (Dridex)", "value": "f8220a732828a3275191dfdd62ddfdbdbe593115", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495958, "uuid": "9bde2c54-7a48-4642-aa90-26f5cdb10546", "comment": "Malware payload (Dridex)", "value": "56ece73ee2d5ba124b8d4dc20e339990198f61b66c5c9d83ea6357dd36bc7f6db508dfae18333cd3d99394eb9dadfae2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495958, "uuid": "1e803cde-ad5c-4671-9788-2feaa7706808", "value": "9BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495958, "uuid": "389339aa-042e-497b-8b72-76a6afa2f57a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495958, "uuid": "2a6fe2a0-5890-4476-981c-80ac2559a1df", "value": "3072:WA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:W3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495958, "uuid": "44e3c222-bf7a-462b-8b06-ed9560d44b13", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495958, "uuid": "410344cd-33b9-4394-804b-a5294bcb0915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495958, "uuid": "cd8075bb-e151-4484-82d1-dbfa85d73cba", "value": "70b8cd69cdb94278ba80346e16abb9016150d705ccbbcce60f5bbc8ac964f84a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6deebb4-9d8e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618452238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452238, "uuid": "857f4ea4-c6fa-4770-a987-a5295e8ad65f", "comment": "Malware payload (Dridex)", "value": "99eaa175e71b796e1f93de3226c26054", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452238, "uuid": "10f3efd6-d47f-4909-b67d-b6b9ab4a12c7", "comment": "Malware payload (Dridex)", "value": "70bc60a5ea5587a299836a264b158b9b5d1363fbf19279e4bbe583708d5a6a6c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452238, "uuid": "85a45c57-4ec2-4f92-9e28-491bf7ae358a", "comment": "Malware payload (Dridex)", "value": "99043243cbae421ee789352e2f0102a91dd5ffd0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452238, "uuid": "5acbc094-40cd-497e-99f1-e851c4fea2e6", "comment": "Malware payload (Dridex)", "value": "bc663ca719d7fcca0cb1f0b8b91d36d82538827ef591f5124b6ca61265c887d21d1c5b74abcad28ade6f285a08a893c6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452238, "uuid": "5f56da62-c2f0-4ffc-ae6c-89a49250a5a0", "value": "33249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452238, "uuid": "37f053e1-2fa2-40c3-a377-7432abbb622c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452238, "uuid": "cb6a4d9b-aa84-43d8-bee2-3a31e79ff63b", "value": "3072:c0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:npepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618452238, "uuid": "7a654142-7815-462c-9938-ede57dedffc7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618452238, "uuid": "84a8c00c-8531-4eb4-993d-fffc8ac1c6a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452238, "uuid": "f0c52ca2-d864-4bff-a42e-0dc263e61c82", "value": "70bc60a5ea5587a299836a264b158b9b5d1363fbf19279e4bbe583708d5a6a6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9d92a0-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "1e8c0bbd-dda8-4387-b365-1bb5af8a31b9", "comment": "Malware payload (Dridex)", "value": "0dd7c7a6a1e9cda80d65a51474058dbf", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "c56eab32-53f0-471b-8fe5-4cbd4a3b25bb", "comment": "Malware payload (Dridex)", "value": "70d8b891e64ad1b86f32db6cc3c5e1cc185b69c95614737adb66964920850a73", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "da31a3c7-2e4e-4df2-aa15-cc8760eac3e2", "comment": "Malware payload (Dridex)", "value": "d2f5adc86ba6a26129648cbde06e232ffb95a748", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497185, "uuid": "d6e4887d-4c3c-46ae-b8a1-bb9c56783991", "comment": "Malware payload (Dridex)", "value": "57779733d79baa6168ca28cbea5495a16d0d5db5993cdf484a5d6a21354c419a01f4b15d23d0bb977ee5353852d8ac26", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "303d13b1-8bbf-4a9b-9721-d8d0160510be", "value": "EFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "004bfa1c-98b3-4ac6-a5ff-99e64d69ebfe", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "4badf407-cdeb-4ac5-86c4-b631db816fae", "value": "3072:ciFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:/eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497185, "uuid": "79dacaf1-5f0a-409b-9d6b-4cf259b7c4cc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497185, "uuid": "50323c3f-4fa2-4e2b-a3f3-8e684aa405d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497185, "uuid": "c53068ad-ddbd-4313-9dac-d0b21b1d35f1", "value": "70d8b891e64ad1b86f32db6cc3c5e1cc185b69c95614737adb66964920850a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4c2b1d-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480786, "uuid": "e3bfc0a7-a95e-4278-91b2-8075b3955515", "comment": "Malware payload (Dridex)", "value": "d77362a276d1d0f97cc2491aa8f93d7a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480786, "uuid": "a8050d6a-bb97-446d-8922-53e58cb000df", "comment": "Malware payload (Dridex)", "value": "70e9a20adf6aad24b8dd15830c6dc0d3d366da6b0d0d931c6959cb16e867d4fa", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480786, "uuid": "dce91d64-101a-4e59-bc4f-0ed1f5d12f4a", "comment": "Malware payload (Dridex)", "value": "8de981104e2d1be3f9b7e55d38ec1f8adf9320f9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480786, "uuid": "5bf7b4d0-fea4-49ba-a8fe-8c1eb0a6198d", "comment": "Malware payload (Dridex)", "value": "4795c9bca05dc2ac6be2c6b594ae25cce960b16f2c2402e25de78c96c0b9b7b6fbd457c89b6863f7cfcb7df093468a59", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480786, "uuid": "3a171fc5-4093-44b5-8995-c1eb62a037e6", "value": "0DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480786, "uuid": "dfe00a5b-3d98-47eb-991c-2a7b395127e3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480786, "uuid": "4665531f-0ad2-405d-b929-4dc69a9bae67", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480786, "uuid": "d674e9fe-204a-4ed1-921e-eafa67483cb7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480786, "uuid": "3c7756fe-d284-41af-a8ba-f7296e66354b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480786, "uuid": "c55562e7-dd03-4275-9599-769a91040535", "value": "70e9a20adf6aad24b8dd15830c6dc0d3d366da6b0d0d931c6959cb16e867d4fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db89aa92-9daa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464271, "uuid": "d938dc88-bce7-4988-9cbe-177e48e62336", "comment": "Malware payload (Dridex)", "value": "fccf320bf0ea4406d8caf30ad204abda", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464271, "uuid": "6664517a-cd58-486e-bee4-a7806f3ab416", "comment": "Malware payload (Dridex)", "value": "7129dd88d81953ee39c5e95048eebf0f01daa89e11520f5738be3f3e705ea042", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464271, "uuid": "c87082b8-bb43-4f95-8515-710da0c5ec19", "comment": "Malware payload (Dridex)", "value": "315196d1d7cb5c961753b7ca16734a04119dd383", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464271, "uuid": "6ee12e28-fafe-44ef-a773-867dc6fed663", "comment": "Malware payload (Dridex)", "value": "a6c9276b2b6b970e71447cf75615b01db7bd9905a9c23c3fe1379e08e1b5d247add1cb12a8f546768f398bc61789ae7d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464271, "uuid": "71556856-e1e6-4834-bd99-72de64af3d1c", "value": "5DF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464271, "uuid": "a3655b5b-60ac-4704-8c6a-86ad20ba31f8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464271, "uuid": "cd645f50-8b6b-41a0-bc0f-81df4e41fe19", "value": "3072:1A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:13J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464271, "uuid": "c35a896d-0986-4dec-8aad-918a1c79880a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464271, "uuid": "aeb7b7c5-31ac-43cd-88ca-4cfb0a2f8399", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464271, "uuid": "4949452d-07c9-4aec-a7c6-30d0d858a796", "value": "7129dd88d81953ee39c5e95048eebf0f01daa89e11520f5738be3f3e705ea042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb99788f-9ddf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618487062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618487062, "uuid": "303d8981-8d13-4b8d-a0e9-47c978b73182", "comment": "Malware payload (Dridex)", "value": "b4059ff7037aa8d498105298c9f16632", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618487062, "uuid": "d37c7958-95c2-4c40-b5ca-103d4b1d4be8", "comment": "Malware payload (Dridex)", "value": "712d4bd385542c08b05430d084b56c3f3f02bee71cf0c777d5e54a8748a49185", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618487062, "uuid": "ffbd394b-cbb2-4d99-9fd8-1c9f555ab0f0", "comment": "Malware payload (Dridex)", "value": "681c6e3f134cc35fd618a81774d042190ed0bd57", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618487062, "uuid": "08ddcf14-5196-49c9-b640-4819efa4ddd6", "comment": "Malware payload (Dridex)", "value": "0980296ec664494599edc987e68b42a1aa92cffe6723f292fa710c357dd80ed5f4c11dbfd82e4b1bab993a7085afb9ac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618487062, "uuid": "d48ea03f-7e54-4b69-9434-240f73e90d77", "value": "28F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618487062, "uuid": "2145aee5-9f70-4c3f-8b4c-34d854ca92ce", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618487062, "uuid": "a14ea05b-a33b-4a78-9d6f-b6675dc14b4b", "value": "3072:PA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:P3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618487062, "uuid": "798a46f0-b046-4cdf-b752-3c96a0e5552d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618487062, "uuid": "6a2b20f6-c903-4738-9835-c3a3e9779f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618487062, "uuid": "2e6a31f5-3a6b-438d-842a-332a82e6bb88", "value": "712d4bd385542c08b05430d084b56c3f3f02bee71cf0c777d5e54a8748a49185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4749bb-9dd7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618483355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483355, "uuid": "eb106b0b-e864-4243-bc93-8c3e0c3e0291", "comment": "Malware payload (Dridex)", "value": "b7f3a691e69d4b2f4c82af6a3900e8a9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483355, "uuid": "c6960597-0c74-4ad3-a941-0c5658fc17ad", "comment": "Malware payload (Dridex)", "value": "715025337d18a02d92bf631f8ce1095e03d0b2a50a69e974162b6da694c091a0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483355, "uuid": "9b440e25-e04c-4518-b6da-2ae218293966", "comment": "Malware payload (Dridex)", "value": "8040ce7f40412b23ca4687329a0debf060f7f7f0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618483355, "uuid": "65f6c972-43a5-4a60-a958-b1ecea1f945d", "comment": "Malware payload (Dridex)", "value": "2a938fce4bce3afe6aa0bb6f3422d0038d11a36f8401c821c5404710f967c0c9778684cc8b806ac0fa23bf4c8491ab04", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483355, "uuid": "c7600b98-0556-495c-8ad6-934ea27d06fa", "value": "7B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483355, "uuid": "d5fc1d1e-0e61-4424-8989-15b1676d59ac", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483355, "uuid": "20df821e-17fd-41ff-9e72-6e66b5df173e", "value": "3072:u0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:tpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618483355, "uuid": "74cc9db5-ae66-4534-883a-98c955538be6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618483355, "uuid": "12668d50-367b-4f58-afb6-5469fbef4b7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618483355, "uuid": "c538c5ab-efef-4137-8455-8bbed834e5de", "value": "715025337d18a02d92bf631f8ce1095e03d0b2a50a69e974162b6da694c091a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd527d4-9e10-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618508028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508028, "uuid": "faf6e6e4-2cce-4b2e-959d-b82cc0432ada", "comment": "Malware payload (Dridex)", "value": "60afd7f9f1bbc99215f5d0e8c806960d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508028, "uuid": "7545f6e4-bc54-4a50-867c-fc60a88c7ebe", "comment": "Malware payload (Dridex)", "value": "71d3a166ff87199973868ccf4242b83d9b22b29cff3eed72d48c2a6c46e2bf79", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508028, "uuid": "fb1bd52c-fc06-4287-8d51-960a894517ab", "comment": "Malware payload (Dridex)", "value": "62d7c56ed592f0873d8c5f5c6ed2bed076d3079d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618508028, "uuid": "910d529b-d340-4083-8c94-a58039bbdf52", "comment": "Malware