{ "Event": { "published": true, "date": "2021-04-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-05", "timestamp": 1617667382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f8104ea6-f1e9-4efd-9d38-81e4cd5880e4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf634f4a-95d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617603942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603942, "uuid": "af576dcb-1294-4d69-a963-11f1ca06cbfd", "comment": "Malware payload (AgentTesla)", "value": "dc96b237dc5b2265e3b426254123f165", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603942, "uuid": "eff5ec74-d0d9-4796-8fea-aa7ebac25fca", "comment": "Malware payload (AgentTesla)", "value": "01327cbb9dcf2149ac4663afe116fb816179c395a2ea44a26b6bf67fb2bd27fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603942, "uuid": "f1ab8284-e1b1-4f0e-b350-9eb7a903efb1", "comment": "Malware payload (AgentTesla)", "value": "428202ad77cc5df9c78d493fb36a8dd5ff9e1428", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603942, "uuid": "23b571c1-63e4-42e6-91db-b4eab824541b", "comment": "Malware payload (AgentTesla)", "value": "db3c87a520e4e7feeb5015f594a86f3330d724910f7c0e0134f15d667aae54583b9e83472d6145a678b6bec0ec2cbc8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603942, "uuid": "bbcaec29-d111-414c-8478-a2952121d1a8", "value": "7D9423A77A61B7899466880A6DE28C9DD35BEC7C4F62410CD502B2E7F5348342E9FB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603942, "uuid": "56c29bb2-0705-41cf-9c39-66e002faf0f0", "value": "12288:CBCRv8S8sEbwBRLVkGLBvdwglGWTRGqFP246XGlem:FKwB5VtNTRGyQXGlem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617603942, "uuid": "ff87b284-15b5-4ba6-bdeb-9518ed382a3e", "value": 415166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617603942, "uuid": "820cee6e-997e-4275-99a3-ce4539176d43", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603942, "uuid": "6681cff3-e144-4435-973d-c8cc25ee1df2", "value": "Shandong CIRS Form.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c71157-9646-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651511, "uuid": "07185ffa-6cd8-4f46-b66b-0e376b2f4501", "comment": "Malware payload (Dridex)", "value": "dc5fe3021c47145731d3693f9c3900b4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651511, "uuid": "21e2b5cf-0615-4b66-8cfb-d5a58df45292", "comment": "Malware payload (Dridex)", "value": "015cef419ed6af109cf881c30c608851445cc1824f269786e791d0d4067687bf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651511, "uuid": "3a5f750e-645f-44a7-802c-ddf058aa3d39", "comment": "Malware payload (Dridex)", "value": "77e31d53a62961d3feb528433330bfe49c348d06", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651511, "uuid": "3ba39c64-5f16-4c75-9cee-3441ac2839fb", "comment": "Malware payload (Dridex)", "value": "3cc0e7061a81a8c923b0feab1f86a69a653eaf4f11a03b86ca8c6218e4d86a722f96b30f94f376205a821ac7047d42c2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651511, "uuid": "8cc34909-89ad-43ab-bbfa-380b32194660", "value": "3414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651511, "uuid": "9a7cfbcd-93e1-482a-9654-0ea8b15cab68", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651511, "uuid": "e0961adc-a32d-4ac7-ac64-2128fba070d6", "value": "3072:TBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:TBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651511, "uuid": "5adf2718-2dbf-4b03-ba8c-4f8a86115fb1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651511, "uuid": "ebc7103c-f377-4c1f-9afd-2ff17438d937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651511, "uuid": "93d44fc4-9e27-49cd-a21e-7cbe077a05df", "value": "015cef419ed6af109cf881c30c608851445cc1824f269786e791d0d4067687bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6561cda2-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614958, "uuid": "fae98077-8e63-475f-b76f-d4d7546bcc95", "comment": "Malware payload", "value": "fd0a15ffdddf8ff99ca64f154c8d7687", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614958, "uuid": "34866d43-a941-4d4b-b5cc-b8512f1fb512", "comment": "Malware payload", "value": "016a1738c27fb3416ddef3c55af9e6eb19635c61fa92c7095b63b798c105dbae", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614958, "uuid": "5467aea2-8335-44d9-8ca1-1d049eb17ba8", "comment": "Malware payload", "value": "0acb705134048a5e0f80d119781f7e759be3cbaa", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614958, "uuid": "53923c55-96ea-4e39-a88f-7cf3ab31db9b", "comment": "Malware payload", "value": "ca2c962a3c0681322e0cf8145a58fc746b0783d62059d2ecd341da4bec4aacaac73a9e2c2551693578d9a3c29e76c282", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614958, "uuid": "bdd5e2c7-a1a6-4902-bc30-95d2510aaa0e", "value": "79663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614958, "uuid": "8d34032d-f7fd-4f08-ba67-0ae80f989d57", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614958, "uuid": "991aeb46-7181-49d6-b6b7-54fa6345b28f", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazD:kfauN/HYOSIT/EVF9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614958, "uuid": "dc8ddc30-db19-4e38-8658-86750724e8bf", "value": 6967194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614958, "uuid": "04b67815-8e77-477e-a3d3-14b0e90c57dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614958, "uuid": "68226fd9-5aae-4db3-ae2d-9148f42babcb", "value": "016a1738c27fb3416ddef3c55af9e6eb19635c61fa92c7095b63b798c105dbae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0d8423-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "78261905-d3a3-40f1-800a-c583a11877e2", "comment": "Malware payload (Dridex)", "value": "d6eb65899440a3df7f6b237d49557a89", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "1e6570b0-1215-4d7a-b87c-bd8de2eec872", "comment": "Malware payload (Dridex)", "value": "024a733e181cf2c24e66736e169174372f09304542a222a2ab8d38e4671677c8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "c08af1fb-5cd0-46d3-b27f-5e1a92769b2e", "comment": "Malware payload (Dridex)", "value": "ffbc0b20809c3d2e31e2e2a926020fd1e4f7b562", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "c63384d1-a946-46bf-a541-4b40bdcb3fb6", "comment": "Malware payload (Dridex)", "value": "9c023237bc93f7ca1a5b850905c6eb4815d715db2140048f4438814f6b38a33d9934092d4d9563870d417633999e47fe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "fc1edde1-8704-4a82-9fbb-bef9d41b718a", "value": "B514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "4617a377-aa55-445f-bc53-a3ef3220fe2f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "851d6776-ec1f-4b4d-aa08-1dd83329bbd4", "value": "3072:6BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:6BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647883, "uuid": "c6144980-62db-43f8-833e-3b56f850ad19", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647883, "uuid": "584e6270-b776-4089-835b-4fc451a0f438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "6a83dbf0-b02f-4c54-a310-e20cdb20808b", "value": "024a733e181cf2c24e66736e169174372f09304542a222a2ab8d38e4671677c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce93bf31-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647776, "uuid": "bce313ac-e5fa-4bdd-8d84-d5c41d89789c", "comment": "Malware payload (Dridex)", "value": "0d681deb7b5c00c121a01d7b732843a2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647776, "uuid": "2aaa1a43-36fc-4761-86b2-1f2fd96fd825", "comment": "Malware payload (Dridex)", "value": "025ed8f71cd91e7cb2d32807d20c17665cfdb01967483735fcfae9158eeb969b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647776, "uuid": "163677b9-8da7-47e7-894e-65f3fae6ee12", "comment": "Malware payload (Dridex)", "value": "f9a498bef524841fd39336bfe6d9fb9321d27526", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647776, "uuid": "57d5339a-6700-4350-b332-ca06a9a1dac4", "comment": "Malware payload (Dridex)", "value": "a362d6378807e3ed8faf4badbb01c561d43ba73aa8bea3fc7a780f394d6caac34d459051a9c0d1b29c524fc206e52303", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647776, "uuid": "93a51ddd-1ee9-4e61-9584-301403acc674", "value": "2F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647776, "uuid": "c8240034-0e26-4f8e-b8a8-380e76a0e67b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647776, "uuid": "1a55250f-f5d1-4e71-b955-8a7d25c75c70", "value": "3072:dBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:dBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647776, "uuid": "7ad96284-ecba-4cf5-a686-fbbad6ee89a6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647776, "uuid": "b6cdbd2f-14fd-42ee-baaf-7f23e8d363c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647776, "uuid": "d1dfd815-a9e1-43cc-b120-29d3bd6b3992", "value": "025ed8f71cd91e7cb2d32807d20c17665cfdb01967483735fcfae9158eeb969b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09df99e8-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "e323c956-7290-47b7-a52b-dce521751eef", "comment": "Malware payload (Dridex)", "value": "1e4648bebf2d0d147e969ce1aa8ed25c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "dcef6516-d31b-444a-9187-75d790226446", "comment": "Malware payload (Dridex)", "value": "038b31ae84a065f6f7878f4d1f89332efc3a24e681d6efa6079e17b31ae4b15a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "e593a434-f9a4-4e28-a09f-4bda585027d6", "comment": "Malware payload (Dridex)", "value": "52880a4595281f9a2a1e8fa9eb7ee37275629d9c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "67c20788-94cc-497e-9a61-2cc7057593d8", "comment": "Malware payload (Dridex)", "value": "e9ff53078fbdbbe0682dd32c6489deeea192a7c2cb9ede75680f40e677b9c0bcf900c7286c5a98223a382b4d13c79d1e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "3bf105ad-c2b1-462f-8eeb-ad837b82ed36", "value": "9014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "9ccc0b34-d263-48f2-98d4-0102e18d387d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "3c748f17-6c6c-49d9-95eb-a91bc6f19576", "value": "3072:1BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:1BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649594, "uuid": "b18d0357-5360-458e-af5b-ac2da4d440d2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649594, "uuid": "81f90808-97ef-439d-b47d-c292d285269c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "3bc97100-3eec-4212-9227-a084c40dd92a", "value": "038b31ae84a065f6f7878f4d1f89332efc3a24e681d6efa6079e17b31ae4b15a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8da7a7d-95f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614722, "uuid": "eaa3a47f-36cb-4223-8076-d10844e3941c", "comment": "Malware payload", "value": "ac133663f3df86bf17ed7bee3d4b9a80", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614722, "uuid": "c90341a6-aaa7-4bc0-a97c-d6a52b32d350", "comment": "Malware payload", "value": "03bdb2c5cdea7f4b01dd14e5436a26162de5e85b78d67e0600cc27ef5ae57f4a", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614722, "uuid": "131ed687-6cba-484c-99c2-1908d3992ba3", "comment": "Malware payload", "value": "535c179e2c2e54ca3311ce05fb8ccad2934c2817", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614722, "uuid": "f8aeea0e-70e7-4f57-83c5-89a9bd7ad065", "comment": "Malware payload", "value": "aac504faf588a3e8a8aedb1b9d32cead0f90b975120a7a7357f406c166e2ddd3fbb754f2ae080d264c1f64a04d8be561", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614722, "uuid": "2d5c8c22-39b2-4745-b550-ecda0fb6333a", "value": "DA663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614722, "uuid": "18bb917c-fc13-4ed0-943a-1defc7d9a852", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614722, "uuid": "eafc6f97-03ee-4fd8-bce7-c4dfc82ace27", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazz:kfauN/HYOSIT/EVF9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614722, "uuid": "da531d5b-efea-407e-a8b4-061f30366730", "value": 6967073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614722, "uuid": "73270719-a6bc-4835-b4bb-da1c811cffe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614722, "uuid": "2462d197-34f1-4097-86c3-848eb7b47edb", "value": "03bdb2c5cdea7f4b01dd14e5436a26162de5e85b78d67e0600cc27ef5ae57f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7026badb-961a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617632585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632585, "uuid": "1567cfa4-0847-44ad-8ad9-8fccb9c1f52c", "comment": "Malware payload (RaccoonStealer)", "value": "0b6e3a48c0c55996ebd0fb4c02ad34f3", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632585, "uuid": "03f2623c-2642-41da-8c86-c6d41c5c6076", "comment": "Malware payload (RaccoonStealer)", "value": "063599342888ca8db39fbfa1a514614781beae26ef228c4c6a5a3f99b67b6a63", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632585, "uuid": "15b8c130-0b3b-433b-a148-294423d95fe4", "comment": "Malware payload (RaccoonStealer)", "value": "5d0ec73e21d32b89d3a8444ec4563a451ecedcd7", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632585, "uuid": "be36bc36-6ffa-42b9-8ff0-50afc1c0af71", "comment": "Malware payload (RaccoonStealer)", "value": "4950b31c64adb4123f1ce41a45c86ca108c9b915247b5505b1a1bd8d85cc35203d857e072f1e52306ca7733cd06d8d4f", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632585, "uuid": "4cf8fb0b-74a3-4189-a716-cac89c2090b9", "value": "BBC4E01132E0C072D5A225754625C7F15EBB78726B299ACFBBD81AB90F247D0EB39307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632585, "uuid": "95a03921-73dc-4bf6-b1c2-d581475795a6", "value": "cfd2a8b3b87892c94a344172880ccdd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632585, "uuid": "e79e867f-183e-401b-ba78-61878e60d9b3", "value": "12288:XVLUpsUGuIvm6gQbbJu5SZ31dfTjCBtnFav/601:lysUqOKnAAZ31dOt4/601", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632585, "uuid": "83ebda90-9ec3-448c-b412-5ec723ac300f", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632585, "uuid": "76029ac2-b740-4c0c-bc0b-9f7daeb5f9c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632585, "uuid": "aae6471f-0b88-4669-a77b-6a0775d7bed4", "value": "SecuriteInfo.com.W32.AIDetect.malware1.21202.28107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a8a2cf-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617604219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604219, "uuid": "86ce047c-15c3-420b-8bf8-c9c356205fd3", "comment": "Malware payload (NanoCore)", "value": "d9b97229c1ffefb60c6c1abe86eeb720", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604219, "uuid": "880aa7b2-a803-46bd-b7f7-0883ce74bc57", "comment": "Malware payload (NanoCore)", "value": "066cd9770911c86ad9b050f137ca0684413929fbd84a0cfb22013aa534d24523", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604219, "uuid": "345e7196-fed7-48f8-bbd6-68a923c1b424", "comment": "Malware payload (NanoCore)", "value": "da1a7ae1a7a9ac98b024955ce4317522a5bdf744", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604219, "uuid": "3cc2c0ed-3365-4c36-b3e6-15787a42f9dd", "comment": "Malware payload (NanoCore)", "value": "9fdcd09eeb2eba409c70f12c05c051be03fdd6bb0003575090f079e66b388e24ae1e2ffcb7d9f86ca975201baa19c22f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604219, "uuid": "68544ab6-707a-48ed-8db4-3af6c33b94ca", "value": "0A25CE13728C935CE99A1F70343746700266AF076D2DE60DBDCDFD5D1B73A8A8A126E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604219, "uuid": "ab3001c9-e59d-4e1c-a0a4-6a5032fbc20b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604219, "uuid": "727d1e14-cc32-469b-8394-7be42cdfa4fa", "value": "12288:+Owldk/VrgYFofcnJN4GMLPl/el40p5ht7wQiCIoDVgGU20Te6cifUAVW8HvSrmn:qldkpmUJOVh/el40LsCIgU1NhrV5DR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604219, "uuid": "74c25fa8-8a3e-400b-8736-3bed239f2fab", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604219, "uuid": "ed3b8d1d-1a3a-4b85-87bd-61ef0ea6cb0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604219, "uuid": "cc0c1436-44bb-4071-be6e-94c8bb42d1a0", "value": "DHL_Express_Shipment_ConfirmationBJC400618092909_88700456XXXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43812ed3-9657-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658710, "uuid": "589771dd-ea5a-4bbe-82a0-6321d662c2bc", "comment": "Malware payload (Dridex)", "value": "7ade51b64e3267eece8f744b21925950", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658710, "uuid": "cea4882a-5355-433f-832e-92ce125b75e5", "comment": "Malware payload (Dridex)", "value": "07995ae2654e477d7763256aa56d5eef1ff52a5e1f7e0a427cc8f7b1be9c1ec8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658710, "uuid": "bc6939f8-742e-4adf-9d39-63022da79057", "comment": "Malware payload (Dridex)", "value": "5bb7d05044fa696603f5b513e6c8a0c506cacc63", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658710, "uuid": "da3d5e7a-6ae6-4ea1-8ba4-6ad107e6f4aa", "comment": "Malware payload (Dridex)", "value": "642717f3bfcc66947c3a35e019d648253851d57a01329fc3113db973faf367f218d7772e1f5018d7016e6124913e76f2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658710, "uuid": "84c32f49-c815-4ccb-b414-20cb0e84c5ed", "value": "07149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658710, "uuid": "b72066b8-4dbd-44b2-95b1-86c9e6f85f39", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658710, "uuid": "84392e26-cf90-4fb3-a382-63ca40738492", "value": "3072:H6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:HZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658710, "uuid": "93e54e1b-aa77-4ee2-8ccc-28e02416cfa8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658710, "uuid": "23b6ee6a-97ea-4b25-b2ed-de41b8803f1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658710, "uuid": "703fd0bd-f964-4328-a927-f47d10da3fc0", "value": "07995ae2654e477d7763256aa56d5eef1ff52a5e1f7e0a427cc8f7b1be9c1ec8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e161d72e-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646519, "uuid": "1e3f86f0-96a4-4801-9ac6-d556c4196be0", "comment": "Malware payload (Dridex)", "value": "ec1cc55042c717d97943e0e86a73e0b3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646519, "uuid": "a4e0efc9-53d9-4a0b-b8fd-8d0e79c4a8f0", "comment": "Malware payload (Dridex)", "value": "08691b1aea16ff5736ec5b606da90b0f80501e11874d9f296e9af865b1acb4fc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646519, "uuid": "521199d5-829f-4114-b124-00cfe9e3dbda", "comment": "Malware payload (Dridex)", "value": "7e84eb57854604ee518a08de1249f799d3b21b24", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646519, "uuid": "0332f8b0-725a-4f1a-8b96-5334a31b6437", "comment": "Malware payload (Dridex)", "value": "1a395c2835971b70992a3cd21221e83f690f8dd04c08544932a915a43dcdecb73b1b09ffed78754f2affdadcd2dfd315", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646519, "uuid": "ec147d51-393c-42b8-acd1-c4e38c757eee", "value": "3F149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646519, "uuid": "002177b0-9260-454d-a6bb-5ed8c1f1b81a", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646519, "uuid": "5e84acb4-a26c-4d28-981e-432ca9a288e9", "value": "3072:+6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:+ZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646519, "uuid": "231983eb-9292-46ca-95c6-82a7e207c540", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646519, "uuid": "0164a9d8-e486-4bfc-8270-d3067a392896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646519, "uuid": "4ad5a554-ca4e-47ee-9448-d2feef3b1f86", "value": "08691b1aea16ff5736ec5b606da90b0f80501e11874d9f296e9af865b1acb4fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6ca10b-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617650346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650346, "uuid": "bff3dc79-13af-4170-883c-7b7791382f09", "comment": "Malware payload (IcedID)", "value": "acc57b939ac8bb9bd4bf18f76e779977", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650346, "uuid": "2ffdda09-b9c3-435f-9ff7-82bee467997f", "comment": "Malware payload (IcedID)", "value": "08a63aa27179c37d20715c6606dca1bbf7a5a7e3d4aeb56300b5361492366f1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650346, "uuid": "350b355d-9590-40cc-a038-128607265c59", "comment": "Malware payload (IcedID)", "value": "61d4a0974fea535423a9bdfb1c2cdef7515085fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650346, "uuid": "96b60295-43e3-4ae1-b380-1341bfe3e229", "comment": "Malware payload (IcedID)", "value": "213de22443327b0aa1d41a4585a502abde4644be799c201056b6e506a9760b75466c6f03225dd2be2be9b2bfa932dfba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650346, "uuid": "69bdd9fb-12ba-424a-8802-d7533580bdda", "value": "6B14F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650346, "uuid": "e2ccc7ad-437a-4bcb-87e1-4de87340e1b4", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650346, "uuid": "73ac8110-430f-43eb-ad93-bf7a79553f57", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650346, "uuid": "71959a9e-e2fd-4663-8d23-11db4cba2df9", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650346, "uuid": "5362edc1-e29f-44ca-af42-9953d677b3a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650346, "uuid": "8adb016b-081f-45df-8ec1-f64831ba8663", "value": "acc57b939ac8bb9bd4bf18f76e779977.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ed4335-9611-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617628871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628871, "uuid": "71d8007a-f5fe-47cd-bed1-c18270ca1e5e", "comment": "Malware payload (NanoCore)", "value": "79cd8383f51372c9f0721289f6470889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628871, "uuid": "141fc732-9ec0-4ee3-b23e-24fb1add4f43", "comment": "Malware payload (NanoCore)", "value": "08ecce1fb89755fa576a2c1c855bbb0f701ef20c791f56dc0c675fb2a8163691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628871, "uuid": "8d3b1bb8-ad71-425d-8b5b-d1e067417402", "comment": "Malware payload (NanoCore)", "value": "41b082acc2c9725da7c20ff93dc26df2ab06d1aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628871, "uuid": "ea0ed337-9947-4c30-a2b6-86a859348be1", "comment": "Malware payload (NanoCore)", "value": "ea2289cb8c9c110e3698a37b7ec38b008a11b4b31688371790ff8d00aae9166b40546b8aa7434813eed1838ef1fe0d98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628871, "uuid": "6b8a70b1-841d-4a09-a96b-c5e6d8a2ffea", "value": "12F401102745DA01C48D07728626E6039376FDDC3EA3DB1C051AB1993AB6B8DBFD9ED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628871, "uuid": "cf331e5f-759e-4d75-aaf6-ee2a55672b5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628871, "uuid": "25c74f80-3e0b-437a-b27f-894fff79d4b5", "value": "12288:M+7v0sCUuWvoXrR9yV2LNaQu4hy/f1oJ4W5erTf+uJTwtrG3:J7v0sCOvwlUV2pzvhy/fA4jSuNwtS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617628871, "uuid": "391a0b0f-38a1-4238-bbdc-729e748401e1", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617628871, "uuid": "07ad8801-dd9a-4628-9a8e-3bc95770e15f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628871, "uuid": "2fc3c899-9581-4313-a3a1-5de39d28f7e1", "value": "Quotation_Request.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d44d9f0-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604261, "uuid": "fcffe7c5-29fa-4bad-8325-8744cf301e1e", "comment": "Malware payload (AgentTesla)", "value": "b967722c59b654c6629f40b5d567be34", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604261, "uuid": "0abe58b2-c0d4-4329-8a3c-103d5e01d83a", "comment": "Malware payload (AgentTesla)", "value": "08ef33dfef9ce4b362eca4964cb3fd3345688de2e45a3aae2d26dcfda45b93a2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604261, "uuid": "2a727ff0-526e-4e8c-9b8d-40c265152a2e", "comment": "Malware payload (AgentTesla)", "value": "9f9b048b9f85f69cec1797aaab64a44d319c1875", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604261, "uuid": "b16d093d-0917-4447-ad46-4ec077e7800e", "comment": "Malware payload (AgentTesla)", "value": "b8421ebdbed8a2fa68d014cfce090ad7a7281c424d322861234885b35e8fd55711e7c511530ae6c1ff5b5016cf07ffaa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604261, "uuid": "a8ea3e2a-f3de-49f0-9e38-3825e11f2c70", "value": "8462C107DF5D376BEF21343C108F57247981250AE9496348E697A4B9AC977BA0AF1F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604261, "uuid": "0603686f-ba70-4e52-8ab2-3d29656bb063", "value": "384:o/s5ybCWOCVWNdabSTuo/KYmPqO3P0RUajXklTIjfM28ZTv:2yybCYoNdmho/KlPReXbEMjUpTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604261, "uuid": "1758d1b3-ec26-4c3c-bc0a-1a3f9dc6d3e2", "value": 14746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604261, "uuid": "09a67371-d221-45d0-bf85-f4b078cee679", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604261, "uuid": "13e8cdfd-3070-47d5-8f49-9b9987ed69a2", "value": "MV HONGSHENG 7 PDA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d49a950-9647-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651908, "uuid": "d73eba45-f2c1-4e48-97ab-d0cf8d6cadf7", "comment": "Malware payload (Dridex)", "value": "e32fa4983862bcf8d735bb944c339ea1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651908, "uuid": "46828889-8f3f-4973-b439-be0dbcf2b752", "comment": "Malware payload (Dridex)", "value": "08fc753cfebeee7d4f6f76546cece88b501aaaf383e13b7fe6c5a0f8e7c7948b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651908, "uuid": "1a6dce2c-7c6e-4464-9b18-5fe007750891", "comment": "Malware payload (Dridex)", "value": "a640781e2da6d75ca176137dfc314cb2d5973005", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651908, "uuid": "a1c69993-65db-416c-bddc-472577a232da", "comment": "Malware payload (Dridex)", "value": "c6859896c2469110af9000d96e8161f02d247e2f42e33722d28f9f115b9b9fc49f7ff2a81588b09744ab59de10d479ec", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651908, "uuid": "1d588b84-90ef-4022-8bef-727adfba78b0", "value": "3B14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651908, "uuid": "578f80cf-0f25-4ef1-93fb-f9f9d81cd293", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651908, "uuid": "eb1227bd-7953-4071-8eee-6d9e526baeff", "value": "3072:sBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:sBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651908, "uuid": "4b8cb265-672c-4b78-8771-8a79f3dac004", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651908, "uuid": "65235cd5-0465-455b-b01c-08b0f6485303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651908, "uuid": "6d04813d-d169-44bc-845e-2655e4607e5e", "value": "08fc753cfebeee7d4f6f76546cece88b501aaaf383e13b7fe6c5a0f8e7c7948b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7d54f3-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644396, "uuid": "745662c3-0463-403c-8e7e-7ef06512c6d7", "comment": "Malware payload (Dridex)", "value": "f659d0b4345220d2055289dcf59f0e79", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644396, "uuid": "37c12f13-cd3a-48db-b7b6-b177ae8bf4f0", "comment": "Malware payload (Dridex)", "value": "0960b39617b3752534bf114995573fe4de579cfd44e3a169720b2e393e7035af", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644396, "uuid": "da353116-394d-477f-89a4-c5f8aa218136", "comment": "Malware payload (Dridex)", "value": "96b8d1d017eecfb21db37683ff9532925a4fd396", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644396, "uuid": "01d9365c-672b-41cd-bd0f-3b3a05a43223", "comment": "Malware payload (Dridex)", "value": "cecfa96cec149d7abe0446a84c5afa87b93a468cb53cd8a1c86624094a9dbb0b4f9d45ac1027dcb2fc5ecf014b524802", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644396, "uuid": "391c8ea9-489f-449f-9bcd-44223bc66dff", "value": "6014AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644396, "uuid": "b58a3aa6-eb84-4cd7-b42a-446f25ef9c9d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644396, "uuid": "dd364e4a-b21f-49fe-af51-51c05aa3e805", "value": "3072:IBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:IBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644396, "uuid": "dbe2965f-16b8-4f7b-b613-a663d535b465", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644396, "uuid": "7032c404-35f8-4f3d-a405-78cedeb4edc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644396, "uuid": "a1d8807f-7cea-41ba-81aa-b90a2410d745", "value": "0960b39617b3752534bf114995573fe4de579cfd44e3a169720b2e393e7035af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da810e3c-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "085faff3-5937-4ffa-a110-ef52b84fc9a1", "comment": "Malware payload (Dridex)", "value": "50fb079436642eb3f73cab85d49e497a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "9151d53b-757c-4e10-ad93-af0815f26f73", "comment": "Malware payload (Dridex)", "value": "0a09912bb8b242e740fc11ed31628f221f2c16e24d340449733cd2e9adcc69f4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "da012295-a621-4970-b40f-081b456ac7f1", "comment": "Malware payload (Dridex)", "value": "cc21e478a16cc7633fdb9983224b92099afce327", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "7674e993-eb9b-42d8-8b43-39e6e5062c0e", "comment": "Malware payload (Dridex)", "value": "bfaaae113ef96564304610cae02bbb95586635177d248115eb820a427809d50aaeacd3db759dc1cfee29a1929c8b05c3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "c7d087d1-f741-4e3a-84d1-b6c0d593ebd5", "value": "C8149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "5c8f9ab0-ae98-40a3-a5e3-5f62633140fb", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "b11e4093-2001-4395-b3ba-f4225a00e650", "value": "3072:U6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:UZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646508, "uuid": "947fc6f1-5210-4099-89a2-73ea031c6fef", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646508, "uuid": "de373a1a-2f48-4076-a9ee-769cf6a9c076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "fdee4fdd-47b2-49ff-acd7-5de4e1c9af06", "value": "0a09912bb8b242e740fc11ed31628f221f2c16e24d340449733cd2e9adcc69f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e342ad-9656-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658492, "uuid": "5eadd2d2-d6bf-4041-bb54-49c253cfeb37", "comment": "Malware payload (Dridex)", "value": "3bd83a1794607a05a0a3b321c616cbf1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658492, "uuid": "ad310cec-c8dc-43dd-8b24-2aee5dc75a33", "comment": "Malware payload (Dridex)", "value": "0aa0ba90aeafb774a6b8af2dc768c591b59826ce2c305b353219dc7bedcad3db", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658492, "uuid": "6b7abcfe-6a6f-4973-9086-1c89207de3a8", "comment": "Malware payload (Dridex)", "value": "0adc540fa141ef1f86547109762baa056ce411bf", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658492, "uuid": "f5e3567e-cdee-4db2-abe2-8479e96fdc11", "comment": "Malware payload (Dridex)", "value": "73e64c72d53a5b20d137c5fe3d8819f5bc90077bda19fad9bb89364d29d73b40c06e6fa3eb466b6f4b892cf1f8c36fe0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658492, "uuid": "792bf937-1954-45d9-ad37-68dd52bc6d34", "value": "CC149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658492, "uuid": "621e3d13-87e1-4188-b319-4d85a9714262", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658492, "uuid": "72413514-ab32-41f7-b1b0-fc08ca6431db", "value": "3072:N6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:NZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658492, "uuid": "6be248c1-4e97-4e8a-a111-fe8f8e133a48", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658492, "uuid": "cddffa90-bf77-4899-b4cd-8d38db90e01c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658492, "uuid": "2fa0a59b-4f6f-4845-81df-7924d959e9d1", "value": "0aa0ba90aeafb774a6b8af2dc768c591b59826ce2c305b353219dc7bedcad3db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4809419-95d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617603951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603951, "uuid": "c1d73a1b-f1d5-422a-b002-c4dccdabb3b4", "comment": "Malware payload (AgentTesla)", "value": "2fc09da8694c3029b42e23947c390b50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603951, "uuid": "7315763f-5a47-4718-9121-657f4e07dbdb", "comment": "Malware payload (AgentTesla)", "value": "0aa33a46ce0903294bbaab17ef7efc361d9986d342097973dc76bdd721e68e05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603951, "uuid": "f6050f7f-10f7-4148-a0a0-3903c931f691", "comment": "Malware payload (AgentTesla)", "value": "115ddb86b3070d3d8706f96f5f8dc90a1523d973", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603951, "uuid": "3e1c30b4-d5a3-47ec-93cf-9b8d34462537", "comment": "Malware payload (AgentTesla)", "value": "47d4f11d272bfd592106753bcf546c424cf8827e2944ee686fdbed701ab171b71c7f0ef3ac95217f0a738783b812bbdb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603951, "uuid": "e75a90d7-aa8e-4399-98b3-082263a0cd36", "value": "7FD427B872E1E679C814827169217C7243F19CE4DC73EA15ADDCF9E09130EAD2FA1A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603951, "uuid": "4f88b3f5-66c2-493a-b319-2dafe253e4ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603951, "uuid": "72729754-0448-4806-bc63-a1706ae22a3d", "value": "12288:HDAxu7Ud2SYoFEg36hyYS7giSZIkZATX:8xuwd2SYoFj36hyYc9SZIkZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617603951, "uuid": "12c62e32-0a2a-49bf-b0d4-4e9b98e141f7", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617603951, "uuid": "9143bda6-7d0c-443b-9ca2-e0e58bbc7f5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603951, "uuid": "59fc698a-f8b6-4f92-aa1b-c6e36dc2c117", "value": "Shandong CIRS Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c2c8be-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649743, "uuid": "d9f5e2d9-c293-4e9e-b294-2633ac3ed216", "comment": "Malware payload (Dridex)", "value": "d1b3da0143e8fbce1f5a28a8b5e76153", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649743, "uuid": "20077b4d-68b7-407e-b945-fbb915877979", "comment": "Malware payload (Dridex)", "value": "0ad63748effd9a9cef30be6b1cb4d6cfa2a75e062f014be3925bfe9ff1aaca09", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649743, "uuid": "d28a10d3-a6a8-47de-8f7b-4144469c45d3", "comment": "Malware payload (Dridex)", "value": "e77d7ccda1f30cf5ddba85a17e1ea3902fa91c06", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649743, "uuid": "1e81e4bc-8eee-41e5-9619-af63934aeb65", "comment": "Malware payload (Dridex)", "value": "e75228418e4e7f495eb2a405ae9bf35507e97cd292612084a68a42a3773bbae3e94007bb0d4281bd7e1e90cd3c4901d2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649743, "uuid": "0aba8040-ed46-4032-9829-ded325c6a0b5", "value": "0E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649743, "uuid": "3bcbb692-ba43-4f92-8bac-e7905070f5fa", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649743, "uuid": "09c424b0-b81c-4a58-aff2-98d0263d21a6", "value": "3072:PBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:PBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649743, "uuid": "270f6afe-feb3-4d42-a001-659b737f3341", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649743, "uuid": "df1bcce1-8d9e-4cdf-b103-62ff841f83e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649743, "uuid": "a97db2e9-f275-47dc-939f-ed055305b187", "value": "0ad63748effd9a9cef30be6b1cb4d6cfa2a75e062f014be3925bfe9ff1aaca09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ddd020-95da-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617604918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604918, "uuid": "5f820eff-c45a-40f2-9e44-7c4828fdb25f", "comment": "Malware payload (RedLineStealer)", "value": "303cfb8e3b5eee413aaee8c7162c9778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604918, "uuid": "41647832-2b61-417f-96e6-72a8ddae6008", "comment": "Malware payload (RedLineStealer)", "value": "0b3641e54ee0e39db24c0535aa3064b4dffba404557aa01509e5f1cd1d243077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604918, "uuid": "641e6612-5788-4c00-96d7-2c203ff7a17d", "comment": "Malware payload (RedLineStealer)", "value": "17afd76c96a7c2dda0c8f6a8e7505d7d1f910970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604918, "uuid": "9348104f-24b0-4639-81c5-beb4067d54ab", "comment": "Malware payload (RedLineStealer)", "value": "aa976bc9fa09a072684ebdd9fca5b4a6c1150feae7ca0ce6b230985d28218b4a062a3dd784648e1d0d18fcaf7d9a6591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604918, "uuid": "2fc0410d-502a-40ba-a089-01699b239d52", "value": "5BD5462122E8CFE1C0AF2475DD96B2F44613AE10CD658FCB7E847E1A39B12A5E53118F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604918, "uuid": "ff3bc759-2e72-4965-a4dd-0dcdde99ced8", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604918, "uuid": "44b73c1d-3667-4918-8e28-b65443ee1b62", "value": "49152:tkQTA0fORHyQkqoxYkc6kRY5h/gqSGNonMjLQ4D+ps+2:ta6EHoHWkcpUQgoMcs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604918, "uuid": "67da9457-b0c2-454e-be9f-0934104d8849", "value": 2818995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604918, "uuid": "8f47e707-bfc6-4e8e-ac7b-76030d4074b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604918, "uuid": "167acc30-a4a9-4370-8808-f23a78fbc250", "value": "303cfb8e3b5eee413aaee8c7162c9778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f125a3-95f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614483, "uuid": "79a8bc54-3253-4ccc-979a-ac47bb61d234", "comment": "Malware payload", "value": "dde978f310f46d0556ea774da695b698", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614483, "uuid": "42ba54c9-7fd1-4319-8a0a-badb6bbc7ae5", "comment": "Malware payload", "value": "0bc20b98a473491219885cc68d0f0944563260ae12add1b1199e64255e92c40d", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614483, "uuid": "bb7bedf4-eac4-4495-83df-572a17279f00", "comment": "Malware payload", "value": "e22548f91b17d4f4fc38dfe1b90ea71b1a2bfed1", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614483, "uuid": "8f80a309-1869-4d91-add0-e69090765f83", "comment": "Malware payload", "value": "12c08515ade1dc26686d61e5a708efe92d8d2fb117cc93f8a483b0763e4de197acc870971a6af5f60b1c3516afb95603", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614483, "uuid": "7f147c77-8bae-4467-ae00-2e969a233665", "value": "BA663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF63AC5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614483, "uuid": "25905641-7e8d-463c-aeb3-a25e23155fe3", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614483, "uuid": "c5610cbf-f6c7-46eb-86d5-2a9691950660", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazR:kfauN/HYOSIT/EVF9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614483, "uuid": "75133dd1-2cf1-49fc-a9a9-1243675db4c0", "value": 6967362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614483, "uuid": "a3b7c242-300b-43f3-9977-c2f4e0859769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614483, "uuid": "331e9e50-f0d9-4971-818a-5fb90a591ebc", "value": "0bc20b98a473491219885cc68d0f0944563260ae12add1b1199e64255e92c40d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ed474d-965e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617661942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617661942, "uuid": "cee4a969-e3c1-4ae1-be53-c3f88164c8f9", "comment": "Malware payload", "value": "8a3e9997f0b1192d4dbc2a76e7a9b5d1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617661942, "uuid": "f8300a25-79d0-48fa-bb87-d9a49ac85dfd", "comment": "Malware payload", "value": "0c1b5088e52fe8b6b56e61ca0b31ffd7c68544bd2cd477893ba56b6c493ef3f6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617661942, "uuid": "8abc7bb7-2526-4a58-b2c0-4c5e6ed52b65", "comment": "Malware payload", "value": "b07c550880bdfb5e8220a94edb2fa1edae50d7da", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617661942, "uuid": "f13683f2-f023-4b4a-ba9e-381bb0769719", "comment": "Malware payload", "value": "237ba2893a7dd273274afd6752497e5652032a467bbb2a21614a9e19fb7352b5f67d2056f8d0087f152cd6640cf2f1d8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617661942, "uuid": "4146a092-7bf1-45ac-b94a-93ee37a7139c", "value": "EA14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617661942, "uuid": "5e3e20d2-14db-4ebc-bfd4-9d0c0f742a9b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617661942, "uuid": "5002ba91-f709-4333-b937-eca48ab7a313", "value": "3072:LBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:LBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617661942, "uuid": "a6337d5a-b5b8-474c-847d-c376dcc48960", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617661942, "uuid": "191927e4-cb29-4ab6-b637-827ca4776969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617661942, "uuid": "3ab4ac33-a8ca-42c8-aaef-0bdf6bc19e3f", "value": "0c1b5088e52fe8b6b56e61ca0b31ffd7c68544bd2cd477893ba56b6c493ef3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a9adc9-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617644453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644453, "uuid": "af244a60-7c7d-456c-9220-da44ffb66517", "comment": "Malware payload (AgentTesla)", "value": "2ee9dc577080bacad4b0c21531056016", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644453, "uuid": "77a116e6-2fcd-40a3-bf49-24aa3f43eace", "comment": "Malware payload (AgentTesla)", "value": "0c4d69af26ed7b68eb62a79194bb3a1660fd33c9fa1d539bed4e7a1f9d3a3bf8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644453, "uuid": "d9454e57-99e9-4eef-91b3-5518116380bc", "comment": "Malware payload (AgentTesla)", "value": "3c658c79b54b923af9d469d1d62fa41218091e78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644453, "uuid": "090cf0fb-f2eb-4cf2-991a-254b494598a7", "comment": "Malware payload (AgentTesla)", "value": "2d60131e6a629ba7455485950469dd9432613b432b6810a2102710d58436e2d36d8a89a1a0070d7d31e2e3d8e2e3b0e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644453, "uuid": "24fa8c74-224b-466d-865a-00408ffdf535", "value": "17E4336EBA13972B488B5CE107C60CFAF5B11DC262949057DC62749D6FBC023F742AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644453, "uuid": "ed8aa589-8b19-409d-85ec-24f11b084afe", "value": "12288:08wM+1z39VPxrV+zYkugwgxgiNbjxc23Xbig8x+9vRjg3/VhsmK64dUJPWyDLUxo:NwMMz3975+EkLPxgiNbtckOew/PppPVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644453, "uuid": "0ba76006-3467-4f57-b02f-ea86b0a9a742", "value": 710580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644453, "uuid": "fe1de3d7-7f10-4ace-877d-975744aa73be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644453, "uuid": "da9d6aae-637a-4f48-b2e7-97de3817595f", "value": "#ENQ67548820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f0f916-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644250, "uuid": "8eaab895-1239-416b-8a87-27aa416c317b", "comment": "Malware payload (Dridex)", "value": "37b8b82f622e0b73570611ac7b27a995", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644250, "uuid": "bc49514c-543d-4236-bd6c-48c1170d455d", "comment": "Malware payload (Dridex)", "value": "0cf572b8f4f04ddd686f4dcaabc1b303dc89329b55e7b44e2038ede6794eb67d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644250, "uuid": "d46e79ed-377f-4b81-89b6-656a023510a8", "comment": "Malware payload (Dridex)", "value": "d58f57fb862bb912bf515ebdd7d08a82465f7534", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644250, "uuid": "1fffd59d-f261-4019-a59d-a277953790f5", "comment": "Malware payload (Dridex)", "value": "416ecb47282687383bbfdf52f65510352978817cf52beeebc2903d0f5fe88c014a4b739ca88ce9a0f425ded73b3c6f40", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644250, "uuid": "c7d53a5f-d976-415c-8360-ec9621b0dc77", "value": "6714AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644250, "uuid": "17aae523-a92f-4d7b-bb5b-3913e12d7ba0", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644250, "uuid": "c1971fb0-3e73-4391-aecc-84640aa0a013", "value": "3072:xBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:xBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644250, "uuid": "6d41021b-2a43-40e4-9070-40c011332a88", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644250, "uuid": "e1757d06-96c7-4881-bf30-404c9292a30a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644250, "uuid": "db02d5c8-a301-4c2a-ab3d-8806f9d00974", "value": "0cf572b8f4f04ddd686f4dcaabc1b303dc89329b55e7b44e2038ede6794eb67d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb10a67-9640-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649065, "uuid": "b74c25a7-2b82-47a0-90b8-bd7163e6ab7f", "comment": "Malware