payload (Dridex)", "value": "11627a80992515e313500a281805421c242e26d63f5337bea09b818e4dc44b4de96cd934b83a06251012b96a90d4c113", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508028, "uuid": "74f61c5f-8215-483d-bbd2-6fbcf0256f9e", "value": "75F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508028, "uuid": "c725a8a9-9d32-4147-8acf-0ee15594cb45", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508028, "uuid": "69aa9d39-4014-4c99-9296-526992fac7f9", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618508028, "uuid": "192f9f00-27d4-44f3-8f81-76c51f1e15ba", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618508028, "uuid": "2330c64e-ec2f-4e2a-b8a5-de40e155e6e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618508028, "uuid": "82cc20e7-aaad-4591-bcdc-bf591fcca0c8", "value": "71d3a166ff87199973868ccf4242b83d9b22b29cff3eed72d48c2a6c46e2bf79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73b89f1-9d8f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618452641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452641, "uuid": "73425734-4d75-4723-875a-071006afec01", "comment": "Malware payload (Dridex)", "value": "201d38a8715b725a55809f5ed5d06e0c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452641, "uuid": "dd3663a0-e462-4aee-85f0-ca32b266efb5", "comment": "Malware payload (Dridex)", "value": "71f0a28f49b51c39aed567f4cefa48009e50222d7ff2035d7e6d58b089f6eb09", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452641, "uuid": "ff8933f2-b077-4b53-90cc-282e0ecab4f2", "comment": "Malware payload (Dridex)", "value": "ea9f8b6c2e3fb0335e784e250f02bf795ed8ced7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618452641, "uuid": "3dc4fdda-9d19-476a-93d8-3b4cca536df3", "comment": "Malware payload (Dridex)", "value": "b3ed7c011b5909b35ab5e87f33919e7dda2b4879bd409af4ca4764b2e2285961ba673f290eac752c1c5aac9123cfc102", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452641, "uuid": "f9f179eb-5248-4c33-9295-4947d3f65c8b", "value": "00249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452641, "uuid": "bd087366-ac08-47ab-892b-cc3f0707c2c4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452641, "uuid": "d38399be-e61f-4edd-875a-5e0432843ebe", "value": "3072:T0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:SpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618452641, "uuid": "c05f2bb4-eb01-4594-89b6-d04243e8ef1e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618452641, "uuid": "825ad8be-315c-44e7-b341-085037b00066", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618452641, "uuid": "8855325f-d3db-4de8-af90-fb1ead109c5d", "value": "71f0a28f49b51c39aed567f4cefa48009e50222d7ff2035d7e6d58b089f6eb09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194ed47c-9dfa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "a4c82f4c-b6ca-43e2-b64f-b37c6be1df59", "comment": "Malware payload (Dridex)", "value": "37f2ace299dc76d329fd293410e0ec21", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "1089f08a-5955-47b0-9132-4e53c68f8c18", "comment": "Malware payload (Dridex)", "value": "72059e7aed3535f6551d65aba0d71764cc7d4ad9c26126e87a87f37e6c5f39e7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "675eef42-be2e-450a-a96f-10ad01cb12eb", "comment": "Malware payload (Dridex)", "value": "d788a4707375fb3c047f9ab39f75a5e209851d34", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498305, "uuid": "05e43d60-653d-4753-b332-8c7dd112dda6", "comment": "Malware payload (Dridex)", "value": "ee5987150554f59f4a4bb5539ccec58bc5955ad6bc1422fab9b2377b5c686ae8b8faca9766303104a02c4ea13b14cbfa", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "37e7d028-62cd-4143-b921-9fe118ae5340", "value": "C1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "38c0e49e-3618-49f6-a5fa-745d2c49b86f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "079c3117-da94-416b-911d-370aa4efe0f0", "value": "3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498305, "uuid": "6148d6f8-220d-4d68-8c3c-621c75a7dfc2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498305, "uuid": "3db573ee-adc1-4d53-83a1-ec1c40d33258", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498305, "uuid": "c0327db8-6c00-40bf-9280-a343df2513d0", "value": "72059e7aed3535f6551d65aba0d71764cc7d4ad9c26126e87a87f37e6c5f39e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437f824e-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497087, "uuid": "a0b677e7-69ba-43ca-99f4-7e5826cdf918", "comment": "Malware payload (Dridex)", "value": "f024559e41845449b51fd9bb063036a6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497087, "uuid": "547aa169-e79b-41c8-b39c-06947a3b588b", "comment": "Malware payload (Dridex)", "value": "72093dc47fb9a1dab90e814fea20876e59eee223d97d51b85ed9ccfdb35d5ffd", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497087, "uuid": "afc4d6a2-82bf-4053-942a-14fc9ca7fccb", "comment": "Malware payload (Dridex)", "value": "74d2e7ff4b93231e3b2f56d6e4ebd1911de7338f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497087, "uuid": "11fae411-1085-4a90-b81e-a4243d631da9", "comment": "Malware payload (Dridex)", "value": "acaca9b60f0a1a755381f77cc5de2e09b307ae736fbcc86551319aa6cef229baa40c2e9fc57fbb0c5714141f2f36f47f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497087, "uuid": "1fb42ba0-78a0-4605-b609-54b57042c3d2", "value": "0EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497087, "uuid": "7bceeb46-d602-4abf-b92b-5c090136fb27", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497087, "uuid": "e936075e-dd13-448c-bd79-0c8760fd915d", "value": "3072:UiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:XeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497087, "uuid": "fe0046fc-d687-4c23-99c1-8d291c28d37c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497087, "uuid": "31a5b5e5-2692-4b8d-9fde-4822932aae8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497087, "uuid": "765e585d-9c93-4d72-8df2-a3eac34008da", "value": "72093dc47fb9a1dab90e814fea20876e59eee223d97d51b85ed9ccfdb35d5ffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b66e8ab-9e1f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618514334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514334, "uuid": "b2fd10f5-10d7-43d5-a179-5138793612a1", "comment": "Malware payload (Loki)", "value": "71fffc7d15f4c34476a1d0db1d7a9ff3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514334, "uuid": "ab21a95c-acdb-44ab-aa33-677cb7fb5a03", "comment": "Malware payload (Loki)", "value": "721339a36ab621f9aac5fb09e8e10d37e51149fddfd0d24f10b6761a45f456db", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514334, "uuid": "2af6c13c-fc92-4ea5-aab5-2be840b02d6b", "comment": "Malware payload (Loki)", "value": "5bc511117f7a0fa74b864d2c7df1b7b547583434", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514334, "uuid": "f5106629-8064-4540-ae2d-0dcc435665c6", "comment": "Malware payload (Loki)", "value": "144013160ea1b598e8ba1b53c7305b3df11ad62fb25aa37f57fcc064e28fc02474b858c78b62e29188aec356b152abd1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514334, "uuid": "ff898429-5f7f-49b4-9ec4-2ded24488dcd", "value": "6E427DA0DEA8DE688B1E8167067EBC4C493570BD53E25AF03CCCE6E92757E095B31418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514334, "uuid": "262ebf65-bce2-41bd-a4d3-69a7b9ec976b", "value": "192:YCumHrYW6W/0SjVoK4AC2iOQ+zg8Gg62+4pNb126pb2NezXLMey4DmKYmx0hJcIz:rd0W6/+qAjfzgc62HYQz7MePiKYQ0hyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514334, "uuid": "70b89a82-2bac-4752-bcdc-c26a3d1c4199", "value": 12245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514334, "uuid": "67c87673-852e-4cea-aea1-6c0951096ac8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514334, "uuid": "ae8a6140-aab2-4c8d-a41f-8595e9c2bf4c", "value": "71fffc7d15f4c34476a1d0db1d7a9ff3.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55beb365-9e18-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1618511291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511291, "uuid": "4e733219-420f-4907-bc7f-ea102bc49c04", "comment": "Malware payload (TrickBot)", "value": "4ec95ca2b0df8475ec8b973ff2fc844a", "object_relation": "md5", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511291, "uuid": "5020594a-5fab-4134-a84e-e4c9685b245b", "comment": "Malware payload (TrickBot)", "value": "7235083a31014473c9a538e102efd9b9549ac454f99a5f8b2c36ccfc69045f0c", "object_relation": "sha256", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511291, "uuid": "ebd47b24-cb83-4c10-b829-4111f3820eb1", "comment": "Malware payload (TrickBot)", "value": "385a0daa005f5d87911fd1144d1e2f18a1ca8b5a", "object_relation": "sha1", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618511291, "uuid": "999b0e0e-f225-492b-adbc-145bba753ee6", "comment": "Malware payload (TrickBot)", "value": "fac16cc82e4a930774edb7ef173674bfe49215a7128f653a9db25b891e49ed9a981f9a2c3693537436894a6a65654d35", "object_relation": "sha3-384", "Tag": [ { "name": "bazacall", "colour": "#F247BA", "exportable": true, "hide_tag": false }, { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511291, "uuid": "d1d83bba-516f-4e71-84e1-2693d306a7a6", "value": "5A548A0B8D2C19C2D56D42F97E460EED7E082B1EEC42AAFF10606FC63E651571D8E16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511291, "uuid": "b01bb1ab-c26f-4eb0-a015-8e9f735e8303", "value": "6144:cI9GKZGd38S3knv1D8LtYOKlJbAuxcM4SPtDr3Dv:z9GEGd38XvAtjuy+P3Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618511291, "uuid": "8b6502a8-e3bf-43ad-9d68-2433f882361c", "value": 296187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618511291, "uuid": "f367c7b6-8369-4a18-9476-a693dc0d54e4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618511291, "uuid": "9a847e54-f4be-4882-a4b7-43dd042511d2", "value": "subscription_1618510398.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5ccb4c-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496753, "uuid": "c5f646fb-61ca-4b35-8a21-32d24357c4a6", "comment": "Malware payload (Dridex)", "value": "82fc19da26c7e296e9e1772719081500", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496753, "uuid": "245d4d6c-e3da-4573-90cc-ec5b9ca66da2", "comment": "Malware payload (Dridex)", "value": "723b7567e1d11a5d75306437625597cc30725405afa5d8741a1d47cdee279eb6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496753, "uuid": "83119bbc-c385-454e-9342-a39f019a7aea", "comment": "Malware payload (Dridex)", "value": "b0ca282ae8c0d5174219b802401abe23531b2559", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496753, "uuid": "f1a14a25-f0b3-4e0d-a9b4-0118cf238fec", "comment": "Malware payload (Dridex)", "value": "de3fcead4cc85d74c59e2b8d2efec68cf42e622a9257b1696e6bda19b7be3b34005f552b1b131cb7463c66211bf567d3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496753, "uuid": "30726165-4598-4bab-874b-6b91eae199bd", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496753, "uuid": "5471544f-2e53-4b6e-b025-df8e722dca01", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496753, "uuid": "d2ae735f-5cfe-48a8-b97c-aee5669f1401", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496753, "uuid": "9aa319ef-89a5-4aef-92f7-210ee59aadbf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496753, "uuid": "87660874-3cbf-47da-8a9c-7791c52970e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496753, "uuid": "bb885209-b6d2-4ea1-8bbd-4a1ffc3486d9", "value": "723b7567e1d11a5d75306437625597cc30725405afa5d8741a1d47cdee279eb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748d2e32-9d89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618449925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449925, "uuid": "e8c0d9e4-469f-48ee-9b19-9cc5e85498c7", "comment": "Malware payload (Dridex)", "value": "ee33b61dccc47f7db73890b4681c3f0b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449925, "uuid": "ea4dde6f-2bd5-4157-b3c1-32759c9f999e", "comment": "Malware payload (Dridex)", "value": "72a4cfedf6722bbfc736ddd39877a9c8058c4ef9372033469248c18290531676", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449925, "uuid": "53ce79e8-5ab2-42ed-8230-0d8ed880d804", "comment": "Malware payload (Dridex)", "value": "5649bff15f84498de24ca1dc1e0ba30646432d36", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618449925, "uuid": "7d62c5bd-59ce-4d48-95d0-ff73ab69c45d", "comment": "Malware payload (Dridex)", "value": "944296cff3e52a8ac32b0c62b6ad82dd12f563b6f87a37986b7d2dbad53335ab17a206a15bb8f023287b0024929f6016", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449925, "uuid": "688ba1d1-5270-4733-b2ea-39e51b9e623e", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449925, "uuid": "0dbb0f6e-a994-4da4-95c2-ecff70b85708", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449925, "uuid": "df2bb3d2-445d-457b-b0f2-96570436d88e", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618449925, "uuid": "e4020802-8351-41c3-b3a7-f9417a96079a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618449925, "uuid": "8177d8eb-e53d-473a-8ca5-7dbfab86654a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618449925, "uuid": "38be136f-0679-49a0-9e26-610a8b401d77", "value": "72a4cfedf6722bbfc736ddd39877a9c8058c4ef9372033469248c18290531676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9791ea47-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496799, "uuid": "ba06be3d-0c27-47e3-b76e-3140e97034c9", "comment": "Malware payload (Dridex)", "value": "2716a3874d23859518c7966a39514411", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496799, "uuid": "b8c1ad57-205c-44f9-a42e-e34979c1c5d4", "comment": "Malware payload (Dridex)", "value": "72c03f15263f9b9e8fc19f6882ba9f85c8d0245d3b9ca7a900548acd1e4cba2b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496799, "uuid": "47ff7126-7761-4f15-b011-4f87e48c8147", "comment": "Malware payload (Dridex)", "value": "e414045599615a3dc3620bee16e8c70439e862ee", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496799, "uuid": "e58976f3-2e3f-4313-b8b9-b1fd85833c30", "comment": "Malware payload (Dridex)", "value": "90b77793e404219b90584a484d6049b3ec4c4ea7e5c3383fcefef43fa2883eaadeac8c17ea93bd8f9180b981b0060410", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496799, "uuid": "12ad5e76-57da-4cad-9552-3d7672e05532", "value": "57F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496799, "uuid": "827a2c03-6100-4da4-b877-266598b22a34", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496799, "uuid": "bb14e2b9-f59c-4247-a715-02b976fb7143", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496799, "uuid": "efd59df0-8eb4-447f-b805-491ad014fa9e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496799, "uuid": "5b38cb7b-8b8f-4feb-8f09-a93c24eccb21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496799, "uuid": "02c83e2d-f413-42af-87d5-cbed42ae11c3", "value": "72c03f15263f9b9e8fc19f6882ba9f85c8d0245d3b9ca7a900548acd1e4cba2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf566828-9dd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618484437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484437, "uuid": "41f2db1a-2948-4890-b98e-f7d603beb74e", "comment": "Malware payload (Dridex)", "value": "aa2e55fe98243a26f295ed2b36f2ce26", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484437, "uuid": "d69c9b62-c9b1-442f-a945-fa4eb6db9478", "comment": "Malware payload (Dridex)", "value": "72f2ed1bbbfae65605da2da23dc728b416dc6e7e0e23da6b62f5b22796ee9e25", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484437, "uuid": "3eeafe9f-9bf0-46b6-8536-ddb64802763a", "comment": "Malware payload (Dridex)", "value": "53fd17e8a2a2f8407b3fe77c80c5bd4867747896", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618484437, "uuid": "ba921b71-a710-4791-a06b-85ce12e0880a", "comment": "Malware payload (Dridex)", "value": "4111d250127eb4ecf214fe509aa85ffcdfe47ff891552633367c1edccee2b4a6a21ce6eda83a636fee3844ec0804f1d5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484437, "uuid": "2fe0e838-bba3-46e7-94fc-0e39875d6d68", "value": "7A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484437, "uuid": "b6779a6b-acf3-4104-a67f-18a1635a0a5a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484437, "uuid": "9525d62f-920e-4e70-af2a-b3f50e682c24", "value": "3072:E0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:vpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618484437, "uuid": "58bbc346-90ba-4282-8115-02eeb8c8219e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618484437, "uuid": "3cebb747-8d11-4e09-bec4-8defe1f68ec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618484437, "uuid": "9a1676f0-1228-4920-a855-0acb6382a03d", "value": "72f2ed1bbbfae65605da2da23dc728b416dc6e7e0e23da6b62f5b22796ee9e25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b75e421-9dd6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618482901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482901, "uuid": "cc0b07fb-9e38-45ee-8b5a-a41d28417c57", "comment": "Malware payload (Dridex)", "value": "501843e47bfa971117c773f7e2d387e9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482901, "uuid": "98f87314-e6e8-4f0c-bf41-c3e94e5d5984", "comment": "Malware payload (Dridex)", "value": "73023e5dd8910b0b54246539a952320dc9a1bb02159c582033c872885ab0ca5c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482901, "uuid": "bad14b43-e492-4224-b714-db8c2f77b64c", "comment": "Malware payload (Dridex)", "value": "12defda3549256972bd04592bf9d10c5b03b9908", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618482901, "uuid": "76fdd379-387e-45d7-88fe-6fa552f4b423", "comment": "Malware payload (Dridex)", "value": "c9f0455c2497beab2fead49a7d809723d4be2bfea10466302ae1a2253bc3f4a3e28a9718df8b812e7010e35915ab4b85", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482901, "uuid": "5f542428-bc18-4ed6-a66b-a9df179d42d1", "value": "7E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482901, "uuid": "f425a004-25f9-48d2-8597-6c76c69754c0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482901, "uuid": "e5baee53-8ede-42ce-9f77-f7f9a3b0f097", "value": "3072:V0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:4pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618482901, "uuid": "e845d4a7-f6de-4351-9f76-e9b1b5cf7f25", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618482901, "uuid": "3c41cb58-1bcc-479c-966b-99da058bfc67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618482901, "uuid": "0e9941d0-9546-4581-87d5-0dc47636b8cf", "value": "73023e5dd8910b0b54246539a952320dc9a1bb02159c582033c872885ab0ca5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf76b19-9dca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618477962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477962, "uuid": "2d56332c-5522-41c4-bd74-9af843d45854", "comment": "Malware payload (Dridex)", "value": "a3a9ac958a14a1344bb045cb43c2246e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477962, "uuid": "f88dbe67-8180-41a7-b9e1-7e7e212e0deb", "comment": "Malware payload (Dridex)", "value": "73075021811c35c7a8ac6749862a40519be119537bd5154bbbd75c9cc60b5a20", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477962, "uuid": "fb13400c-ec7e-420b-8b2b-3fc02f2afc11", "comment": "Malware payload (Dridex)", "value": "50c6429dcf3273ad94f4024f38effe85a1fb459f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618477962, "uuid": "2698883f-ce3b-4b22-a09f-f84db2e657d0", "comment": "Malware payload (Dridex)", "value": "2379d99c2c54b01ceb8266b307fc6c33ab3ab48e134b9ee073c4835be08ba400d0fd46e9a075ea4a5330a2c58163420a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477962, "uuid": "52a8a01e-328b-433f-b229-21da23554eca", "value": "A5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477962, "uuid": "8d06b233-1761-4854-8946-2fc222cfc1a1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477962, "uuid": "fed4a00f-281e-4586-940f-537bb8c035c0", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618477962, "uuid": "7793c7c4-bf20-45d5-aca7-f6cf52ece4cb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618477962, "uuid": "bd15deb8-9221-48be-b5a4-80f37f7a81ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618477962, "uuid": "71a5a847-87c2-4c9d-aed2-d43f35655077", "value": "73075021811c35c7a8ac6749862a40519be119537bd5154bbbd75c9cc60b5a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d549b59d-9db7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618469844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469844, "uuid": "5f6396f6-b832-4798-9b6b-8f198e60e697", "comment": "Malware payload (Dridex)", "value": "b5eff03f4142f5803547922bc3cc9359", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469844, "uuid": "748e8265-34d5-451c-bd6a-af0f9c6ac5d0", "comment": "Malware payload (Dridex)", "value": "738fd3bad299bb66c72a2894170d405510caca8d48e457fa43cd7431ce6ac937", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469844, "uuid": "aa8879d5-1ed9-4e34-a342-1de519859c20", "comment": "Malware payload (Dridex)", "value": "ab2c5abb57ed49b4b9f8955314ec3816833c2b66", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618469844, "uuid": "b1a86b34-62b6-4457-a1da-d261a03ce67e", "comment": "Malware payload (Dridex)", "value": "5f6a2fd63ec34c6864a718f6c7cbb13b9a6d29ed26a98ea6653d85de8345712f108da98040cceb49706bc0f964df084e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469844, "uuid": "ce69a85d-e397-49f2-a6ea-582e6e34977a", "value": "68249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469844, "uuid": "f40d260a-03a3-4755-abd1-f72b71cfcd12", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469844, "uuid": "23b3b7aa-b09d-46d9-bf03-ba3e3e820bd5", "value": "3072:y0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:xpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618469844, "uuid": "461c8cfd-8799-452b-aed5-d2cec6d40eed", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618469844, "uuid": "c74fc80f-4927-4d3e-8aae-8b5dc7cf134a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618469844, "uuid": "fe7a6331-cd19-4711-8c24-d0e422736498", "value": "738fd3bad299bb66c72a2894170d405510caca8d48e457fa43cd7431ce6ac937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2e386f-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618499005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499005, "uuid": "b8988ca9-a1cb-4e30-bdbc-83c715492982", "comment": "Malware payload (RaccoonStealer)", "value": "68e1ba282aedafbe31d7a15af8f28362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499005, "uuid": "fe5bd007-3c69-4b1c-8735-87b8b69cbfc8", "comment": "Malware payload (RaccoonStealer)", "value": "7396e6b887ea90222eebcbb2772a8618d59d93d9bcd33c61e306e2b70bb0c3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499005, "uuid": "f93217f2-240d-4588-b7dd-c99045896ac6", "comment": "Malware payload (RaccoonStealer)", "value": "4ee583fc154e4f6e6d44bcc44c9039c19ee37167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618499005, "uuid": "6699a80f-ee96-47b3-8f16-5195583cb91d", "comment": "Malware payload (RaccoonStealer)", "value": "f69abf1259cfadbe19d6f6525fe09137eabf193af6fdbb7c053ff0ba21bf42306ae6d859286ba10a62ee990a02a37eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499005, "uuid": "67bf6cba-73a9-4b5f-a0f5-ab43c4755094", "value": "83B4E01136D0C073D4A3297249A4CBB51BABB87657618ACF7BD51EBC8F347D29A2070E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499005, "uuid": "a306aade-b131-4f6c-a192-c53a82982149", "value": "2664b838a9541d474d829395b94a2f9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499005, "uuid": "c56700ac-c268-4637-8aa7-5b22fb8aafa7", "value": "12288:2Sg5jrb4VQ3cfla/v0QQiFb4ZQYP3WNisx:e5/UqcfMdb4ZQYP3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618499005, "uuid": "8e874876-e197-4c54-8dde-f229044bfcad", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618499005, "uuid": "df49deab-5c44-4832-84bd-6e79d9c3c684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618499005, "uuid": "a026a573-8c5b-4d23-8b7d-dfcb36e2bcee", "value": "68e1ba282aedafbe31d7a15af8f28362.