payload (Dridex)", "value": "22238c3480a997565e3617d1e3241a64", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649065, "uuid": "8b10e8ec-bc61-4a5b-afa1-0f79262b7543", "comment": "Malware payload (Dridex)", "value": "0d2eebf4f17830ee5b46e2346e249c3eb3c6a542b7fd2d9c80e83b225d3ee2b1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649065, "uuid": "61e085a6-5f26-40f8-b31d-10b9919a3433", "comment": "Malware payload (Dridex)", "value": "901d1196b302f70f13d23e0684e978c64310d8f7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649065, "uuid": "3d646a26-b164-45d7-9837-4a4c2ca4a93f", "comment": "Malware payload (Dridex)", "value": "a13087a4b3b5da1891fe90f13138039b7642bf8daa594c3fd92578817ae3476c81dd9ca983918ba476d30452956ff767", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649065, "uuid": "a3bdb47f-582b-496d-a199-10866d2902aa", "value": "3C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649065, "uuid": "83cd9fa0-76ca-42d9-ac76-3168fd52fe83", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649065, "uuid": "a7e62d63-8e6f-4b2d-8642-e50379f1e33b", "value": "3072:ABHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ABHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649065, "uuid": "8e0c91b8-a086-4b64-8404-e8b591210379", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649065, "uuid": "78064d7a-3ae2-4760-849e-0b03a0cebc79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649065, "uuid": "9a1db5e5-0d9d-4dd1-9686-c2946be5a92b", "value": "0d2eebf4f17830ee5b46e2346e249c3eb3c6a542b7fd2d9c80e83b225d3ee2b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae6c146-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "9a54dd66-05ef-4a40-b57e-bbc209fa5c88", "comment": "Malware payload (Dridex)", "value": "be58a8721c02908b225e0a43f78bbbe0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "6c5c27c5-7396-4123-8963-9b6c7c52855c", "comment": "Malware payload (Dridex)", "value": "0d65606176666dd2753e48d616a280813a5b7c3a403b06c6fbf5b0a16d1f1da4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "746c5777-c47f-45a8-ba37-92d7f883a083", "comment": "Malware payload (Dridex)", "value": "d182d352ca16d5e0aad46ecdb3f54fdf349b8309", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646508, "uuid": "f3ea0214-54c7-40ac-9116-4ad78ae77d9f", "comment": "Malware payload (Dridex)", "value": "2dd423ec48bbfa2e7b1b610ad01c5d441a3de64f93ce7ad535f27c7961f3db66c33566615ef313602c25134afefe50ea", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "09fe8cab-5506-4734-9c7a-9aa50252e6f0", "value": "D0149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "bf2016b2-78d0-44d1-a1e5-c5ff617cdee9", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "4c257853-badd-4b75-a9c2-d963b9a941bc", "value": "3072:j6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:jZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646508, "uuid": "9fae8f9b-aa73-4117-a07c-3b636d5baff4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646508, "uuid": "fa7a2241-9f67-470f-9a33-14eb5c2a82a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646508, "uuid": "4d37afbd-9a59-4886-bc2c-786cadd6cbba", "value": "0d65606176666dd2753e48d616a280813a5b7c3a403b06c6fbf5b0a16d1f1da4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91481676-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644237, "uuid": "5db7d72e-bc23-46f4-9f05-0379bef0f3b2", "comment": "Malware payload (Dridex)", "value": "d300d61c8922055c62aeb990910b7479", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644237, "uuid": "52ace987-c5f7-489f-a403-849d40a6a1bc", "comment": "Malware payload (Dridex)", "value": "0d87b8394693b9a7791223ca37999a314c0803f08288ee7ca95bdde3d5aa0bf4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644237, "uuid": "7457ab26-0c1b-4ef5-b732-ef6847b40ab1", "comment": "Malware payload (Dridex)", "value": "68d93a38fad02ba3d2b3dfd4560fa69562924fa7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644237, "uuid": "7abc0534-bf58-41ce-bfad-7d265e78c70a", "comment": "Malware payload (Dridex)", "value": "d7a4a90fe22da04a24e34edc9ad7359e2b27775715429869da37a0c358a878ca0fa5bcaec20ff310eb0e038cc63367cb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644237, "uuid": "e4d75ce0-44e8-492b-b360-0466dc14d556", "value": "B714AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644237, "uuid": "c1e68022-218a-4f32-8865-14a361a7e2fb", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644237, "uuid": "eb4c71aa-b0ff-4467-8622-946eb82705f3", "value": "3072:BBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:BBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644237, "uuid": "23d01ef4-bcec-4bf4-a214-43b081f20572", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644237, "uuid": "669beeaa-a999-4524-b518-26c124badbb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644237, "uuid": "323f920e-e217-4512-94ca-0389990a4dca", "value": "0d87b8394693b9a7791223ca37999a314c0803f08288ee7ca95bdde3d5aa0bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b661f62c-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604357, "uuid": "c34f710b-64b8-4ba9-84cc-bc0fe4b535df", "comment": "Malware payload (AgentTesla)", "value": "47b35f98b9559b5d574dd05b2825a877", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604357, "uuid": "bc6a7285-18e0-4133-b427-79cb795f6497", "comment": "Malware payload (AgentTesla)", "value": "0ea29559587bbf6911d883fc5cd60e72857e8e0ab5422a89df6c778ced3c1ce4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604357, "uuid": "0ef87df0-dc7f-4e8c-a6de-a49e4618bf5d", "comment": "Malware payload (AgentTesla)", "value": "c45269754488814a1ba1f8e7e1810c8dc35d0558", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604357, "uuid": "8cfe1475-cb04-4125-8ac4-81770fe7ab5c", "comment": "Malware payload (AgentTesla)", "value": "b5f7576524da8b375dc15fe637d95a9599b0965b6b95355e6ff57d4e48baa1aa70d57a57055aca87d932b8f4d2abfb0d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604357, "uuid": "23e311d0-96d0-42e3-92ac-7f552ef0bba9", "value": "68B423D6DD3980A76C042FB1977AF5CC1B6932B26FD185423E80CB7E6F2A051DA29358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604357, "uuid": "f8051637-b54b-4eb3-8fc2-22484652125f", "value": "12288:ITBGMoNQNUL9KYrHYxvrktvjC3gtf8ogSw+qDbFxFUYlof:4TdNUL9KEHYluC3gGAw+qDbFPU8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604357, "uuid": "ca396d81-a76c-4cbe-a1b5-7de0fad1c93f", "value": 529584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604357, "uuid": "46dc0757-43bd-4de3-b702-386f5d8288cb", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604357, "uuid": "8139dd87-e578-40f4-84c7-1b3ad141b6d9", "value": "Payment Notification.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec8c39c-95f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614598, "uuid": "0a22c29c-cdd9-4e5f-a5e3-958e8a9dc7da", "comment": "Malware payload", "value": "4007084059e66d1115b6cd6d3489f370", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614598, "uuid": "cf25d19a-49e8-4877-a6c6-45c3da22fb91", "comment": "Malware payload", "value": "0f35f9dc61b9619e670fd1e0fd8e4ffe2ebe77bf5edde65b98a14c5a4070d662", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614598, "uuid": "512f7501-4c31-4da0-9ddd-bc8d4612e2aa", "comment": "Malware payload", "value": "e567a8fff27ae1b0f2f40eed72fead29535c70e5", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614598, "uuid": "569c91ff-188c-4653-8498-796e148cc2c5", "comment": "Malware payload", "value": "b86243e6bda276e473999686f9814010ed65edb132e5cf174549ce2253a2611e4cd7555a0762c7ffd149afc432d7bf99", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614598, "uuid": "58f1c6c0-675d-4eab-a9c8-d69a62687a53", "value": "ED663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF63AC5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614598, "uuid": "71bca1e9-d1c8-4224-8d66-e611e6220f85", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614598, "uuid": "09b15764-0d53-48ad-a2d7-8d1ed4db5d68", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazb:kfauN/HYOSIT/EVF9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614598, "uuid": "daf09cce-2efa-4c5f-867d-6dbd27779f36", "value": 6967095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614598, "uuid": "c6b5dbf1-25f7-4f40-a2a0-daa1ece552a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614598, "uuid": "1093837d-375f-4aa7-8b41-8e0c80608cb3", "value": "0f35f9dc61b9619e670fd1e0fd8e4ffe2ebe77bf5edde65b98a14c5a4070d662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141acc6d-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617644457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644457, "uuid": "47dd5812-e62a-41fc-b052-3d3048be98ec", "comment": "Malware payload (AgentTesla)", "value": "6bd34f69fe1e86cab1f94b31ba5438c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644457, "uuid": "090f8888-808e-48a5-8a80-51001c9cfc4e", "comment": "Malware payload (AgentTesla)", "value": "10a2252fa27a963566e6c86ddf0f2e0ce082fd4b5f939f53fc011303b11e9420", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644457, "uuid": "d5ace7a6-db53-429d-bef0-20140eba1136", "comment": "Malware payload (AgentTesla)", "value": "571ec0d250ce7deffcaa8b213c44335fbb70258f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644457, "uuid": "f3ec94ab-b7f0-49c8-a616-c83b48592d33", "comment": "Malware payload (AgentTesla)", "value": "62989f70d9f15652bfb4541ff8ff3d36b27e8d3a7d5feabeda8d4d504d1598e59af8dffed094176bd696de344485cd6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644457, "uuid": "f8534e9f-6083-4e5c-939c-f11fbb014ed6", "value": "B535F0207396D606D4692AF5C992C4F283B1FDD82913D76B29857ECB347930C9EC1EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644457, "uuid": "c6c834e3-3be3-4516-b265-2d5d34a80157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644457, "uuid": "97af81ad-a476-4a17-b4ea-817e02225414", "value": "24576:yt7KYkVUZ393x+AkntxAENRvWgSu61N7hPHDLlxahY:yt2VVg9BXktxAE215hPjLahY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644457, "uuid": "b83a46b5-5280-486a-a298-db2b19c067ce", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644457, "uuid": "3751c088-59d7-42dd-b85a-15fb7dffca1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644457, "uuid": "a071c27e-6f18-45be-a0fb-33ff43177cdd", "value": "#ENQ67548820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8983cf-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604263, "uuid": "09986a8a-761c-4273-b114-0278d2b7027d", "comment": "Malware payload (AgentTesla)", "value": "b7a9f6dbd9f853af91f2efe391e8be04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604263, "uuid": "ff7a93db-c463-481f-a8ef-ea9a4e4a79e6", "comment": "Malware payload (AgentTesla)", "value": "1103c8bce611da075ffa20426295a4f84b2409378c774dc32ca9edf968cd8a29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604263, "uuid": "93be5a32-aae6-4974-ac7f-108a0d46808b", "comment": "Malware payload (AgentTesla)", "value": "e1b8db8001856058c19c2725027b25992fbed0e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604263, "uuid": "6f9d2c49-b420-4648-8582-3b2117e7020f", "comment": "Malware payload (AgentTesla)", "value": "c0f7ba82d8a0a697b14114bd4d56e7add390babf777580a9d8ef423e8441548622f1c8744ecb628d920a67a33cb8a759", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604263, "uuid": "890d4d05-8480-4c12-8b7f-8644750f36dc", "value": "7FE209F856DD9CEEC8B78F3908F104258674C6D06A72DF2F1C4AC8A064167DA27B961F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604263, "uuid": "c111be71-26b7-454a-9447-9bcd646e4e1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604263, "uuid": "a379bdd2-3eb1-4b21-83da-25f25cb5bb3d", "value": "768:idjM22eVe67gVFUPodS6zvVZhyDnLO9SxUAO/QeA3z8qmQ1rFa8/fwr8SXBQfymi:W7xVp7gVFUPodS6zvVZhyDnLO9SxUAOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604263, "uuid": "08f2f925-88e8-40a3-b8c1-2428388724bf", "value": 32312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604263, "uuid": "83c5ca15-d1c2-47b0-96b3-8e45ae2bed8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604263, "uuid": "3bf85b95-d616-4547-afa0-8d5bbb7aa705", "value": "MV HONGSHENG 7 PDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784ee98a-965f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617662234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662234, "uuid": "fc219839-5618-48d1-b939-87c89e94083b", "comment": "Malware payload", "value": "c27cc96c4037581aa84e0d088ec8712d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662234, "uuid": "1ab5c6e2-5ad3-49c9-8a9c-a12109322a7d", "comment": "Malware payload", "value": "1109153987a95b2695fcae4d8899d60eec06874b20bd53c02ad238ebedc80911", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662234, "uuid": "b0d7f23d-9ec6-4218-805e-ccc7aca452e2", "comment": "Malware payload", "value": "485506b1f66b82bba5dac23b262c5558c2ad521f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662234, "uuid": "a24bd0e7-aa5a-4ace-bfda-f87743c67624", "comment": "Malware payload", "value": "4475a71a3ae74ab59f3e52677b1e42106fac1364c05c100663c1e671fafbba78a6d3edb5184ae90ba88c8be0da3b40a8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662234, "uuid": "4898d682-a429-4739-9df1-c903294631d1", "value": "0E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662234, "uuid": "90fb88c2-afbf-4172-9d8a-fe6809db257a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662234, "uuid": "363908a9-91c0-4c63-a1c2-b75e6875c080", "value": "3072:4BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:4BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617662234, "uuid": "6e473afe-6e8c-4224-b20b-e8f7cac9b9aa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617662234, "uuid": "1701c20d-8c90-4d84-b1cb-d4e9122bfec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662234, "uuid": "c91a1ba7-66ed-4485-afa9-ddf3f39cc6e6", "value": "1109153987a95b2695fcae4d8899d60eec06874b20bd53c02ad238ebedc80911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d611701-95be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617592960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592960, "uuid": "00bcbd74-88b9-4578-9cfa-253fefd0d0c5", "comment": "Malware payload (Dridex)", "value": "4b1d17defa1eecb27c3d0e667189ce8b", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592960, "uuid": "fc12420f-0fbc-40e9-8691-0f0cfe9312a5", "comment": "Malware payload (Dridex)", "value": "1258a7005a89dcd206a1c34165d086e51b5c4d6b58dfd797be8633200e42a1c8", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592960, "uuid": "583fa781-d938-4b1d-aa0b-ffd7d163a9d6", "comment": "Malware payload (Dridex)", "value": "11c504ef049fcc8e0a154f849fd29a050d7f5b51", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592960, "uuid": "7794adb8-e44c-4b08-b609-7e3b8c2bef5b", "comment": "Malware payload (Dridex)", "value": "36253b9235fe080e3a4f59a0bf26283d0007944c2f703e2e78bb1b374928a222bc32ee9b03fb5df3a583c7c9b893719b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592960, "uuid": "c7e11daa-a8a9-4a26-8c35-54d7ff5b190a", "value": "4E058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592960, "uuid": "fb9a99be-bbe6-4f45-8ed6-82588b36e238", "value": "523b18dc1c7a7f2ecc8f20b6295beddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592960, "uuid": "d86aae63-e19a-459c-ad5e-777b42a3c43a", "value": "12288:HbqkjZV1Vu8MpJYosZUmc16RWdrpo8+FFcLxT8HoxmhsDJteMKT281MOU7qOkQR1:HbqkjZVqxYjxoArwQormMKNiOUFkK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617592960, "uuid": "f0e1df4e-c05e-4462-89c7-58d6c0819fa5", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617592960, "uuid": "3d60b453-b809-4ccf-8d02-50064fa28adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592960, "uuid": "f1d1387b-85e8-4f6d-b506-bd48cfb1d51f", "value": "1258a7005a89dcd206a1c34165d086e51b5c4d6b58dfd797be8633200e42a1c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f124437b-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "96366533-3538-4e1c-a841-7a92896d8292", "comment": "Malware payload (Dridex)", "value": "4ae32e209b4c0edd67172bd01f1bb6eb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "10420d3a-5d33-4f7f-8852-15b5641898de", "comment": "Malware payload (Dridex)", "value": "125dc0bd2e7e85a8f80b2f1832a8077075ed0b65240dd43a992b96359ad64326", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "7d00d99f-eb26-41f9-863a-8a613fcd51ea", "comment": "Malware payload (Dridex)", "value": "4eb4e41869d06560b144539a22515a024d6db86e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "dd1a6ff6-a115-4c92-89ff-8ae903d37cd0", "comment": "Malware payload (Dridex)", "value": "8ef4c2a8e507984a2d6e0dccabd9544be5d181924d4b73266d8da8eaf9e0a0bfc6fb7b4f88ddec3b2d4fd42b34631289", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "97483628-8443-4b5f-8f32-1ea0f806134c", "value": "5D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "1cb7835c-11eb-4358-aeb7-8651e96645a4", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "ab05d49a-24b6-43d4-8966-9cc278f69f80", "value": "3072:cBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:cBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647834, "uuid": "91f5ec0b-9c01-454a-8087-a869e0e546ef", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647834, "uuid": "87a28e34-ce2b-444c-b284-4490ed36a293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "c67b80a3-9b6c-463b-90c7-df4fba10aac7", "value": "125dc0bd2e7e85a8f80b2f1832a8077075ed0b65240dd43a992b96359ad64326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3badf254-963f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617648389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648389, "uuid": "56baab2a-d8f3-4dff-9de0-aebfea2da94e", "comment": "Malware payload (Dridex)", "value": "16d91e9b88dad4135b39478ac4fdacff", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648389, "uuid": "dfc85303-cca6-435a-9aa0-0938df0b068b", "comment": "Malware payload (Dridex)", "value": "128b3c8b1840faa317234d0ebb3d02770e16c7b761b9f1e1f2b3443d2200187e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648389, "uuid": "c00e8d7e-b832-47d2-b8fc-bc6526a9bf12", "comment": "Malware payload (Dridex)", "value": "1951fc200b502df6bd212734c76fd759bfa12192", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648389, "uuid": "3e6b0271-5015-4c67-af51-e09351ad0658", "comment": "Malware payload (Dridex)", "value": "abc902b7dfb3436d3c2a513e4fb691ae27b054d087ea88c542ba80c4257d1f8575f12aab4183294234ae6269ecae3540", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648389, "uuid": "c1662622-8b01-421e-9029-f2efcbd9b531", "value": "D314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648389, "uuid": "aa2386f2-179e-49a3-a6e4-222ddf4ff6fa", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648389, "uuid": "8a5587d7-edd0-4ba5-883b-18300828f50d", "value": "3072:KBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:KBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617648389, "uuid": "4e0fbd2c-ba34-466a-b8d8-72e0521ef184", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617648389, "uuid": "b969fd7a-9b85-4f93-bdd9-9b309e2e0369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648389, "uuid": "f101f049-2dc0-4955-97b3-ec4c35a1eb13", "value": "128b3c8b1840faa317234d0ebb3d02770e16c7b761b9f1e1f2b3443d2200187e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a646c1-9626-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617637809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637809, "uuid": "154842e0-45b3-4fea-a462-ecd68b3896fd", "comment": "Malware payload (IcedID)", "value": "ff850d5378ad9ecc1953cfe104b5298d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637809, "uuid": "b814bea3-9cac-4fac-9950-33bc3c516a2c", "comment": "Malware payload (IcedID)", "value": "12beb51eff2c95616d1ee91830048c87715953a39699f3167aaa8956aa44ef21", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637809, "uuid": "dbaf3f12-ed75-463b-b3e3-84cf3681903c", "comment": "Malware payload (IcedID)", "value": "1126cc3a0767865c552343a70aa7e1237d8d9cb4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637809, "uuid": "04729cff-c030-4988-95e3-fc44c3ab29fd", "comment": "Malware payload (IcedID)", "value": "1b40f332a916bd4a33fc80f59b13bdd13d0a5c03d66765b7885342a86dcb37900a9adbddd2057508d85a6274692e9972", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637809, "uuid": "6608173c-c87c-4de3-8433-43c3bfa45200", "value": "CA24E79B588B64E3D63FB170F384417934507EE2015DABF7A594830AE39BFE19A1B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637809, "uuid": "b45b01d8-c9d3-4f0f-8193-7aa58569e0f1", "value": "28b031d0558b8e7db218ee60c7804970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637809, "uuid": "e9eecfba-8389-40ac-b61b-75736e76bf07", "value": "1536:6j2b0yzmq83AGHuU2rs3VN2farGJti7VkJtvTU9Lkv9anrQmpfQo62g5mTCIscmW:6j22OU2rbKEtsIzF+ubH9RAbiZE4WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617637809, "uuid": "f0684360-b000-4619-949e-087a4a4e0216", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617637809, "uuid": "343b32c3-d0f7-4665-860e-d51506e18699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637809, "uuid": "8d526fe6-e9e7-4e61-ad79-f8fba33d2429", "value": "44285,5327891204.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d7fb3b-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644299, "uuid": "ba41479b-2d57-4dc2-922f-ab5a47ac15d0", "comment": "Malware payload (Dridex)", "value": "9004cafd2329ac98dfcd00d89b1d7174", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644299, "uuid": "421055ef-6d65-48cb-9d34-615b82fd1a9d", "comment": "Malware payload (Dridex)", "value": "12c3a82ee0ef8c4a075b85b3384c0d3361df9adb4239edf9289686e880ce6cb7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644299, "uuid": "9d944135-e534-4d3d-a007-bfad4e71107c", "comment": "Malware payload (Dridex)", "value": "7e7c2fed4a4b1e5af93782e22576a554db5cb79b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644299, "uuid": "c634ba18-14bf-46d7-8147-3aa4d4b752af", "comment": "Malware payload (Dridex)", "value": "714cb5106f1e2cd1635f448650615048bebaf0e73bf76c7fe1c29fece51fc13cbe25f59070003932c662b5ceadf2322b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644299, "uuid": "32688680-7c78-4d04-8d98-66e743aa2c2e", "value": "2E14AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644299, "uuid": "f1266c4e-0742-4380-bf68-6c83c4d4931a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644299, "uuid": "a14a6216-80d5-4f2e-a649-534daf964115", "value": "3072:qBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:qBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644299, "uuid": "6251ec77-3779-4d82-99d3-dcb4b88131ea", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644299, "uuid": "f36092d9-1e6f-4082-b848-2a7386077b3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644299, "uuid": "cfa6dec5-5e18-4f8c-8f67-68e590484a0e", "value": "12c3a82ee0ef8c4a075b85b3384c0d3361df9adb4239edf9289686e880ce6cb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9460e777-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "2b4ce254-ee17-456a-bc7c-1bde25c50cf6", "comment": "Malware payload (Dridex)", "value": "c335689ec042757f98c89b4d619b48cc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "684eedc7-bac2-4230-a036-9bf7a91d0ecd", "comment": "Malware payload (Dridex)", "value": "131f2b508640ceb7246fcbc4fabaa18323bf7506fcafb40ed1e07bbccc936f7c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "cc53d0d1-fff7-4724-8af9-100c6c433cc8", "comment": "Malware payload (Dridex)", "value": "154a01fdab8504281d2516c5f08050a504e3cb6a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "8792438a-ab03-4dd9-87a7-3a6e1b124ea3", "comment": "Malware payload (Dridex)", "value": "ec3a476a6eca7f0c38492415a8efde7a02569f1d048453af52c69762af057bb3c2186c6b5d7cc0f2b9567aa7b7ed6e88", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "49e552b4-c9ab-4400-b23d-cfd0277e62db", "value": "5914AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "dd91a28b-40af-44c2-b897-77b9d02ab758", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "d7b46835-844a-475b-ab5e-825e1733463e", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644243, "uuid": "de5b8d4e-14ef-4be5-907f-49ff1e6b14e5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644243, "uuid": "69f6e2bd-fd3c-420f-bd81-91db2cb6cfdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "76e36835-a6ba-422f-9be1-e54fea386257", "value": "131f2b508640ceb7246fcbc4fabaa18323bf7506fcafb40ed1e07bbccc936f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce9c8de-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650324, "uuid": "a7639121-9563-40c6-975d-cbc4c783c4ae", "comment": "Malware payload (Dridex)", "value": "ae193ee4cb21fcc458d56f3b14fc00f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650324, "uuid": "30cea2ab-9955-4b58-9dd8-8831bb25f2ca", "comment": "Malware payload (Dridex)", "value": "134a053b0e52b62f0583e95b5b0be49dc6a533c4a61e7916ec45e4c22aa6a0d1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650324, "uuid": "0fa0ca95-28d0-4f33-822a-7803fa4719c2", "comment": "Malware payload (Dridex)", "value": "3db1219f89ade3292f34d8cfa4b59cd23e79cda8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650324, "uuid": "db113ec2-e6f9-4290-aba2-bd340fe3e7d7", "comment": "Malware payload (Dridex)", "value": "e514b9356137262f528ab84a1d7c384d80530ef914592f7599725c24d429fd38306f14fba0b98b97886baed441d380b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650324, "uuid": "d66ca02c-b570-428d-aebf-24972e1b6b6d", "value": "BE72B54DCB47D251DBF098BB60AFF4F045616821D072D662AB65A01EA3F7CD306A793C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650324, "uuid": "0fff0d9f-a3bd-49fe-ad59-6161a99f91a9", "value": "192:EY8QLlhADwZIOUwwiy5JQyf69vij7AMMvU6NcaJdq2vxQ:EYLLvA6IOfwigJXf696j7uc6Xq2pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650324, "uuid": "7ab68d34-b778-4b40-8d04-6a508efb80f7", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650324, "uuid": "f99f7e91-b545-488f-83f9-b2f0d3ad62ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650324, "uuid": "b7cf17aa-661d-44d9-a2a3-d9103f0e6dfe", "value": "ae193ee4cb21fcc458d56f3b14fc00f5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080acd33-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649591, "uuid": "0517582a-3fa7-459d-8804-12b12d9c98fa", "comment": "Malware payload (Dridex)", "value": "1fd824bcbb003a8c24487fb30f9d5c3c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649591, "uuid": "15cddb93-1ef5-4c18-8cb4-3ade7a39517c", "comment": "Malware payload (Dridex)", "value": "14690ffcbaab694fd3e226420fb41cb24f4e305a564e03c9ffdefe29148571de", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649591, "uuid": "93131eb0-bf21-4e1f-9451-fb234d42893d", "comment": "Malware payload (Dridex)", "value": "96df8fea6e806e96d58d2cf6f79932c33f4b4cf9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649591, "uuid": "e36bf0c4-612f-4442-b1f0-291a6f734084", "comment": "Malware payload (Dridex)", "value": "de46fd9e9a3d8ffd16cbf989ad6db0434e69250c0a9e1acb8ae066070371edd4162c30d5c7da6eb68e8f287e190b7ee8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649591, "uuid": "adf03e1c-e3de-4e3e-bf23-e94408df6b46", "value": "5114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649591, "uuid": "6a3b05f6-e637-4915-837e-fb2b36b2f822", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649591, "uuid": "5f4a1b51-0c2c-4d4d-910a-a4fb6aa7fed5", "value": "3072:mBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:mBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649591, "uuid": "2c1d0106-b91b-4270-940c-653d2694c63c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649591, "uuid": "92b28d0a-ae1a-42c7-9d97-99086194018e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649591, "uuid": "bbebe3b8-92a7-457a-b106-cff74c111e36", "value": "14690ffcbaab694fd3e226420fb41cb24f4e305a564e03c9ffdefe29148571de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc2d979-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614944, "uuid": "7095a46d-4554-4191-a3cc-d092cfa22efd", "comment": "Malware payload", "value": "d4f9f334eff38c5a01a03a684aeb7f92", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614944, "uuid": "49edf1d8-eedf-49d7-9f53-5cd5874406e7", "comment": "Malware payload", "value": "14f7650cf7f4846aa683f0cee500d8957ebdbb85b59c6e45b7c56a66ebfd8122", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614944, "uuid": "1b781ab5-ebce-4bae-9806-6bfa6d1af62b", "comment": "Malware payload", "value": "def5a3b4795dbe144a5b610b449387c11c071311", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614944, "uuid": "70ab7bb9-9826-42dc-bbe4-711e895e8165", "comment": "Malware