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333068d2-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "f5ac1723-3ca1-446b-ab47-1f40b399d63b", "comment": "Malware payload (Dridex)", "value": "d3469a2f704ed21d6fe26f969a41de2f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "956dc84e-65be-4fa0-bb2c-1155314b15fc", "comment": "Malware payload (Dridex)", "value": "74780d81054320d7c874bb2714c56bcd0497e51af3d49e08dc690c8a5abccf70", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "510da26c-a4fb-45d5-a4a0-4d3fb1b50035", "comment": "Malware payload (Dridex)", "value": "d67d273c499c4399b9b13d83ec9226e17885d97f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497060, "uuid": "451f06c7-b6b8-4319-b797-bebe68b6e737", "comment": "Malware payload (Dridex)", "value": "776d95a73b31ff5e88da35865d006d2e131217737f49520062893b4d3df4824e40fef9e72ab144acd75f6d0732e60ed4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "2eca0e53-df01-4de5-8817-d466b71f32c4", "value": "48F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "7bad249e-6c63-4f2a-bbfc-9826b9cf7dc3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "a195b190-79a9-481d-af75-31d53c36a3d0", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497060, "uuid": "dd6ec6c8-971f-4e3c-8a01-ec72021ed693", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497060, "uuid": "d663cf13-56cc-4ccc-bb9f-94c0af416e8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497060, "uuid": "78a53f97-717f-48ba-bd02-930ab8ddf33b", "value": "74780d81054320d7c874bb2714c56bcd0497e51af3d49e08dc690c8a5abccf70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894f8ca3-9d8a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618450389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450389, "uuid": "0ac560ff-87f6-4a46-ab12-add0f1a9b94b", "comment": "Malware payload (Dridex)", "value": "98c5474812be45fba92291ad12d24287", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450389, "uuid": "781a5547-59bc-4f27-bd76-826011e74b7c", "comment": "Malware payload (Dridex)", "value": "7497e5fc18a07da5891fd6b029582378070b801d4fbfd966d0382aee90eb1912", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450389, "uuid": "4641a773-1a64-4273-9f4e-414d9a90f283", "comment": "Malware payload (Dridex)", "value": "5f5b17dc351266fba1cf474fb2b32ed7163c3035", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618450389, "uuid": "e361e108-d853-4628-bc0b-e79d8b9ebf23", "comment": "Malware payload (Dridex)", "value": "25a76fffe353887d1936ae8482692ca3b12e848a4103fd4f36d62b154f2dd6a8565f2cc59e83a1d14110a419bb7ceed2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450389, "uuid": "07732ad9-0f4d-44f7-a24f-76f48cccdc2e", "value": "68249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450389, "uuid": "f8127482-716b-46ef-8a8d-1e1e3e1b711b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450389, "uuid": "cb4a9b96-8187-4b01-83a7-95d84b40f13f", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618450389, "uuid": "99b722cf-e7f0-42e5-b2ab-6a0960c5602c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618450389, "uuid": "a3c59bf1-bef6-44ed-a309-d0bf93219b91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618450389, "uuid": "43dca426-465f-42f4-a0e2-8654bd215ab3", "value": "7497e5fc18a07da5891fd6b029582378070b801d4fbfd966d0382aee90eb1912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33e12ca-9e0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1618506294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506294, "uuid": "a145b673-a631-4ac4-8728-d8744a071029", "comment": "Malware payload (AZORult)", "value": "cad622f9755c1e1eb3cfe3457404dce7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506294, "uuid": "0617d268-5fad-4681-a06e-e9f390c57505", "comment": "Malware payload (AZORult)", "value": "74a643c612076ad3fe8f8697cb433a638e2bea4e672455aeafd09a22853eeae4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506294, "uuid": "6249aecf-f8e0-41f4-b6d3-85aedfbef4eb", "comment": "Malware payload (AZORult)", "value": "056bfde3e8c8530f5bab7aa4bec4754823e6068a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618506294, "uuid": "d07ae7e1-0c23-415b-8dc2-76677f26094a", "comment": "Malware payload (AZORult)", "value": "680fd2223ebcf108915102557e532a51a2c3227f03038d34fbed0875809ed6ae6883ff5ac8b819cb4d00d5481d02e180", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506294, "uuid": "e74d1255-5db3-4924-bb10-7561731ede34", "value": "5F966C13F285903BC0670A3A882B97A4693B7F212E1A8D5B67F43D4C5F35681793AF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506294, "uuid": "0d0dd091-a918-48c0-b59c-5d4d6efdc600", "value": "82bebf59260e0b81ec653b88efbfccdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506294, "uuid": "81838af6-5d80-464c-8b79-4021c6f4837c", "value": "98304:7B47a3t2lDG/QJVHh5WjUpojRge9HaQg5W3AG57TSd/t4PlF/Ld9BwJ+gSSACzVA:7KGEUs0UpojRge9HaQg5W3AW7TSEXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618506294, "uuid": "75214ace-c475-451c-a1d9-aa6ecc314914", "value": 8622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618506294, "uuid": "ead764e9-7982-4445-bb55-cc8e7874b057", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618506294, "uuid": "45137d41-4927-4a85-9f94-8746749ef745", "value": "xDrpOoosp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36e32d0-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "59146b24-15e1-44ca-b30e-9b84dc57aa28", "comment": "Malware payload (Dridex)", "value": "8ff24d9c061aa5039bdf6e484e986847", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "16bf6538-b65e-4d05-aa90-67cb061fb812", "comment": "Malware payload (Dridex)", "value": "7513037fce0035a4ae3740001864f9625353254b0b964e7fb818721951d51ba2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "0fa2ca0a-7ee9-4cfe-8eef-9816fd19ccf9", "comment": "Malware payload (Dridex)", "value": "9441f23b861ccc0919528881dd9c536e323fa5cf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495960, "uuid": "e191be1d-f902-4f8a-af70-57ad5ffe1911", "comment": "Malware payload (Dridex)", "value": "31cec934876b1c0c85b15c4c9003c7b9ab74a7815e17d6e7b037d0a9c08bcbc000fa5112b45524f70f859819d68c168d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "634e5a02-2cf4-44df-b813-071af9e99a4c", "value": "D6F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "5a07d938-3355-4863-921c-77ed73a24c24", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "86263ab4-3fd8-4519-8994-1330a8ae5248", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495960, "uuid": "492e8e1d-739b-4f7e-9b4f-75bcf9674256", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495960, "uuid": "e0dc2158-9dd1-4b40-ac1a-8f8fcda3b535", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495960, "uuid": "ad8ee0e3-6743-4e12-b809-82c515a22a23", "value": "7513037fce0035a4ae3740001864f9625353254b0b964e7fb818721951d51ba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663d52aa-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496716, "uuid": "4a30cd6d-9346-4afb-94ff-56f4425fba29", "comment": "Malware payload (Dridex)", "value": "55648a74def46c7bd3f0bd0847f06754", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496716, "uuid": "ddaff0f6-e621-40a5-b786-da9cb903c97d", "comment": "Malware payload (Dridex)", "value": "75227475769f6d08af0184b148c5313f637dab0bd86265914cd60f47ef41f699", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496716, "uuid": "c2511d21-cd66-47f9-88f6-6a866de90c4c", "comment": "Malware payload (Dridex)", "value": "74dcca0040bdd069663fe9d188b74a2e9e2e7934", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496716, "uuid": "4522752f-e5c8-4b83-b0c9-477ea34b1c3a", "comment": "Malware payload (Dridex)", "value": "6c59f21145a135823027c0869cdb18bec00412fa9b4bfaef4ffca09de6a659c3c6a7cbc26d5c5a978a3cae67b8190ab3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496716, "uuid": "b280d5b0-7143-4995-8aa9-5a19747e3a9d", "value": "DCF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496716, "uuid": "e91481cc-3eed-4c73-bc6f-f38d83b9876c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496716, "uuid": "189100bd-6ba7-4648-b75c-be044d18a0d8", "value": "3072:BiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:SeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496716, "uuid": "299ca61c-0d43-45cd-8ea7-c710d3c845ab", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496716, "uuid": "c80d04ce-b31c-4913-a7c6-0c33f02509b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496716, "uuid": "d68ef249-d757-4c57-a813-322cfa811923", "value": "75227475769f6d08af0184b148c5313f637dab0bd86265914cd60f47ef41f699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9042af7e-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "9411a6aa-1e6a-4a1d-9b41-fe6d06ffc386", "comment": "Malware payload (Dridex)", "value": "134dbb527064d0969cb1810ecde712ac", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "2afa34fd-dfe9-41c1-893a-d5b68fe1d14a", "comment": "Malware payload (Dridex)", "value": "756b1a7748521170b55a9d55fb91ff80ee97364b73a7c536ff2da7d4d3f60d8f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "8c96b5c8-d6a5-443d-b3ef-e266ad8995b2", "comment": "Malware payload (Dridex)", "value": "0801fbfc61b45df7764d07c6c487e8b445d7b26b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495928, "uuid": "88955622-3db5-4047-bb64-ba23708ee723", "comment": "Malware payload (Dridex)", "value": "143ff659c684606ac63f295b3cf3edb3059da073167e7842efea7f30ad711475e8af79b4a2716b214d8358ab5ee984f6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "5142284f-0b43-4ea6-9922-1cf41a836365", "value": "47F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "b37b6dc1-a797-48ab-b14b-685ab399574d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "a0c09318-9de0-40f0-8c4f-8c5325044a82", "value": "3072:iiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:heAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495928, "uuid": "0cf231c8-ef19-4b48-9585-996649e2f393", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495928, "uuid": "96ef0dc4-918a-4b69-92a4-035bb33e77a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495928, "uuid": "0f080a4e-b576-40d4-bc14-6a90f426e03e", "value": "756b1a7748521170b55a9d55fb91ff80ee97364b73a7c536ff2da7d4d3f60d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0392e8a9-9e07-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618503852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503852, "uuid": "d5b04161-0ae3-46d4-a434-1a71bc6c4d12", "comment": "Malware payload (AgentTesla)", "value": "5a4138cb495fee29f0ff209d2f70cc98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503852, "uuid": "59b72359-f572-490f-a1b4-cedf70996aec", "comment": "Malware payload (AgentTesla)", "value": "7582182ef873a01a095cdca3e94d8c46c2e86aae1e198960cedceaf9ab7de3ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503852, "uuid": "8e518483-50f5-4fe6-9995-f5b10b554308", "comment": "Malware payload (AgentTesla)", "value": "414b498d90ab215307fe89bf43e9a7ccd16235c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618503852, "uuid": "e46d9070-2d97-482f-9e5e-ff3a036d6b0a", "comment": "Malware payload (AgentTesla)", "value": "5904c1c87225dc566a0fee0c806e04ffe14704579eba8a40fcd9402cb496c0419b8a255abf69bdc4b9d7e190d4e4473f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503852, "uuid": "c96afae9-a18c-4bdf-8f0d-f68243c14022", "value": "87057B6232B7C605D6E95F38519D1E041EB1AD026923E70C19B675EF0BB27838F1EF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503852, "uuid": "211e022a-b6dc-4a89-83d0-2cb5de838a69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503852, "uuid": "4123ce8b-d5bb-4ed0-94de-29e959d843af", "value": "12288:6ipt/SXAXbIcHIPVAXPa7WORqfne+acpUB4sEOZcYXK:6ipF92dAXC7WORynpyWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618503852, "uuid": "a6c3c0a4-634c-41ed-92d3-ac97046acc64", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618503852, "uuid": "21f99566-089a-4e35-81f6-252dcacf5ac9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618503852, "uuid": "9be91944-f1d6-4fbb-a41c-965c4b13c24a", "value": "5a4138cb495fee29f0ff209d2f70cc98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857ce3e2-9df5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496339, "uuid": "ababaaab-419e-4983-a3ad-541ca0d96ef9", "comment": "Malware payload (Dridex)", "value": "9ce9e8c82bd1ecbd99cee9d2d894fe86", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496339, "uuid": "255ce1f5-f14b-4e77-a0c8-f9c3cad3aaa7", "comment": "Malware payload (Dridex)", "value": "75d96a769b958849e37e442139e4c90d294dc64d8f105416bd3bec3c57f1c8be", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496339, "uuid": "94f28384-166a-42b3-8f2b-a597b78d1b22", "comment": "Malware payload (Dridex)", "value": "f242157ef5d0fe05433524b2d52d9b6795b32e0c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496339, "uuid": "6d825bb9-d027-42e2-99ef-4af5cc6a97f4", "comment": "Malware payload (Dridex)", "value": "47f4f37861d3c5d53eccff0ec3759d657e22b45ba2a5fd5e5689ce9f339e4ae9fd39c7d9d7d47cd217d406c128cfcc1c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496339, "uuid": "69fb6f91-4465-497c-8baa-797561424e3a", "value": "C4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496339, "uuid": "e62286d3-78b3-4ea1-866f-ae2b69f1d908", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496339, "uuid": "027650a5-2a6c-4f14-a3ec-7c4aa7144a65", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496339, "uuid": "0daecadb-b72e-418a-af2c-0c39c1d1be40", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496339, "uuid": "e97c4f5c-b319-4091-81ec-8e7ab320d1b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496339, "uuid": "beb80fbd-085a-4101-86e4-dc14e321763e", "value": "75d96a769b958849e37e442139e4c90d294dc64d8f105416bd3bec3c57f1c8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1665dfe0-9dfb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618498730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498730, "uuid": "7ecafe0c-e791-45aa-8649-59942903b951", "comment": "Malware payload (Dridex)", "value": "ddc9613c5443e13ebc0229ab59f62f47", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498730, "uuid": "8df273f5-1091-49fc-bc94-7eadfc735d28", "comment": "Malware payload (Dridex)", "value": "75e4949376a4b0d0927b76b4d42cce810dd77b1a85be1a426fcd00c0d93f5878", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498730, "uuid": "5771a8be-ba41-4c5c-b2ce-1d59dbf119b0", "comment": "Malware payload (Dridex)", "value": "0b6d97edddb0a44a21cf0547c965e7a24833b590", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618498730, "uuid": "171bad87-ce90-4d5a-82fa-b7854e358d50", "comment": "Malware payload (Dridex)", "value": "dd78d013b86a63fd5251ffbe1ffe8e274c6c3f45eb29bfe10bafb17721481a29b8f907605e53695c6b87258f2fe48021", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498730, "uuid": "d733f419-68fb-4186-8838-9e476f1bfc14", "value": "9AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498730, "uuid": "f6e197cd-cfc7-4b09-aadc-70b1e284e056", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498730, "uuid": "68882a11-b477-485d-ac88-50d1bf723d16", "value": "3072:lA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:l3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618498730, "uuid": "36b57c86-a266-4857-a743-f65b4c3b3c4b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618498730, "uuid": "e0cb7722-5e5d-4c91-b2e6-efb16486c1d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618498730, "uuid": "f5ebac78-682e-451e-bf00-3b81df0fa6ab", "value": "75e4949376a4b0d0927b76b4d42cce810dd77b1a85be1a426fcd00c0d93f5878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74402055-9e37-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618524657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524657, "uuid": "d0e668c5-666d-43de-baec-5dd2403b06af", "comment": "Malware payload (Dridex)", "value": "fdf21353956b8c85053082be4c0d188d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524657, "uuid": "190bfbf4-5c85-47a0-9019-a8604d296d33", "comment": "Malware payload (Dridex)", "value": "75f331827fe7983d4a8b7cc7f3b415ac16b3869e8c35a4f258d7e25f6a676b2e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524657, "uuid": "e30de1ff-d465-45c3-8a0e-f2c15e33788f", "comment": "Malware payload (Dridex)", "value": "37d03b671323b879426763db8e724428f2451396", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618524657, "uuid": "37a09670-92d2-4612-8032-ba2fa0dd197c", "comment": "Malware payload (Dridex)", "value": "936a02b6575641b3af568fcda33b8d83129334cfad4ea7cdf0d535c4ee9410993b7d2a098e73ab5f2514040a521d3fed", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524657, "uuid": "d66ee8d7-dd1e-498e-85d3-b6019ad22f32", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524657, "uuid": "33bcf90c-6826-4a2f-a885-637b10060b84", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524657, "uuid": "76dbdba4-86ff-418f-9c87-febef8456a54", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618524657, "uuid": "66f7ba17-3ee6-454c-807f-15fb0855c0c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618524657, "uuid": "df6e7d88-3862-4654-9d05-b448568973b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618524657, "uuid": "56040fcc-9e4c-4b58-ab11-e2d772e7164e", "value": "75f331827fe7983d4a8b7cc7f3b415ac16b3869e8c35a4f258d7e25f6a676b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4ab2a9-9d9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618458478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458478, "uuid": "439d565b-c0f2-442f-be43-9b153132ca09", "comment": "Malware payload (Dridex)", "value": "89cd79a310a35f4213170416140c989c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458478, "uuid": "48ef6e37-ffcd-44b5-b4d3-d08c4ab70363", "comment": "Malware payload (Dridex)", "value": "76211c33e6539f4c00963b3afcddd5c692d94e16735a5a4fbb93221b893e1d65", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458478, "uuid": "e8456678-73c9-44e3-acda-438d73878e92", "comment": "Malware payload (Dridex)", "value": "509ca9d6750513c7737d41c5b98a2e1e1f13b5b8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618458478, "uuid": "3bce76db-7bbe-452a-843a-578ee65a58c5", "comment": "Malware payload (Dridex)", "value": "be7dd96a06bc1dad363392fa6d1eb397b00c1db9406c9cca62a9536e6c1eef868b2fa09b83fdb16758881793889b3882", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458478, "uuid": "fd392230-9639-4871-b78c-de09ed93ff11", "value": "22F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458478, "uuid": "cebe953f-8438-4eaa-aa7d-a34ff3d5b4a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458478, "uuid": "f5ac4b9f-51ae-4c5a-bb10-87e68a1ed149", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618458478, "uuid": "0b241f86-82c2-4ef7-b012-57ed1ceb8a5b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618458478, "uuid": "7214d873-e983-4879-84b6-ce5411cccf89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618458478, "uuid": "0ccb770b-e004-4639-afe8-3d4115402b6e", "value": "76211c33e6539f4c00963b3afcddd5c692d94e16735a5a4fbb93221b893e1d65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581e0747-9e1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618513872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513872, "uuid": "512758c8-dbf8-473d-a681-c56418d90dee", "comment": "Malware payload (Dridex)", "value": "b9b1d1293f7eaec32d3f3152058d831a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513872, "uuid": "83dc600a-058d-4888-8d35-875dc43b88db", "comment": "Malware payload (Dridex)", "value": "763eff5577de921eb2580b96744b4e4c602623bcb5525e281b977409dfc3c42b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513872, "uuid": "962d09d8-4ae0-46aa-922b-8f9d1bcf43f9", "comment": "Malware payload (Dridex)", "value": "819d51e3bbd794e74d876f827be4be92fa274f77", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618513872, "uuid": "1420b35a-d54c-4eb4-b82d-4ee7bbecfdbd", "comment": "Malware payload (Dridex)", "value": "47e20b0da7e64e3e5af35e3def8d3a800c07ea5700ab048592e1fa21299e02a9657eda8a64f928f2b31d7b63fa146827", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513872, "uuid": "3bd049f7-9e3c-4573-a597-b6d848076d74", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513872, "uuid": "c1ae8c43-f00d-4eb2-8ac1-e1881b47fbb4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513872, "uuid": "837a9c0f-c490-45c0-ad7e-112be31d8bee", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618513872, "uuid": "3be54d9c-3a46-439e-9abc-e6c4ade56358", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618513872, "uuid": "e5d26b80-9070-4aaa-90a3-4b605b942f47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618513872, "uuid": "db99163a-f0b9-44aa-83fa-c3d9f0143dbe", "value": "763eff5577de921eb2580b96744b4e4c602623bcb5525e281b977409dfc3c42b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4017fe4-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495988, "uuid": "df15612c-dc67-4316-852b-8b0905e77273", "comment": "Malware payload (Dridex)", "value": "b47e5a3f96140d102afffe42cb2581a3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495988, "uuid": "7603f644-f2d9-4f58-a6b1-404f90691264", "comment": "Malware payload (Dridex)", "value": "76708d6b7d6022963a454b5be4af75956adfc921edc7f9d78e2ea89a5f3947ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495988, "uuid": "9cd0c888-481d-4b4f-b913-30448a82ad3b", "comment": "Malware payload (Dridex)", "value": "bf1bb348d727a8d75548bf16314438f57c9b187d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495988, "uuid": "8d36eaf8-6c68-4c8a-9e0c-44f2f6ae7db6", "comment": "Malware payload (Dridex)", "value": "490f60dad97f4b32da57b14ac7bf66632b89e9685b86d486fcf82d32d039a4f4756fee557f26bd03cf434042e0af81e8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495988, "uuid": "78ab353c-c3a3-4821-8993-6abc24b7fdb4", "value": "84F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495988, "uuid": "4ae26adb-3dc3-4842-95ed-ab1f0c889ed9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495988, "uuid": "ab1a3b76-674b-4221-a415-80c4e603644e", "value": "3072:yA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495988, "uuid": "97ca70b3-61b3-4193-9a8f-08158feb1067", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495988, "uuid": "3fcf6679-a909-4bee-900e-3ef3fa18f0b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495988, "uuid": "f6a8a8ed-505a-4154-a481-ff4370ee8509", "value": "76708d6b7d6022963a454b5be4af75956adfc921edc7f9d78e2ea89a5f3947ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcb53e7-9db9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618470422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470422, "uuid": "0bc8de3a-2e26-4c73-b853-884ddf3bd7fb", "comment": "Malware payload (Dridex)", "value": "06c42ae9486fd309ec71e76f6a10a88f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470422, "uuid": "d18fca27-e43e-44dd-b5e2-3aec8def82a9", "comment": "Malware payload (Dridex)", "value": "76d00fdd2349834d4a1c18fbec9325063bfabe99a3099af77c37e186ac6df29e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470422, "uuid": "edbd9bfe-7182-4249-b620-7981500711a1", "comment": "Malware payload (Dridex)", "value": "1d2d8ad8f1155d8867f4dbd425875ce23bdfa2b1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618470422, "uuid": "aa26d429-3480-45b3-b15e-365f919e18e3", "comment": "Malware payload (Dridex)", "value": "476132e51b1f74e0fac617b3c1b20173ce46ec9a26b922167ecb53364092b497748099163504e49a01d56e3c7ac50869", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470422, "uuid": "f652aaa1-275b-4cf7-a82c-44e5c8a3090f", "value": "EF249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470422, "uuid": "dc4de85f-7995-4a39-9c66-e7527d79500e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470422, "uuid": "be749366-701e-4a99-808f-b21005462dcf", "value": "3072:R0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:EpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618470422, "uuid": "1be6f86e-36c1-48f2-91a2-2fd653af628d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618470422, "uuid": "d7e32923-17e2-4f65-8948-3e2281b0a34f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618470422, "uuid": "4384d76c-985a-4a69-a2c9-00b2d7ea0053", "value": "76d00fdd2349834d4a1c18fbec9325063bfabe99a3099af77c37e186ac6df29e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cdc244-9d93-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618454169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454169, "uuid": "306f0119-9651-45f4-b609-0e3e37ec62d9", "comment": "Malware payload (Dridex)", "value": "319049071b151ba53670cbc362f515ec", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454169, "uuid": "e55dfe48-ce54-4597-9f9b-3e668a10feb4", "comment": "Malware payload (Dridex)", "value": "772abc2dc767094c28118bde5390d0a311c6ed9ed8a9765d4b0d819b7ff4fa39", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454169, "uuid": "9493cb3b-40d8-4409-8453-a275f996ac7f", "comment": "Malware payload (Dridex)", "value": "7c8ec24d4ee43a2322c0cd46d17a5a33d9672277", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618454169, "uuid": "59cdae1a-2a77-4c0e-8527-b57dec366c67", "comment": "Malware payload (Dridex)", "value": "ce20ae8d1585f4cf67aed3b9ad0b30f3ad02546e613ba61d17db1e3b9f4292ba2ebfe74fee57511cc827322d06fee749", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454169, "uuid": "27a14798-6e1e-4689-a0d4-0ac223c9abef", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454169, "uuid": "d0e00132-03d4-414e-98c9-b2385fb1c6e0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454169, "uuid": "8c295f6e-4eb1-4bd2-ae7c-286a15a95b42", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618454169, "uuid": "5ffea668-8b75-4931-93ce-a5dfab6864eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618454169, "uuid": "ccb4b10e-8530-4b72-865c-5600d6a65bbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618454169, "uuid": "bc10de6f-052f-4b26-a6c3-bf9d7f9f0608", "value": "772abc2dc767094c28118bde5390d0a311c6ed9ed8a9765d4b0d819b7ff4fa39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07139bb5-9e41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618528769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528769, "uuid": "6dd676c3-05aa-4791-b735-fe8558b68cb1", "comment": "Malware payload (Dridex)", "value": "c9bb376fb6da7d9051ef41112c5d35b5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528769, "uuid": "b56742ac-13c5-4b1a-9e05-3c4ca5a3dc02", "comment": "Malware payload (Dridex)", "value": "772c97de32faf5737e5be5ef7290faddd071f71a7dde264a15e2f1437c5a3b62", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528769, "uuid": "1d661049-52ff-41c1-ba6f-32b56dae365a", "comment": "Malware payload (Dridex)", "value": "a33276d5e73cfa12ca231ec43a31a3caccb46678", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618528769, "uuid": "739eebbc-b9c4-4c2a-8d9c-64c6917f789f", "comment": "Malware payload (Dridex)", "value": "bc5cb61d0a439dd21b86a8f6009c507e1de5f975605f3e388838baa18788c34746b69544b7791a60ab65dde41e5159d4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528769, "uuid": "dc6e82d3-f8bf-4869-8d67-9cc5b7041d8b", "value": "E3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528769, "uuid": "4206f4ad-5fca-404a-97d9-dc7666ced1ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528769, "uuid": "85bd2f50-4adf-46a9-b555-4626e9ced1b9", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618528769, "uuid": "9e849880-4e83-498a-94d3-6e6bd9c2b74a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618528769, "uuid": "af7817f5-f61e-4b65-b2ad-c01e5e8139b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618528769, "uuid": "45d4b9a6-923c-4e30-a941-fd4f0a5ada63", "value": "772c97de32faf5737e5be5ef7290faddd071f71a7dde264a15e2f1437c5a3b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0c43e9-9e0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618507677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507677, "uuid": "de9ef48d-4a83-4ccd-afb0-a31d3a7c0984", "comment": "Malware payload (Dridex)", "value": "f9b3a2044395f15901b0eba54c02e6cf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507677, "uuid": "414b6faa-0935-4f3b-addf-c79f03d733e8", "comment": "Malware payload (Dridex)", "value": "77334d5342d4f4497c26a151e1267b9c8bc8c8248d7813083b0b26882b496554", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507677, "uuid": "06d90385-d645-4e9c-b366-907c7c3aa167", "comment": "Malware payload (Dridex)", "value": "73aa92089bbb6d1926ceed90215ffabb3ee58d48", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618507677, "uuid": "0465de16-e063-4a0a-849e-353013b1aad0", "comment": "Malware payload (Dridex)", "value": "80704de54e8d12560ce12a2010e1db713c1a258248020cb0509fa04ad83fdcef5f5beca4d687498c0b5e72649c7b6b02", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507677, "uuid": "43c655dc-cf2b-4c67-b1a2-998785ccdb27", "value": "1DF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507677, "uuid": "35bee402-ea38-4587-9ad7-90e7c174145b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507677, "uuid": "eed33948-3881-4d13-9ead-8ba46930bcf1", "value": "3072:+A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:+3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618507677, "uuid": "40a219da-d14c-4554-a73b-a6caba36de11", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618507677, "uuid": "922990f5-8765-4417-9234-6db21f8b526e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618507677, "uuid": "fb863b47-02f9-4f7c-be82-28edb2f18a3c", "value": "77334d5342d4f4497c26a151e1267b9c8bc8c8248d7813083b0b26882b496554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ea67c5-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "61d4be31-6779-4ef2-9704-e24d79d5f545", "comment": "Malware payload (Dridex)", "value": "75cfe23ad7e400d3d58f27bf70ce98da", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "1d999522-4321-405b-adf4-7d291e020064", "comment": "Malware payload (Dridex)", "value": "773d5e2b1f98fd223ee1952d7fa4a9b4b1c65a7da125f823086ed8009656fa9b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "30dfa28a-9cf6-481b-b7f1-d155d160ffa9", "comment": "Malware payload (Dridex)", "value": "01b916f268701c89e8bcdca4aa2811796fb4b5d6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495964, "uuid": "ae2874d7-07d1-4453-97b8-b5b27a8f3b40", "comment": "Malware payload (Dridex)", "value": "f3b72a384836bb888b41ed9a0eb965f911f831dba0a2466c0fe6870ede515c577dc03bee59dfc58be1be5cced0dadd7e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "b5de7169-963f-4b3f-8a9c-fb887d097abd", "value": "F5F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "34d07fa7-645a-4eed-9430-e16c0931f3f2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "0fb0660c-9986-4868-860e-2c492145f1a4", "value": "3072:7iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:YeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495964, "uuid": "23a465e1-fe0e-4374-8a0d-ae1205e55eb8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495964, "uuid": "78353e87-568b-4d3b-8af2-460f052ade3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495964, "uuid": "67f55c22-3c2a-4c5c-a777-2aab6d116214", "value": "773d5e2b1f98fd223ee1952d7fa4a9b4b1c65a7da125f823086ed8009656fa9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c29499e-9dc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618476459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476459, "uuid": "129b598b-ede0-4fe4-b459-fb59a04ed24f", "comment": "Malware payload (Dridex)", "value": "99d2bc530a964308d173b6a45bf9cb7e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476459, "uuid": "e82e9637-4479-4a04-bf57-324437ae07af", "comment": "Malware payload (Dridex)", "value": "7758ced1ab95055050eda59189124521cc820eda077c5c2981b20f562314f2e6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476459, "uuid": "768d2cb7-931e-45da-868d-f013c34711dd", "comment": "Malware payload (Dridex)", "value": "6f436ca1418de5647cc92a602026e47c9d834dcd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618476459, "uuid": "6169b84d-fdd1-412a-ab81-293ffcf6bde2", "comment": "Malware payload (Dridex)", "value": "140520223421d6f077d9d4100054e041d492cf514a6fc67a2345ef4cd437b170ce67376e14cf1509c2143cd9c0b1e641", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476459, "uuid": "89d5e4b0-731a-4637-882c-4e237cebf16a", "value": "B1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476459, "uuid": "bb0129d1-4652-47d3-90fe-f11a7c620639", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476459, "uuid": "5c2d6731-0b31-4a89-8033-4575e5cb2e57", "value": "3072:r0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:qpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618476459, "uuid": "fc1268f7-3f8e-485b-b851-6e37771daa7a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618476459, "uuid": "8915b969-bedf-473b-bc9b-21ac0dfb6816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618476459, "uuid": "6ade2f52-18c4-4c23-9c96-59b8ab192235", "value": "7758ced1ab95055050eda59189124521cc820eda077c5c2981b20f562314f2e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455dc0ac-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496661, "uuid": "37a9a0ad-d5c7-4264-8093-c073ffad39dc", "comment": "Malware payload (Dridex)", "value": "ce2cca8ef05f961669d123a8d8f5e7aa", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496661, "uuid": "fd02a0a8-4b2b-4603-a214-c15272bab048", "comment": "Malware payload (Dridex)", "value": "77c4c11060d538ccec0276749cbc308d2e0b3b1c371c99fac859f5e4d42ce2b7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496661, "uuid": "53a7ba5d-4914-4a35-9ccc-83c810011c9a", "comment": "Malware payload (Dridex)", "value": "2a461a80419e3e57325dd659d5b3e677df6d7dec", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496661, "uuid": "a9b13a08-5bf3-4bc4-be29-daccf351ccbb", "comment": "Malware payload (Dridex)", "value": "4a88b060192b1492697ed787b9ffcfeca9d86344d855a63b7f4061f5d56aff4acec1e9c236aedfb5178ca9e9bacc4df6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496661, "uuid": "632186c8-73ca-4fad-a302-2d78ba93dc56", "value": "46F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496661, "uuid": "52cfce42-0ca9-4cb2-be13-e3bbe71bb5e9", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496661, "uuid": "f2f3e53a-2857-4b07-bf40-78e7cc9de825", "value": "3072:7iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:YeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496661, "uuid": "2125740c-a81e-4e66-8b6d-5cce4e2e76d8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496661, "uuid": "38a73380-2f5a-4920-bd24-60db69cdc1dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496661, "uuid": "4f8b342f-f6dd-4f7b-8891-8631f2cfa647", "value": "77c4c11060d538ccec0276749cbc308d2e0b3b1c371c99fac859f5e4d42ce2b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fe56d8-9dcd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618479237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479237, "uuid": "c22abaf4-c55f-40a3-9058-352c54a1a6a0", "comment": "Malware payload (Dridex)", "value": "8d1dd0aa9f75aab9ac644c117d8f46a9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479237, "uuid": "385810d0-5963-4fdc-8aeb-18079a1c1f80", "comment": "Malware payload (Dridex)", "value": "780561e9eb6cf50542217b3f485d20f2c81c6a288e8e54c2e7da190af716ec56", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479237, "uuid": "66ded903-8f5b-4438-9622-a71610376ba4", "comment": "Malware payload (Dridex)", "value": "dd51d69d7392e2efc10c8a56c1963e0333a13541", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618479237, "uuid": "dbc34373-2216-4e4b-bc68-225c06ad66a7", "comment": "Malware payload (Dridex)", "value": "1f9c9b505817d3f00d127d39239b41cde96b1c45c31f32023704c463545738a31752da24c7b3e5dcf6592521b8dcd78e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479237, "uuid": "9fc05bb9-d0b4-4349-94fc-9746224ce0cb", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479237, "uuid": "4e61bbf8-b369-4de5-b682-19b399af4709", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479237, "uuid": "ca340457-29fc-4cb5-9c06-d47c01a4f760", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618479237, "uuid": "90318927-c9b2-42d1-af4c-b6d72406b2b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618479237, "uuid": "c1d5a552-70ef-4ad6-9a96-fe08a7d97b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618479237, "uuid": "9712f3c6-3b67-4e52-88ed-20f0c5cfe1bf", "value": "780561e9eb6cf50542217b3f485d20f2c81c6a288e8e54c2e7da190af716ec56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193caed4-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496587, "uuid": "42923090-1e33-4805-9afd-c40837241e05", "comment": "Malware payload (Dridex)", "value": "72571873ed28175802ab0089b4fa1862", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496587, "uuid": "0b16b602-dd94-4128-afca-edc51bb40f0d", "comment": "Malware payload (Dridex)", "value": "7849cf0ea5e013b6dd0c947b58f039d169887d7c18a165ba420820445736163d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496587, "uuid": "30903617-a2a6-42a3-9181-e77fc30854ac", "comment": "Malware payload (Dridex)", "value": "8ca8136b7cad00d267e5a5b32fa7c6880ee12794", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496587, "uuid": "5cda768f-4c82-4e86-9d8c-b2a13f9b3d7c", "comment": "Malware payload (Dridex)", "value": "25e80d673adc643e0c616aaa8cf906bfa4b596226b5bd6d9e539fe20a7b86ab8df8e9ff571c65fd2954f7a2d262309fe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496587, "uuid": "329dec4c-d6da-46c3-9bd8-a14890d085c3", "value": "B9F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496587, "uuid": "0427fe91-afe5-4459-a022-3be5d6522e0b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496587, "uuid": "b512e02b-0bec-4277-bdf0-f277da1bfd94", "value": "3072:qA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496587, "uuid": "1b2daaea-8b35-4d5c-9bd7-7fc87eb5b5e4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496587, "uuid": "81d10ff0-797a-4aa6-a1c1-5b9edc0fd1b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496587, "uuid": "7ed59cc0-7916-4806-99b2-f06f39dd8adc", "value": "7849cf0ea5e013b6dd0c947b58f039d169887d7c18a165ba420820445736163d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f00287-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "a2679812-6e9c-4e79-af05-acf372417107", "comment": "Malware