payload", "value": "45880823d8882a685c4b8b070177d591e9611122ddb6d67cf477bfb08f7b33d6efc482c4cc208c5e1048fd8f94ae2f9e", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614944, "uuid": "72704e28-a555-4095-9a19-be5811f498a9", "value": "20863381F0A28CF7F8FA15362AB2D13A3ABAF513074545EF139C16937925391A77C62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614944, "uuid": "8de87cc0-546a-4f20-9c69-ca37453b9129", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614944, "uuid": "0f13e7c1-1d41-4682-90a8-91a124b98824", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazhXrIQQtIkz:kfauN/HYOSIT/EVF9pTQth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614944, "uuid": "44704d78-9783-4493-ae1c-50b07cfbf091", "value": 8230498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614944, "uuid": "b2cf0cc0-3fde-4663-84f0-3d513eca8310", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614944, "uuid": "f3f4c5b7-afff-4958-94eb-ac34c07e37b9", "value": "14f7650cf7f4846aa683f0cee500d8957ebdbb85b59c6e45b7c56a66ebfd8122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420d1653-9645-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "d993aebd-57dd-4dba-be24-854700913a4e", "comment": "Malware payload (Dridex)", "value": "aea8ee0f815745f6c6b61f128166cdf7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "c480fc7c-87d1-4cf0-9715-c5899ce6f18e", "comment": "Malware payload (Dridex)", "value": "15d856ed3592b030b9723070231afe1f29ad9b2fd9d95c70053a5d55ff9983b8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "7a648ad3-7021-45eb-9ec0-bb4bc9adcb07", "comment": "Malware payload (Dridex)", "value": "bb721f2e77e11373116082f5bc66c539d6acf737", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "fa7454f0-7957-4f76-95a7-f23bc3e8fbe3", "comment": "Malware payload (Dridex)", "value": "7feb10042772bdc8c10f111b843f84bba69258ac07af1e6a0e815fc478d84a3510a200a423e27275054c61535ba10f24", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "89937e03-7fae-4bee-be37-3d4cd20da871", "value": "4B14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "a822b54f-acf3-4cc3-bb48-5d0aa4345a14", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "1ea61d9d-e827-41bc-9ffc-4157616567a2", "value": "3072:5BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:5BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650976, "uuid": "b3b5fb7b-5cb7-4cd1-8ac3-c5be9b203cd4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650976, "uuid": "d961476b-0c3d-4c0a-8fbc-8731364252ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "92e40747-752d-47e7-b5b2-26be9e1b8826", "value": "15d856ed3592b030b9723070231afe1f29ad9b2fd9d95c70053a5d55ff9983b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d067261b-9659-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617659805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659805, "uuid": "b26fd1a3-c013-4758-ac0a-a7b09f659884", "comment": "Malware payload", "value": "4c1c06bab4d3d43f7ead6632a0ac8ee8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659805, "uuid": "a0f340c3-533d-4f7e-88b0-79796076eab5", "comment": "Malware payload", "value": "173f9583753d7e1d7c3729663d269e42a696c791c56af28243206889b919648e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659805, "uuid": "d2431cc5-7f93-4a94-bbe6-3439bd5389e9", "comment": "Malware payload", "value": "125311fb765d266250d20b6a616bdccf984b0fd6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659805, "uuid": "2ff8e286-1a01-41b2-b058-3ee87df7a095", "comment": "Malware payload", "value": "7685821039567f1b68bf8ac4d0bdc67e353f5d4faa82cd0f47d1cee43fe115365a3397de3906ee6e7da4e77b6598ccc0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659805, "uuid": "d0cfa63a-a465-4fba-93fd-557a0a914c4b", "value": "0714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659805, "uuid": "5b4ca730-f4c1-413b-b85c-1a50619278e4", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659805, "uuid": "a035767a-b4d9-4bc9-86b7-c20326812a8c", "value": "3072:jBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:jBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617659805, "uuid": "e64f8027-48b5-4bb3-8efd-f68372b03938", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617659805, "uuid": "8d2fd421-2d35-4104-9a64-c86ee18bf23c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659805, "uuid": "d240303c-e2a4-4bab-895c-e0ba1ca2d813", "value": "173f9583753d7e1d7c3729663d269e42a696c791c56af28243206889b919648e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9fd109-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604392, "uuid": "91c67df1-0e55-4176-bb77-c07fbe550d8a", "comment": "Malware payload (AgentTesla)", "value": "cfce26bea3f5a0d336033bebe1ff276d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604392, "uuid": "7444fb30-d923-4b08-b2e6-1a79b889e536", "comment": "Malware payload (AgentTesla)", "value": "1974eb0632e98cc3277adaa0074d95fe33602c751a27032d93ae03b09dd9e77d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604392, "uuid": "0a288770-2f94-488d-b492-befacfe1808a", "comment": "Malware payload (AgentTesla)", "value": "b682c752ad675e2d5bc03244469e2940258dbf61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604392, "uuid": "c41a94b1-0ef1-49eb-a566-6b9937ac8ea7", "comment": "Malware payload (AgentTesla)", "value": "db6305c815438d965e071717f3c29b9325cee4eded0837a3473917a404e88bc5f0361c58d14321482426c00318dd4a11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604392, "uuid": "220ad78f-290c-413f-ac49-b7bdbcc8230e", "value": "19358D2EE1138558CEF4BDBD14F683B54EA05E22681FE7CA63983AB906F3395790D341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604392, "uuid": "77fbfd83-99ab-4efb-a4fa-f8803d190718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604392, "uuid": "8b7fc882-a06f-4555-a04e-83470586ddbd", "value": "12288:IIbupuko518at0uG9kFU+bmlJCpTUc8o518atTXqd8JoKLUItvRUUVGEmOi/JP:Jko5h0d9Z+biJm8o5hsotRnkJ/JP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604392, "uuid": "dc010f0a-8a3a-4843-8b58-cc37565fa9c3", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604392, "uuid": "87d8494d-48e5-4a9c-b17a-816223fcca45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604392, "uuid": "be3a8065-0b5a-49eb-bab9-536da629500e", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b265b5-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604386, "uuid": "ef536b7b-1ab4-4116-8713-3561cd10b69c", "comment": "Malware payload (AgentTesla)", "value": "653008695fd73646e87f9756c5d922af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604386, "uuid": "dc85b294-4ea0-4e67-821d-ab853b4e16d4", "comment": "Malware payload (AgentTesla)", "value": "198c41255ba24b553540eecc84e89e0a9c367798c2c980c9e871e30f32bb9db4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604386, "uuid": "77823ce9-9701-4906-ab28-28d9fda900cb", "comment": "Malware payload (AgentTesla)", "value": "41ef847d19167ef61b3b5eae29fcc5bffefa2156", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604386, "uuid": "aa865fe5-a995-4153-9cdb-ca8c990bb6e8", "comment": "Malware payload (AgentTesla)", "value": "8a734ba764c084f3953e3e8caf29069a8a7b223fd0516941fd2d1977c97f521c39e559bdcb94735f50ff1fc94a918806", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604386, "uuid": "df883612-f9b3-44c9-bd7a-6ae0b541956f", "value": "9C559CD1ED43D244D85A1AF0D42FC25D5662FF082F2DED09698CF3081A72A9ECAD96F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604386, "uuid": "66591da4-626a-4c39-b0c9-9f6e99400477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604386, "uuid": "da58317e-c90f-43f7-baca-03b845f99cbf", "value": "12288:Ta8169VIVvHn9dY8rD7b6s5FT/AOwdSf/aQkeDAnTMBfEcyiYyjcaWVT5rzjxJ+e:d16IVvHnbYQPJFLAyfkHQCqjcaWVzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604386, "uuid": "3b65dc4b-99ae-4c89-b96b-06b4db998f49", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604386, "uuid": "1d98df99-73e5-4cc6-9c69-851e7b3e11a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604386, "uuid": "cc11def7-d60d-41af-8dd7-87c1f65d4ab3", "value": "RFQ#EX50GO_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7764893-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649858, "uuid": "abc76292-3d8c-4db4-856b-b2e12e73ae8b", "comment": "Malware payload (Dridex)", "value": "6579a37db8979e19dbf1a32c86ae7595", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649858, "uuid": "f287a2c7-1f80-4215-bf09-ebde301fbae3", "comment": "Malware payload (Dridex)", "value": "19af5683bf4936ab5fa2bb8547ff5b35e3ce7da047a5335d6f384fd34627fddd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649858, "uuid": "fc79298f-8ca8-40c6-9621-90e819301530", "comment": "Malware payload (Dridex)", "value": "124944aa9bd543244dd77d35168dc1f9e2d563c9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649858, "uuid": "e4cbbcbb-965d-4470-84dd-a596732f91fc", "comment": "Malware payload (Dridex)", "value": "08e3a87376fe5b3ab87189ef7adfd2b72d945fc135b6c6f97c9ca09d15e1a739912eecbc421ee5bc62c05f9dd90dbbe1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649858, "uuid": "57e1c261-b337-4f11-84ff-b3757270b557", "value": "4614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649858, "uuid": "6dc72833-7fdf-4fb6-b61d-c0f6aa2e7ade", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649858, "uuid": "af20b710-c89e-49d3-98b3-eea055e112ee", "value": "3072:VBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:VBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649858, "uuid": "05e31784-e53d-420d-ae43-69b17c1e4552", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649858, "uuid": "7b8fc61b-85a5-4e81-8f25-39fb9c2615e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649858, "uuid": "d28c0af0-b2ea-4e6e-befb-d99c374ef75a", "value": "19af5683bf4936ab5fa2bb8547ff5b35e3ce7da047a5335d6f384fd34627fddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4042d3d3-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617650115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650115, "uuid": "e9aa2e8d-376b-42d2-9576-288b12138d0e", "comment": "Malware payload (RedLineStealer)", "value": "b36447c6987dda4dce4ed3c821acf9bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650115, "uuid": "c4e2128f-d35f-4e4b-8861-dc06fe323110", "comment": "Malware payload (RedLineStealer)", "value": "19ce4f024d418759d4a5f9240e2f636ff66ce6f63964b3685013bde36487615c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650115, "uuid": "ac33a8d3-533c-4476-97f6-a4824e60b43c", "comment": "Malware payload (RedLineStealer)", "value": "89331d26ffaf33e207460d890542132e7b941897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650115, "uuid": "3bd569a9-971a-4e10-8e4f-1f46eb3608dd", "comment": "Malware payload (RedLineStealer)", "value": "3d113adb4f30fd2ef5ef489329e5648f97fc83fd60d8d219f30abc160bbfd8b7dc8548442ad55735ece3a381bdb6bc65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650115, "uuid": "a2eedb8c-7a6d-41d0-aa18-4fb79398a9bb", "value": "9E356AD57D88ADC0D476F2F0A049876207A21E44E98886FC4DF878B985750A7FD9B0BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650115, "uuid": "99d470e2-5dbb-4d7f-bb9c-984a07f5c239", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650115, "uuid": "d59d60f9-96e2-4a50-86a7-b095682bb968", "value": "24576:qNHVXfpBhEStCFJpw1ATK2RMwwAyymblSSR0o6y2jXg:y/p4K2yw5glSSR0o6y20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650115, "uuid": "83553061-6853-4017-b4b3-ff8c2e3b0c5d", "value": 1150392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650115, "uuid": "7064ad51-4c27-4de0-8abd-d2775279e58b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650115, "uuid": "a351e6e3-f600-4d58-aefb-bb0b01511af0", "value": "b36447c6987dda4dce4ed3c821acf9bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffc6927-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1617643618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643618, "uuid": "9dd327b7-f04f-4648-9c09-7d946fafb41b", "comment": "Malware payload (LimeRAT)", "value": "1dc0e9e1674d12fbc60958f26c3aead3", "object_relation": "md5", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643618, "uuid": "d3f9274b-d2da-40e6-9382-c9d6a1ecdd8e", "comment": "Malware payload (LimeRAT)", "value": "19d3a789c15a0f2a76b14d368579af41cb906b52ee084bfbea68ab27653eb57c", "object_relation": "sha256", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643618, "uuid": "8e038bec-b24a-4954-99e6-ac16a82053d3", "comment": "Malware payload (LimeRAT)", "value": "63bb1e18a18f7df94dcbc9cf003c1d0bf9cc21c2", "object_relation": "sha1", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643618, "uuid": "9919ea23-0627-4264-bbc4-e79e4a9530ae", "comment": "Malware payload (LimeRAT)", "value": "5ac5be85b5d84f5865bcee33ae35cd434d6ebf9c5ccd0fc706f6a4fc3f6b615d466fb92a1c419a9f0c767cb91815f080", "object_relation": "sha3-384", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643618, "uuid": "075754c0-4b90-4735-8668-03f194d5046d", "value": "C2B533FA05D59D8764A236BE0B7491AAC07D0F1A98348BB187E50AD13D8C1DABB3F417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643618, "uuid": "2eba4521-771c-4c90-84c4-cfc6d3e83501", "value": "49152:liM7SbF6nX3Wp1JBbLOAz7yctxNtDPVL0Cv2dY0sMk9srT+27:lV7SbF6nHWpFbJz7RjLOdSFEyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643618, "uuid": "99876df6-9d53-4f4e-9d1b-da51d47aa592", "value": 2324424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643618, "uuid": "2f5ccf01-a394-4947-b801-25aa97c7cf79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643618, "uuid": "76cab84b-080b-40b5-a7b7-cb14a8da40c1", "value": "appraisal document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281a3766-95da-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617604977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604977, "uuid": "dc1762ac-696d-418e-ae63-4079c79421bb", "comment": "Malware payload (ArkeiStealer)", "value": "777fecb465b8bda92808c337de0e5020", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604977, "uuid": "1dca37a9-3f3d-4a37-ab76-6e37502c14d4", "comment": "Malware payload (ArkeiStealer)", "value": "1a7fde0d24bfe42ec7fdf49f488eb1a7f8e1b649d1a4c00714cb10c6c8f18fff", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604977, "uuid": "a247b3eb-ba1b-49b7-8090-9bb66f84aa16", "comment": "Malware payload (ArkeiStealer)", "value": "406932686b467ae1dc51452ee1efc511cc190701", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604977, "uuid": "30cfd5c1-3b67-43f3-a3a7-4053e09c68b9", "comment": "Malware payload (ArkeiStealer)", "value": "5611858a2f1625e99659bb6170090ee173876c8b17992d2e4ecf0af020226f06714d09bf6e1a37e5b29f2a3d1ed646c3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604977, "uuid": "dd542b27-7048-49a7-9768-c1bd4e2dd27d", "value": "A1060A7A3D6F3204F1B7102E958B4D26AF8D71162B69D02E247EA71DFB970648F43E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604977, "uuid": "9997991d-16c1-4658-8980-9f9d14f5a378", "value": "6144:FcYg1i+pOQSuEE04jnY/PZL4/4byILPAL/zFQZWx9JU4Ln5iT+xlGgZQwRbIewIL:FcYg1iYEE04jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604977, "uuid": "1f003839-5098-4887-9319-b6f87eddd759", "value": 3659306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604977, "uuid": "c3ac8d5a-43f1-47d5-8740-c7e4d5b4b2b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604977, "uuid": "3b960c8b-44d5-41a3-bed7-5390b8788ff4", "value": "777fecb465b8bda92808c337de0e5020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf491710-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644315, "uuid": "4f87e803-d62f-4cf1-9505-f2946e3cf588", "comment": "Malware payload (Dridex)", "value": "4110c56dd8b6002160a9819b68225638", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644315, "uuid": "8a6b8876-a88e-4bc0-88dc-dcaa92bb673f", "comment": "Malware payload (Dridex)", "value": "1b70380077c91adb4924e89b10fca0ad59f9f736c85c3f3f778a39cae947a430", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644315, "uuid": "c8c05806-0901-40b2-8367-f21577d09c26", "comment": "Malware payload (Dridex)", "value": "da8216cea4de56e2ff665191ca789970d22ddb1f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644315, "uuid": "cb6e2cc8-e5f4-4ada-93e0-dddf568c99c1", "comment": "Malware payload (Dridex)", "value": "5b09b4c6b9bdfd37ddaa04a3a1bb60ca75be4683f3cc7443690ad01f77f6818b42c8c5f727ebb165236085546567392b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644315, "uuid": "e57cd379-533d-4f3d-960b-455067908c55", "value": "6E14AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644315, "uuid": "91c616a1-e390-428c-9b8a-65ed5ec10468", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644315, "uuid": "a38b0ec3-dba4-4938-910d-06b4f3feab8f", "value": "3072:vBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:vBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644315, "uuid": "e642e7e3-2a99-40c7-88c3-5cc6985fbcec", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644315, "uuid": "f4c31ef4-c6d9-4f7d-b978-3257c7522f93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644315, "uuid": "94db37b2-2940-4920-9589-bc202e3e9509", "value": "1b70380077c91adb4924e89b10fca0ad59f9f736c85c3f3f778a39cae947a430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532f84f5-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647999, "uuid": "aefeafbe-1b10-4453-a914-a98bcc6077c1", "comment": "Malware payload (Dridex)", "value": "5ce1105d5871aad365f9701108ca3852", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647999, "uuid": "37f78f6a-1b70-4ad5-b224-714899213c6f", "comment": "Malware payload (Dridex)", "value": "1bbbd7da0174b4c8bb9ad320409ebdc93c0970afc3e2c9635b91625353aac052", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647999, "uuid": "00b60b78-de03-46e1-8eca-532846c157d5", "comment": "Malware payload (Dridex)", "value": "f97f943fc13c2836536be11d64998fa155eecb16", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647999, "uuid": "271e02f7-cf81-4ee0-a0f9-bb7375d64c31", "comment": "Malware payload (Dridex)", "value": "803a2e49686fedcc4560a8612403d4bd4810e8bc5bdb5147169be374d8d78de705128bfa8a8f2b0047dca186a23f7010", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647999, "uuid": "b0fa7c97-dc54-4e9a-bf47-11f3b8793356", "value": "A514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647999, "uuid": "01658e73-af38-4d35-926a-766b905bd3ce", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647999, "uuid": "52fdd92c-10f8-4c61-8716-2f76d08207dc", "value": "3072:MBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:MBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647999, "uuid": "8a3f638b-79ee-4963-8e63-c69c03e76f3c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647999, "uuid": "bbdd38e3-3759-45c0-83e7-579224a8119c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647999, "uuid": "60711571-fc99-4311-a918-ee99e67a366d", "value": "1bbbd7da0174b4c8bb9ad320409ebdc93c0970afc3e2c9635b91625353aac052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82f4a43-95f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614641, "uuid": "7d35860c-9a24-4f3b-81c4-45d780896ead", "comment": "Malware payload", "value": "739f7f8913054765fa42bc34bf650cdf", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614641, "uuid": "b7a2e1f8-9f6a-4e73-a17f-f0026e82fc2e", "comment": "Malware payload", "value": "1bd69aefd9677aead533b2db9010dd5c2b9a262170554e41af90f12c361c640f", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614641, "uuid": "59343f8a-ce81-49b7-9861-e115da3af45a", "comment": "Malware payload", "value": "464d66ef884a29472d625a5df9e1f3008df5d5b2", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614641, "uuid": "78aed0d3-60d4-463c-a060-f6676e44537f", "comment": "Malware payload", "value": "8ccaef5fbf663192019c82331e5a72f2c76a10b2ddd84bcfbb66ae2e79c3ec02bd1042f30b77f43549118fec7bb7c36c", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614641, "uuid": "fd6f2416-00d5-41c7-abf0-4830d0340bf3", "value": "69663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614641, "uuid": "3a59392f-fdf3-41d8-81e1-1412105d85dc", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614641, "uuid": "fc87d31e-460f-4c4c-ae8b-170c6179e7b9", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazY:kfauN/HYOSIT/EVF9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614641, "uuid": "866363ed-f679-452d-a1e6-3e652bbb552c", "value": 6967100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614641, "uuid": "3c867b35-0b1c-4377-9eb9-0330ecb0d8bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614641, "uuid": "eda969c3-a08a-4da5-b71f-f4da0df17b5f", "value": "1bd69aefd9677aead533b2db9010dd5c2b9a262170554e41af90f12c361c640f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f6172a-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644589, "uuid": "2827a6af-17b4-4ce1-abea-ad6fb873cbe0", "comment": "Malware payload (Dridex)", "value": "51c726539d0275e151cdd3cea047719e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644589, "uuid": "9219849c-b19f-442e-90a1-bd9a0c392f8f", "comment": "Malware payload (Dridex)", "value": "1cb218a8205ece089f15ab5e0c4d20c31e88dbed51b988e29f557068271aba71", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644589, "uuid": "1b48da30-c1c3-4480-8ce2-f9a87394fa46", "comment": "Malware payload (Dridex)", "value": "63bdc79c630a379902b64c0bf13eea5791d5c50a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644589, "uuid": "e64e12ff-012e-4025-bd1e-d0e5640ee552", "comment": "Malware payload (Dridex)", "value": "a42841a92adad9515df3805e0213f56c3387ed8cd2d36a19cbdb8bc69100ab89456cadd78213f688f28e7ca3b57e61c6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644589, "uuid": "fa91f742-3e12-4760-8bc4-4e027543b14b", "value": "8314AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644589, "uuid": "eeafcec6-a83b-4402-b500-bdbd31d030a7", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644589, "uuid": "76cc3205-390b-4fd2-9cd5-4f56b04bf388", "value": "3072:6BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:6BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644589, "uuid": "73db2b7e-7090-456c-acc7-dc8ec918cc6d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644589, "uuid": "36532a0f-a5a7-49d2-a8dd-785148518de9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644589, "uuid": "45339230-c7b4-485e-b884-969fa913547f", "value": "1cb218a8205ece089f15ab5e0c4d20c31e88dbed51b988e29f557068271aba71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586c72be-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649726, "uuid": "984b3721-29c4-4155-bb99-1df799ba51b2", "comment": "Malware payload (Dridex)", "value": "2e7175ff07947033b40a2a80ccd4101a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649726, "uuid": "0b9049de-5b8a-48e6-98d6-b92f0207b600", "comment": "Malware payload (Dridex)", "value": "1d6d60a9f2ad53cb627ebf47daeb200a20d5936f108203358118b2b4bfb8014e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649726, "uuid": "b1cc151d-0e49-4af7-954c-4f2efdf1d0d7", "comment": "Malware payload (Dridex)", "value": "b5a2075b83b2ca841a132e4dc607e56340577324", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649726, "uuid": "debf6d10-8e40-4c16-a257-fab9164ec664", "comment": "Malware payload (Dridex)", "value": "c9e720321a9838b32dc5d100ea4dc74917bde7f98d4bf32d0a3a00e733c92d08215dfc015bcb684e0e9e007bd79c5d34", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649726, "uuid": "fc97d1eb-7d6f-4759-b37b-2943ca2e8508", "value": "8214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649726, "uuid": "b48609b1-428f-4995-b973-6b01f68a269d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649726, "uuid": "bceabcc1-614b-401f-b8e3-0bb343731b66", "value": "3072:OBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:OBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649726, "uuid": "b0fb6958-1537-4449-964a-4fe9ae7fe8cb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649726, "uuid": "460fc908-2c2c-487b-849d-478ac37251c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649726, "uuid": "12f9c3a4-a37c-4eca-b743-a308440ab37a", "value": "1d6d60a9f2ad53cb627ebf47daeb200a20d5936f108203358118b2b4bfb8014e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b3c26c-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647736, "uuid": "ab90786b-fbfc-48a5-9dbd-3035a6ea3ae6", "comment": "Malware payload (Dridex)", "value": "f15e9c4d35e1681c198b62478d270a57", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647736, "uuid": "8c9e573b-a35f-4648-85bb-3fbd9d44df14", "comment": "Malware payload (Dridex)", "value": "1dadd05f7131f20b245622b9601afdabad2406d0e13bdb163d53f79be49b7a6e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647736, "uuid": "fc8d1af6-abb5-4e31-be21-8b726e7f87c0", "comment": "Malware payload (Dridex)", "value": "3c58f6d831a0eea225305227093c8aa5494eb550", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647736, "uuid": "6986da89-06ee-4af0-af0d-c7ecac5b4d5b", "comment": "Malware payload (Dridex)", "value": "876b952f59a4bfcf9a81196bc451ede8f9e3f7f776aea7aa45f94f4cdef905d8e53259c3cdde47d227695e7c84b11675", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647736, "uuid": "112b417b-bd82-472b-a530-3819622b4980", "value": "9514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647736, "uuid": "4a6a2a42-0f3f-41d7-a923-ad3a563e3688", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647736, "uuid": "89bcb4c0-27d1-4073-8fb7-da2f322b4f05", "value": "3072:yBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:yBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647736, "uuid": "520c0a3b-cbbe-4075-9ff7-566e1dcc1662", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647736, "uuid": "b1d0ec7a-e1a2-4c6f-b2e8-e81957bdd736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647736, "uuid": "58d7e889-1362-4be6-a073-25b51b1da61d", "value": "1dadd05f7131f20b245622b9601afdabad2406d0e13bdb163d53f79be49b7a6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca69baca-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604390, "uuid": "c8832824-4341-4da1-8afa-f13698b3d29c", "comment": "Malware payload (AgentTesla)", "value": "718ac1057b7f260d8c4923ec7674bcfa", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604390, "uuid": "1070d82b-96c3-4e02-951b-b8e28e321bdc", "comment": "Malware payload (AgentTesla)", "value": "1e2563d2937cee4e31f8988237c29dc36d3392b9392df0d87dd61bc5824c6753", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604390, "uuid": "4b3690b8-12ca-40df-ba1c-e38b46d39d83", "comment": "Malware payload (AgentTesla)", "value": "512e059c1ab9e9daebb5bffa3e6227e371abbbaa", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604390, "uuid": "3980c784-6aae-43fb-bd85-60d4a796107e", "comment": "Malware payload (AgentTesla)", "value": "f47a9ceb0e5862fcd9b7b9f2e566457025f80d3a7c7cd38975cee85263d5f5ab9b1963b1b47c76c8cfe3b08a5818c4a6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604390, "uuid": "d9bfed1a-0c39-4909-a961-890ab46b4e1a", "value": "D1B423E1E494CC4A34DE9D51316020FABF79C3F8BB942533C8B9C685C9A3BC956A06DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604390, "uuid": "8bedecef-b54d-4b20-aa66-3b45b4615753", "value": "12288:lowLc3iBu2mDKAPBgMOz0sFCGiMq21z9GLObNBBceI1Z:l6iBb8Jk1CUB99GISeCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604390, "uuid": "374cc675-6c8f-41fa-a335-f108ae3c4c02", "value": 507006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604390, "uuid": "fe822a21-56fc-47a7-bd00-760ab42c5376", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604390, "uuid": "49be0256-38ab-4986-a718-619f107e57c0", "value": "VESSEL DETALS 2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61196912-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617604213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604213, "uuid": "f32e0f42-b945-4c51-bb58-69b2d783b4b9", "comment": "Malware payload (Formbook)", "value": "c05d971ead362b8163a51bec038261fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604213, "uuid": "2911a2d2-cb28-4821-8ca5-0175e99e6c89", "comment": "Malware payload (Formbook)", "value": "1e5241525e65fdfc2540e30a5e54b0147240a9d0f5da4063ef94509379a19feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604213, "uuid": "2114381f-c061-44f3-9f97-953e8c843312", "comment": "Malware payload (Formbook)", "value": "324ec5d8540321fe90ae84fe39ccc8c2af187269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604213, "uuid": "5205e90e-3d7a-4eb9-9166-d17263a3b74c", "comment": "Malware payload (Formbook)", "value": "602e45d72ac3fa421f2eee6f8915a6dc2359235bd81766dc5761b4140b52391c6706ccbdf3afdf6e5f68d376210ea51d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604213, "uuid": "16f06bf5-0066-4dd9-be71-8e8999c5d247", "value": "8794E0D77644D1E2C873507E8A27CA526AAB6FB99A11120723D0B75F3F3316DD92B203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604213, "uuid": "70d2f30a-ee9d-4677-86bf-8dc3fff27b45", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604213, "uuid": "0e947a88-c09d-4fbb-80f5-18d94875b619", "value": "12288:EyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyEks4stiiBO8JD10ddQ0x6KqM0:Eyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604213, "uuid": "c4b8377a-8d23-4784-a3ee-ca89ab2b828b", "value": 418674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604213, "uuid": "7dd3da67-798d-4265-8d6a-9c1542288b99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604213, "uuid": "e27cb359-ff3c-4eed-bbc9-370fa525b58c", "value": "TRANSFER