payload (Dridex)", "value": "0dc0c33240471d3372704ab26a3bdcd1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "a20e8eda-bc9d-48cd-b0e6-9dd2752e67e4", "comment": "Malware payload (Dridex)", "value": "786a216f03107f5a8e2a78604ea4d4107b35270ada3fab77477ad48f84fcb120", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "4d312412-a12d-4c0f-becc-01c3518056b2", "comment": "Malware payload (Dridex)", "value": "3d1ea5b74994eb380082490243e9ff939972d7cd", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495905, "uuid": "ae11bce5-bf28-4523-a4f5-0a6b81ff94da", "comment": "Malware payload (Dridex)", "value": "a3c5e8141657c5656c758298891faeb25c816048f5e1bf02c8f6c840a018bde06ee443cd1a2efe313de1337a8c0b9ee4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "e221a9cd-9afe-4bd4-b500-48a47f62f5e3", "value": "A7F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "3575178f-426a-45c0-a4ff-f7295ff04d89", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "92405b87-7963-430d-a8a4-c92a7c6d2202", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618495905, "uuid": "94af85f3-5807-432e-89c3-ace77049931c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618495905, "uuid": "8ff9da14-5d11-446d-9fd9-399dc1cc178e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618495905, "uuid": "674f7764-0aae-4a55-bffc-2d76d9d1929e", "value": "786a216f03107f5a8e2a78604ea4d4107b35270ada3fab77477ad48f84fcb120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076788bd-9dab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618464345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464345, "uuid": "8483e4c5-075e-4b8e-ac34-c7eed08a82f8", "comment": "Malware payload (Dridex)", "value": "084624f1947c9b88afcc5eadd4e1841b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464345, "uuid": "6efda32f-edf9-4856-87db-43f3bae1cbb3", "comment": "Malware payload (Dridex)", "value": "7876c2e03cfc848335146c03c46d8aedcb6da666d833e372e7847c740e16cf25", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464345, "uuid": "e6fc4373-dca6-4113-9352-486ad26b60ce", "comment": "Malware payload (Dridex)", "value": "d991ff709d8d34dbece8ce02e7060210735bdcdb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618464345, "uuid": "1f4aa5dd-06c9-4814-b494-7a0ece71fa02", "comment": "Malware payload (Dridex)", "value": "0a01d2ccbc32b9a1938757a18c23e266733b9a09513f971fdf4e367eeb781e4d2d8fb5452e21d1457088712cb576a8f8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464345, "uuid": "ad30718b-94e0-44f8-a15d-1b6939612fd7", "value": "9FF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464345, "uuid": "94f6d99d-2451-4f19-add6-076fe0a21d53", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464345, "uuid": "e2f2f429-1011-4fe8-8d98-79be4e8cba10", "value": "3072:SA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:S3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618464345, "uuid": "6459d48d-29da-4940-9b9b-9bbd21644d3d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618464345, "uuid": "c3cebea4-1b5e-4338-abad-56b899a31998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618464345, "uuid": "36ec6389-76a7-4881-b446-be9de2e606ce", "value": "7876c2e03cfc848335146c03c46d8aedcb6da666d833e372e7847c740e16cf25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336bd91f-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497061, "uuid": "089ac0e9-d1ff-4633-8ff0-ff221d78e53b", "comment": "Malware payload (Dridex)", "value": "f235e95dd67c06012b17164a0a4bdcd0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497061, "uuid": "40d59c6e-bfde-4cad-800e-f9f565753e88", "comment": "Malware payload (Dridex)", "value": "78b46c9aa98d90b95ea8fb7d4dce2611c29e4b4678a00c9ddb90a3c241637a4a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497061, "uuid": "4d54be8e-ea8b-4517-bbf3-3fbe94a60ad1", "comment": "Malware payload (Dridex)", "value": "8ac3f9813b37758b90d4e56f6882d777591cd42a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497061, "uuid": "a280feba-92e9-49d8-8e64-fa5724f43c09", "comment": "Malware payload (Dridex)", "value": "9acb0f85b65197d030b58884fb9269ab1a44f1eb0e8f358c6d52abc5017d4a95e9493d12cdbcfb100164a38b19dbdcfc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497061, "uuid": "bb4be964-2fe0-47b3-8e2d-f1cb944740c9", "value": "2CF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497061, "uuid": "927cbf84-5c40-4805-9859-209aa2b9a448", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497061, "uuid": "cb13ee14-26d9-4f39-bc98-b2fd90c30ae2", "value": "3072:riFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:IeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497061, "uuid": "b88a6d30-979c-4269-921e-1204ba59334c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497061, "uuid": "139a9daa-b515-4b21-8ac2-3289e936f617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497061, "uuid": "67567d46-1cc6-4eb1-a23b-bcaf00e520ff", "value": "78b46c9aa98d90b95ea8fb7d4dce2611c29e4b4678a00c9ddb90a3c241637a4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1489b439-9dae-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618465655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465655, "uuid": "f9f21cb2-83a1-4d1d-b98a-81e8a7c9b4a2", "comment": "Malware payload (RemcosRAT)", "value": "83af5fbadb27f44750b760eda3ab6518", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465655, "uuid": "b84ea3c6-2f76-4b28-8495-0a935a9906aa", "comment": "Malware payload (RemcosRAT)", "value": "78b75b6b9d255c96267433936c42e3a66cfe733280483ba5658598cb021786da", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465655, "uuid": "8b400609-8d01-4209-b5d2-4b88921efc99", "comment": "Malware payload (RemcosRAT)", "value": "5e9bfdc11bbaecb2ac4d3ca27b1d701e1ad56888", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618465655, "uuid": "1bd16863-12e3-404c-a369-b622c234d5da", "comment": "Malware payload (RemcosRAT)", "value": "af521401b431d83d06ddce8bfff77d9232eb85cdea7206dd838fcb8b4fae849c9bd017c48b9ef0c808e77aa06ab2fa36", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465655, "uuid": "921b0274-9923-4096-919c-bacb824c1acc", "value": "A0B302A9200AAFCC4CF1E23A06F6D21EE997796EE04904557E10A5C7C1ECA496FFC497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465655, "uuid": "617497b3-f108-41c8-9c8a-df74e11d1694", "value": "3072:uYF5Rhr/5RhPaYxyg3c8+7DYlQI91kkKwuIOwl1:Jb5jzyGc8+XmrWdwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618465655, "uuid": "20ec5fff-ce0a-4baa-88a9-35b9bed790f6", "value": 114133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618465655, "uuid": "3b9aaefe-87f2-42af-be9e-b218f0b6d926", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618465655, "uuid": "82057ea9-b14d-4a77-a943-2101fd77219b", "value": "0900900.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9fa903-9e20-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618514873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514873, "uuid": "9580de6f-5e40-47d7-a077-0bf02c5d89df", "comment": "Malware payload (AgentTesla)", "value": "eda0686071f17efac51d4239c1cd6b8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514873, "uuid": "cfaf5182-befa-47ec-8428-319e7f523df7", "comment": "Malware payload (AgentTesla)", "value": "78bebab303b16530bca07e2f49e649ecc214389cf7eee459d94d4ee4b2547500", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514873, "uuid": "20b80bb0-c5a5-4b45-9995-fd370890f651", "comment": "Malware payload (AgentTesla)", "value": "54eba2b00cd6bd8d23d9080c95a134e05aac1b72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618514873, "uuid": "b658e8ea-062f-49fe-9776-89b7c56428ec", "comment": "Malware payload (AgentTesla)", "value": "12ac90c98949a3a5cc157054a18838b585175c5479734bcec5d345754390413833117aa1bc1b7d82fb7aacfbf653bfdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514873, "uuid": "41f57a8e-b23d-42e4-af4d-53e44c866a3a", "value": "D6057A6132BBD614D6E91F3844AD1E044EB56E026923E70C196674EF1BB27C38F1EF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514873, "uuid": "ca2023aa-d295-41b3-986e-c3c07127a91d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514873, "uuid": "a83782c8-5043-45db-84b5-083ea4c87743", "value": "12288:mKZoIv+AofbgLJpT6ye/b1kd9e3eNVwMVYcZtFARsGhK:mMoIXof4J16ND1kdc3UV77ORa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618514873, "uuid": "dc8a048e-5718-4312-8438-db8728bd7797", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618514873, "uuid": "2c8a7fbe-258e-41e5-a73b-0a65c7074580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618514873, "uuid": "a56b29c3-ab0a-49c0-afe0-3e690e25ef99", "value": "RFQ-0140#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224da291-9e23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618515930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "606ddd5d-2e8f-4c5a-85f2-78ea005ed5e7", "comment": "Malware payload (Dridex)", "value": "b835239e5e12f043780be0d814b877ee", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "2f2914e0-8616-4b7b-83d3-a29de5211b3b", "comment": "Malware payload (Dridex)", "value": "79018b72ea42f58193e76afdf5f7f2f1bcf8eeea33ccd938633ee2e1d6da0a2b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "a1ea2a31-1c34-49dd-b5c4-fba1fb8c44e5", "comment": "Malware payload (Dridex)", "value": "b0402fa0fc43c87579839a65b5a40df0ddadb80a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618515930, "uuid": "e8478866-a566-4f92-b3b6-3681e89370c2", "comment": "Malware payload (Dridex)", "value": "d1f3400711a3c4cc9c62930368958b7936cfba85edab7d3d77504d0f05b6dc3d3116daaff0f21430cb58d33d71173de0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "e5d577b3-4197-4f9b-803d-a091d92e543f", "value": "5AF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "f7a07b12-ecfb-4f33-b4ee-206559a343bb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "cdfdd8c2-60df-4b2f-99da-d093db76ac89", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618515930, "uuid": "ec75a50f-9ac7-4293-bcd1-04fbb8154e32", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618515930, "uuid": "3d025fdf-7145-4dd7-98fd-1ce4c1efc66e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618515930, "uuid": "74a2b6e2-8efc-496f-9348-9aa37ac90d7d", "value": "79018b72ea42f58193e76afdf5f7f2f1bcf8eeea33ccd938633ee2e1d6da0a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6587996-9dbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618472020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472020, "uuid": "488e0d81-bf64-432f-b8e1-b7370cd114a7", "comment": "Malware payload (Dridex)", "value": "789a040345ff2734ebb6516c03978566", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472020, "uuid": "f5f89d1c-1abc-4534-8941-12cb375e91f3", "comment": "Malware payload (Dridex)", "value": "7910eb921c9a853afa83d18a5c94e3dbbb9d28c6d7caff4ee09c3d8c444a8806", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472020, "uuid": "0e0a09f4-ff40-4164-bd99-603259af6054", "comment": "Malware payload (Dridex)", "value": "e678b736ed7e7a6a6dee36ef156ad739d54c9b10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472020, "uuid": "2c2fc9a2-4546-4c95-b294-a67f0c467fa5", "comment": "Malware payload (Dridex)", "value": "dd98f9deef8f56857fbcd35803039c2663c3c5b8eb2730b53f216e7e0667cbeff317efcb71bd6e4ce85958e72ccfc813", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472020, "uuid": "67e4d2bd-2e3e-45d0-ae56-c56bd30146ee", "value": "D2F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472020, "uuid": "48df186b-c036-49dd-81e0-e4d8860755a5", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472020, "uuid": "6085d978-625c-4bd1-84c3-a45977deb15e", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618472020, "uuid": "75b80a4e-9954-47ec-8950-c99dcde3d666", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618472020, "uuid": "614ba9d6-4c06-4175-8d67-a4dc320eb195", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472020, "uuid": "da8d6c7b-6db5-4bb4-8463-5420ac77e037", "value": "7910eb921c9a853afa83d18a5c94e3dbbb9d28c6d7caff4ee09c3d8c444a8806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00822bad-9dff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618500411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500411, "uuid": "d43c857a-d0cd-44bd-8ec8-238c49516755", "comment": "Malware payload (Dridex)", "value": "7008a24d086a56846d97969f6e28133b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500411, "uuid": "574fe751-9fd0-4177-b7a3-960519921eb5", "comment": "Malware payload (Dridex)", "value": "7919722d098c053270e32b320f82f28d158d05582499a23e384aa07839e24075", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500411, "uuid": "f17a4fd5-91d1-4820-8f8a-19154a27f39a", "comment": "Malware payload (Dridex)", "value": "09aa35e882e2d1a7860f91a914acfa0d452e2472", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618500411, "uuid": "5c5b3c6f-96a4-4b27-a3b5-0a8ae8985216", "comment": "Malware payload (Dridex)", "value": "5be10c91d8815c820ecb0cfaf015759321248966c8da4e7e52b374c77d55237b20373f282a4220bee2c11e4229c0b83a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500411, "uuid": "f91b88bf-05e5-4fa6-b1c5-8589e4818775", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500411, "uuid": "6179e306-33bc-466b-bb5d-9845ee9978e6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500411, "uuid": "bb3a4b80-8968-4cec-8cdb-88ed4333f870", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618500411, "uuid": "508a0fb9-0aa9-480c-847a-286f45eb9ad4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618500411, "uuid": "35bcc4b6-abcd-4927-95e0-5c77a5b181e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618500411, "uuid": "107dded0-4f14-4ca0-a3d0-7282849ba02a", "value": "7919722d098c053270e32b320f82f28d158d05582499a23e384aa07839e24075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e7a48a-9dcf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480011, "uuid": "5e1ebbe0-d64d-45b4-805a-82df93899c66", "comment": "Malware payload (Dridex)", "value": "89643ae5db6187032cbc866764e8aa34", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480011, "uuid": "0e922545-11bc-4abf-a0a2-2e305429736e", "comment": "Malware payload (Dridex)", "value": "7922b41f6af675781024f1a4c3a6d85b33dbd355ec7dbe704e30fb13a4aef2b1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480011, "uuid": "40d7e7ca-42de-4b04-ae5d-9c7605a11ee4", "comment": "Malware payload (Dridex)", "value": "909169cf6d1aaa4a259f0656c611bae9fb1caa74", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480011, "uuid": "b3cc0b80-b010-4a86-90bf-88ff38333df4", "comment": "Malware payload (Dridex)", "value": "0f83af8b36cdd807d615448da67a56ee239d3c66b46b636c477c2a0ece678a04fdf851bac981d8fa395529a4ca0d090a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480011, "uuid": "916904b3-9ec7-489b-aac8-1945cd0c522c", "value": "53F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480011, "uuid": "4c8fd21e-7f5e-47b6-a8bf-960c8830f8c5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480011, "uuid": "45626cb2-c653-4770-85ae-307dcfadb8fb", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480011, "uuid": "a7b2cf56-9953-4b7d-bb73-8c524bf0ad8c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480011, "uuid": "00faf0b0-f2eb-4194-84da-0232b4ec8f35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480011, "uuid": "4ad665c8-d711-4a61-b809-5b9621b88804", "value": "7922b41f6af675781024f1a4c3a6d85b33dbd355ec7dbe704e30fb13a4aef2b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfe8968-9dd1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618480783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480783, "uuid": "79a8672d-08af-4924-b913-af0b5c27cec3", "comment": "Malware payload (Dridex)", "value": "d477f7a728128afcb6f3af1b766b3026", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480783, "uuid": "f3113350-bc21-46cf-a863-86efeed1eaf7", "comment": "Malware payload (Dridex)", "value": "7931f41bc8f8751608486f19b5b1c4c147e1e25705d97d34c4d8e5be79482cf4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480783, "uuid": "5df9063a-c915-433d-bd43-8813c9ea06a7", "comment": "Malware payload (Dridex)", "value": "fdfa710d9b47190ca85f398e79db37a4b295a4d7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618480783, "uuid": "457357dd-1b99-476f-baf5-aafa9facbb9e", "comment": "Malware payload (Dridex)", "value": "4a7ba7a31d3472ff78981b8a4903cd650d5e08063bf3223499c5a524035a4a8a6eeb9657eb9f12c9bbeb4b3103a7481e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480783, "uuid": "11171736-2b52-4d23-9db8-3a6339f295df", "value": "E3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480783, "uuid": "343c5bb5-53a8-431c-b477-3b526c352ef8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480783, "uuid": "51bd193e-f838-434e-b78d-bf6cdd5fcf14", "value": "3072:MiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:veAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618480783, "uuid": "060768a2-5566-411e-8510-bc704b05385b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618480783, "uuid": "86542aec-9f87-454e-9067-9af6548a83d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618480783, "uuid": "39113b8b-ed8b-4a0d-ad62-9acf45393dfe", "value": "7931f41bc8f8751608486f19b5b1c4c147e1e25705d97d34c4d8e5be79482cf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9127d7f-9e3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618527457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527457, "uuid": "cca737e9-0575-416c-bdf8-adba86d1cbb9", "comment": "Malware payload (Dridex)", "value": "a0d45acad91062818d1fba5da89984f4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527457, "uuid": "a9fdd02a-bcf4-491b-8238-bc2efffc61c0", "comment": "Malware payload (Dridex)", "value": "7971cd521a3804a1b7bcc3c148dc0fa5cef587e58f3e3c5e9096f999fe558169", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527457, "uuid": "240f107e-4166-4a61-9501-012615764b3f", "comment": "Malware payload (Dridex)", "value": "548923057320b0be150971735f2e91ad58dd3ee9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618527457, "uuid": "2f244b2f-af04-4b65-8ec5-c8000be3959c", "comment": "Malware payload (Dridex)", "value": "9970541ff38a6e6f5986a5c580e31eed0ce92db4d799677adb240d58db98f89e1d2ce611bec99b647c7f4126d18abccb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527457, "uuid": "959c175b-3d9d-4ea0-99a6-c2e6ae7f7d1c", "value": "C7F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527457, "uuid": "86076611-5752-41dd-b034-95d9330886a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527457, "uuid": "b8251fca-c9d4-4372-b84f-27be32d636fb", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618527457, "uuid": "52e735e6-6ae4-4946-8f1d-e86b1a06e8cc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618527457, "uuid": "cd82c73d-d054-4b54-9704-bd5818e6395b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618527457, "uuid": "ea2356e6-1303-45e2-b8ef-5de9b8c1ccd2", "value": "7971cd521a3804a1b7bcc3c148dc0fa5cef587e58f3e3c5e9096f999fe558169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3798e028-9df6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618496638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "25d0cb3e-ae25-4536-934b-c9815c9b3dfa", "comment": "Malware payload (Dridex)", "value": "c5aabebda41d635fac51c842643e26d7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "c60b4cd4-15fe-4a7a-83c3-be8c25cd4c6a", "comment": "Malware payload (Dridex)", "value": "79727bcaaefe4db22c134cf8b0e3f7f579a0e7167f969d396cedca73ed551f34", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "0b6badd8-1c13-4553-88da-29dd7a2c2886", "comment": "Malware payload (Dridex)", "value": "3f198da06b3911658fe25bbd56f4a0044c69cdf0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618496638, "uuid": "05d4354e-7a97-4ae7-95ee-e1d14839d23b", "comment": "Malware payload (Dridex)", "value": "7bd590991e4a611ce11a5b5de1576726e353a450aa7961e57f0a960ad4beccfc02a439c3051b4799fde8b106f6b74797", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "ad93564c-8dee-4f8e-93fb-bac288fd743b", "value": "FCF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43729E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "bcd0e760-4cc0-4c51-bbce-070a7e558c30", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "4a3d0a3c-316f-49a5-9281-cf4fe571e0b8", "value": "3072:LA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:L3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618496638, "uuid": "328bd697-bb9f-4df5-87c3-93672a164d8f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618496638, "uuid": "a508f7db-6350-48c8-8d1f-1c3c250c1a9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618496638, "uuid": "d16cefdb-296c-4db2-971d-97df910a768f", "value": "79727bcaaefe4db22c134cf8b0e3f7f579a0e7167f969d396cedca73ed551f34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc764348-9dbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618472380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472380, "uuid": "7513cb6b-182d-46eb-9229-ee970f1bd205", "comment": "Malware payload (Dridex)", "value": "ee46c3ff288229d4c7fb4b01017b2f47", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472380, "uuid": "936467e3-48fe-44d9-bb59-6411052dd1ec", "comment": "Malware payload (Dridex)", "value": "79ae0b6879422364a6ced02df5c21bacbd0ce29de5b4224168a6e8a229157182", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472380, "uuid": "70e14490-d28c-4246-bc71-f9527742be3c", "comment": "Malware payload (Dridex)", "value": "c5b7553385416bb684861df467f22b82135e71e2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618472380, "uuid": "69f1920b-e1ff-4185-a0d2-cab32bc493b9", "comment": "Malware payload (Dridex)", "value": "00434bd53181db35ddff70863a604a46829418fd3a2ff898b1d7d9065a4de2ee0ee2665d6d91fb44bc82ecbd6af6b326", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472380, "uuid": "7ad89167-cc14-4a4b-8b0b-27d60ff2ec44", "value": "99F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472380, "uuid": "4a646ddc-2e37-4351-a4b6-a99530e0bbd9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472380, "uuid": "420a90dd-984e-4cf5-a8bb-57483af9bae5", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618472380, "uuid": "42208976-435b-4dfc-a636-7575137331f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618472380, "uuid": "3328365b-a054-4172-839d-0bead3c3a862", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618472380, "uuid": "a5344f83-a0fc-48dc-87f4-73245d7b9ad0", "value": "79ae0b6879422364a6ced02df5c21bacbd0ce29de5b4224168a6e8a229157182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234a5137-9df7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618497033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497033, "uuid": "020e74ee-ca4f-4277-9ff1-565a2d353e09", "comment": "Malware payload (Dridex)", "value": "04789b3c81f22c9a24f659c5b9c0cf80", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497033, "uuid": "f84c8151-4c01-4f9a-ad85-f6ad8da173b0", "comment": "Malware payload (Dridex)", "value": "79c82e4c8c247e8a0213853df32c8ef9141c90598c62c9847392aa86e8ade896", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497033, "uuid": "cb90c0b7-d61e-4bbe-9027-61c9a0a9d3c4", "comment": "Malware payload (Dridex)", "value": "c1cecc6313a15920db75ea92f1a391abd53458a2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618497033, "uuid": "b7a1353b-8543-47c3-bf99-5dbac1c0ee37", "comment": "Malware payload (Dridex)", "value": "795260fd17401f969aa7f078a9ca0283ed7e4f7353c388cd38c72019893e286a1f825b63e942b847c582f31750e7fa32", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497033, "uuid": "45fb870e-1d14-4742-bd35-f2adc704389c", "value": "2AF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497033, "uuid": "c7995d36-2a9d-4c73-b3e7-7045df486ac4", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497033, "uuid": "a9d2826f-4d1d-4bfb-86f4-332775eb32c1", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618497033, "uuid": "f43409cc-46de-42f6-b37d-1be2d4973cb0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618497033, "uuid": "37a35baa-8f31-49d1-8f5e-db520acdde7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618497033, "uuid": "cb156954-0fe9-42d1-8eea-2a6a3fd0bf99", "value": "79c82e4c8c247e8a0213853df32c8ef9141c90598c62c9847392aa86e8ade896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d9b119-9df4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618495902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495902, "uuid": "d31358ed-1544-4f77-b43d-15e0068c6dc0", "comment": "Malware payload (Dridex)", "value": "01cc7c9b6aa8180bbb518c61f9b04856", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495902, "uuid": "e7addca5-4e11-4a54-a151-033cbab418a1", "comment": "Malware payload (Dridex)", "value": "7a942a5d2b1b95be261af014d5b55dbdef07eb054ff0ecdd0e86e6d5456e5139", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618495902, "uuid": "80acf0cd-be03-4bb4-9c