CONFIRMATION_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a60c65-95d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617603978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603978, "uuid": "728fa58d-800b-4f69-b40e-c641341a0c05", "comment": "Malware payload (AgentTesla)", "value": "39837c32d03c65098eff7082f8ddfe1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603978, "uuid": "8b4b79ce-00ca-41f2-983e-d493655b9bee", "comment": "Malware payload (AgentTesla)", "value": "1e8c309986927596fd6c92e8f759ad5adb1359d3faac3c18f8b2b456427a96b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603978, "uuid": "13430587-1b17-4c8c-8bb8-7a2229a15fac", "comment": "Malware payload (AgentTesla)", "value": "ddc1ecf5f65c1dd9aa4102502d6e7fdb16c469f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603978, "uuid": "8b4ebee7-522c-489c-a277-5daa35361cf1", "comment": "Malware payload (AgentTesla)", "value": "32afa0a7e348ebc8dce85a5eba1c5abd1f0d797c3644233e7d306935233f8ca0552632d789b67311f210dc3b8f74b3ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603978, "uuid": "65088daf-58c3-4489-85fa-c35090bae02b", "value": "FA25BE80E6859690DD59A7B05A36C8314333FDEC6833DA1D18DD3DA73BBA78E0C95863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603978, "uuid": "3ac99168-5f88-47f3-90be-eef4665f33c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603978, "uuid": "de4d28dc-2257-4587-8a04-f33450ddf461", "value": "24576:0JAIsXbeeeblPgtZYZF2qmyAxD6fsVNeu5L1q:0JAXALfDAFqsnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617603978, "uuid": "6bf3f6c4-20d0-4934-a337-f8f2fc844484", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617603978, "uuid": "9fffa5f6-07ee-41af-b2b6-0366be3f6bd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603978, "uuid": "9c001e69-518f-441f-bf0b-ddd8dc1c8614", "value": "Payment Advice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f68be0-9667-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617665831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665831, "uuid": "b44c6b56-3acc-411f-98b7-b17b2621ac50", "comment": "Malware payload", "value": "e9f989c9e0781492ecd20e8d158017b5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665831, "uuid": "d44246d6-23f9-43bf-a0c8-cc9e633098d8", "comment": "Malware payload", "value": "1ec0c50a6a88953424432220a872a3b877060534563823bac83a61c624ae1699", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665831, "uuid": "ed7b38f2-e545-4120-860b-a3005c4a3dc6", "comment": "Malware payload", "value": "3240e212a3baf1948e0833584aee723cc92ae58e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665831, "uuid": "2bd63503-5aac-48c2-9b68-3fcf25902837", "comment": "Malware payload", "value": "274b6f31d46c992716652a3ef758edc95cc5b5b82941715ac0cdf7ba20c244bb4b3acc740759ee80d7e2cf1c979eface", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665831, "uuid": "5675008f-703c-46c1-9f7a-ff1789527d96", "value": "F0149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665831, "uuid": "05a85064-62c5-4e8b-93d1-72352053b877", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665831, "uuid": "59011039-c0a5-4839-99da-1e6669717c31", "value": "3072:k6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:kZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617665831, "uuid": "ccbb64b1-f4fc-44bb-ac55-2ce3496506d3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617665831, "uuid": "85e596cf-29a4-4d7e-a5eb-d53253cfd13a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665831, "uuid": "92d7d954-9ab3-43da-9421-03dede25fbc5", "value": "1ec0c50a6a88953424432220a872a3b877060534563823bac83a61c624ae1699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7b6af0-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646462, "uuid": "73c7b366-20a6-46c3-8952-b60d81bb870a", "comment": "Malware payload (Dridex)", "value": "d1e1bb89dd8fb7d28f6d4cc9032202af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646462, "uuid": "36dd8dea-3f9a-49d0-9e49-ea2cdff218ae", "comment": "Malware payload (Dridex)", "value": "1edce996cba94a26869eefdebc8b40dc9cebfe785e0f6d54374e300d8ce83154", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646462, "uuid": "ecd98a66-c0a4-4041-9fe6-895efce43f72", "comment": "Malware payload (Dridex)", "value": "fa025b9de0065e60a952b0bedef948c437c0b5be", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646462, "uuid": "bed0eb69-fa13-43d8-8e71-a5ff0ed6b583", "comment": "Malware payload (Dridex)", "value": "5f52a6c6d7fab49aab776d81692421e8b36b9a51e746ccad0e15210443df8078e689ce835215d72d100afd3ce2ba8536", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646462, "uuid": "a83cc686-2391-42af-8e33-717c532e4c8e", "value": "7C149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646462, "uuid": "c8fa2d57-ec96-4f7e-bf89-58ba3a3ffe03", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646462, "uuid": "54a36db5-b18b-4b4a-b220-0fe745ffcb77", "value": "3072:V6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:VZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646462, "uuid": "51eeb02a-741e-4991-b803-0cf81f143601", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646462, "uuid": "7d100174-bae1-4344-9239-04b91d12274d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646462, "uuid": "47ce58d5-8d28-4eab-8e97-e2a59b0eaee6", "value": "1edce996cba94a26869eefdebc8b40dc9cebfe785e0f6d54374e300d8ce83154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee098c9c-964a-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1617653413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653413, "uuid": "9d45ea87-81ed-4140-a446-5fe6a8ebdd62", "comment": "Malware payload (FickerStealer)", "value": "3d454f8acfaa2433a5dd4082cadffbb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653413, "uuid": "61b5c6c4-d1ab-48c1-a263-2d7129ed28fd", "comment": "Malware payload (FickerStealer)", "value": "1fc5e596cec276b79c9baf505d65d927609798d95743ad9ad7caf7e798bfe717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653413, "uuid": "9f8c6b68-0a8b-42a5-a006-11a7138ed184", "comment": "Malware payload (FickerStealer)", "value": "9b203fcd9881c57f7ab845667893dcad16fa3162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653413, "uuid": "fe34cbcd-841b-4cd7-91d6-fe3560984323", "comment": "Malware payload (FickerStealer)", "value": "cd566c3fa97203db5bfac3e629ff365fb7b0cfb5ef150f8df6c706a58395af41e55670a0067ac3f8be45ed55da68abe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653413, "uuid": "9853fa38-f20d-4a6d-b511-ac2eb261cc40", "value": "0764D011B7D1D033C51604754826C2B69A3AFCB16B3496C7BB807FAAAF712E19B36743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653413, "uuid": "cd92ab0a-7d77-4689-adaf-cffd7a2b83e8", "value": "d4081f8fc1a23f08301ecb84449a4902", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653413, "uuid": "6619ef9e-5455-4c84-830d-d02d5027f9ae", "value": "6144:4MNr0AfLhit/OLz43fKWs7mhmmtERvQJt:Lr0AftitmLzjf7imYERv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617653413, "uuid": "03d6458a-f663-48af-9b6a-a31cf7eee200", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617653413, "uuid": "5d2c6cfe-46e5-4795-858f-eaf1ee29f437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653413, "uuid": "a090d202-2cae-449a-9adf-c7b4b61ca8b2", "value": "9b203fcd9881c57f7ab845667893dcad16fa3162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddb1777-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604235, "uuid": "5c1ab8c8-b7b5-45a3-b791-b03560b2a74a", "comment": "Malware payload (AgentTesla)", "value": "cbd9ce80171395dcf5dde3205ddc57bb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604235, "uuid": "3377c279-4edb-4676-8aa8-d8e409a37822", "comment": "Malware payload (AgentTesla)", "value": "1fdf9dafec54f32d19ca7ff37276a70b7e0b1a588abf6924dc074858c7da31b6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604235, "uuid": "0f41d119-a608-46bc-a1ce-5f701a57c558", "comment": "Malware payload (AgentTesla)", "value": "ae018ad4ee4b358967fa92f400c82c4d16ba90a1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604235, "uuid": "7c9e87eb-a52b-4097-92ea-418ca2146701", "comment": "Malware payload (AgentTesla)", "value": "3939d11477d114cdae06c030ad475438de24b9e48fbfc0467e0c4d9a8e67c91617608989974e73a2b89b98a71027ef6d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604235, "uuid": "af4e3982-cd71-46ce-b3e4-ebaf1fafa29f", "value": "13F42341C34F9F4E426F39D79D0B795887994822B4F56A009CB97E37E3A9381C85B2B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604235, "uuid": "7b6254a0-3240-4cfc-8d68-5de0e288f466", "value": "12288:nETTa/ZSHleBv2OirIudUJylLGcKwNgTxSMbw2m4FzENPvdm1oPvt/usek:n88voOiC8LdKw6Txo2LFzV1onNusek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604235, "uuid": "1a717a12-966b-4509-9354-ce4a5bd90a11", "value": 728460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604235, "uuid": "ae5a2854-9e7b-4ce6-ac34-030657c91f1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604235, "uuid": "bf4873a0-84b7-4606-a1cc-acbebebb814c", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6fc848-963f-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617648306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648306, "uuid": "d7af499a-66c9-448f-ba1b-291110c906e4", "comment": "Malware payload (CobaltStrike)", "value": "329a67cec8e2ff4fc35717502bfb4afd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648306, "uuid": "4062924b-0537-4c3c-81b0-093034896b20", "comment": "Malware payload (CobaltStrike)", "value": "210f032fe0af6d25bf6b74ce5393fdd3b90a741ca8ab716866765371dfe05327", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648306, "uuid": "755beeb2-e9e3-43cb-8387-cbed09ab5a71", "comment": "Malware payload (CobaltStrike)", "value": "ecfabb8b33732336fcb57bbe0b160e4961c75715", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648306, "uuid": "81b3b351-240b-4a63-ad51-8ada892d6bdc", "comment": "Malware payload (CobaltStrike)", "value": "6e431b8911125894be335a6ded59f38d2c5ac4326505a8039a31800f9128f52b2b1c276a8ad2996d5f39a993551fdd19", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648306, "uuid": "ab99888b-8298-4a48-a3eb-3a65e440340b", "value": "9F44CF033B713C99FE07E4348DDB28556E652EE71B99DB2211E1041A9CCFB8AE98DD13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648306, "uuid": "26f44e84-5694-4114-9a19-2614c4bc8613", "value": "5a39eb6cfd5f6c5e4a76574f21752244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648306, "uuid": "7d573b29-7255-4e3c-bc2e-4cf6d242b000", "value": "6144:uOre8kPd0EQClTs4/q3C1BIAFzm50xJKjzQEXP:uWIPd0ENFsEq3C1BHFq5CKPQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617648306, "uuid": "45b16456-f48d-45fa-a20b-5461caaab3ff", "value": 261636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617648306, "uuid": "f1b4c217-0d36-4c50-83a9-a79043fea112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648306, "uuid": "ce6d88fc-d47e-4bcb-9aa6-64ad90cf7248", "value": "gifs20210122.dat.decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73a3817-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644355, "uuid": "ab7d531e-382b-4a01-89c0-1e4f10c347e6", "comment": "Malware payload (Dridex)", "value": "f0866b3499e8a947620cf9492c5081ff", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644355, "uuid": "16eb0811-ce49-472a-9d20-5a9bffa78f84", "comment": "Malware payload (Dridex)", "value": "2119913c3f1bf922ec04b44b8f5af0fb55dbd59c8180d01f8bd7bc4ee6929aae", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644355, "uuid": "21a921c1-a223-4849-9494-ec76b8cd47dc", "comment": "Malware payload (Dridex)", "value": "97217857f2bbcde50d4eb402a4e6ed2f60912416", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644355, "uuid": "b3e62266-662f-4d1f-b7cf-fae9fdd40d8c", "comment": "Malware payload (Dridex)", "value": "da7b59f334f07f87bd96d3de01d9c0bc0442da4d9ae4a2069aeb84afe5d3a2e3c071b8d585f117ba592646e9505d3003", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644355, "uuid": "3f25d866-c049-4e1b-8106-e41c024872c0", "value": "A414AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644355, "uuid": "8c38aa11-bfa5-492a-b3bd-37e9faaa8923", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644355, "uuid": "ade1ada8-1334-43ca-a7a5-bc5957b2e23c", "value": "3072:tBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:tBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644355, "uuid": "79532eca-6c54-4a10-9748-650f976b1740", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644355, "uuid": "61be29f3-a8b2-4de4-9057-b819e3e263b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644355, "uuid": "e5030225-7de9-4679-9203-a5f4587d3191", "value": "2119913c3f1bf922ec04b44b8f5af0fb55dbd59c8180d01f8bd7bc4ee6929aae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4205904e-9645-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "d68a164b-90f9-4af5-9c0d-4806bdab22ca", "comment": "Malware payload (Dridex)", "value": "c14eb768bd64e2d24b87f7f7cc3ffad1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "f3770f09-1409-46aa-b1ad-4963ee780c49", "comment": "Malware payload (Dridex)", "value": "21ba7ba79e8c4705b7ec0ae179cce3e210f107cc305a87bd4f2fc3d0da2e2b9f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "1410c44b-d5e4-48d5-ade5-bca967eb6b11", "comment": "Malware payload (Dridex)", "value": "d7575252dea66cf8c29c787845721fb676c84510", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "f02d8a17-6e89-47a1-a1b9-f8e470100747", "comment": "Malware payload (Dridex)", "value": "cd42594db2b4b20b1c78d9d1b0c4639dc7ab23db4f1e23d26dedfd89680765f604f2c62829833420f0cd4aeea0217d23", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "a682e41e-6412-4559-9a72-ea5a61413275", "value": "6414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "126f2812-d7d3-4aed-bf1c-1b8cf25de32f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "8f726d02-cfc8-444b-8e03-21deb6631e0d", "value": "3072:bBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:bBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650976, "uuid": "1b82432d-0058-4ae9-8403-f1e27fb47dd9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650976, "uuid": "31bb9625-b267-46f3-8759-1218aaa724be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "d30527b1-49d4-4c75-9988-dda42882474b", "value": "21ba7ba79e8c4705b7ec0ae179cce3e210f107cc305a87bd4f2fc3d0da2e2b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feabc81-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649174, "uuid": "56ef9a03-6634-4466-a7bc-3a5b377ec43e", "comment": "Malware payload (Dridex)", "value": "3b304d5a006fd6e7a8b969af01943fcd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649174, "uuid": "a817413b-ec91-4c47-adbf-1d6f22b30860", "comment": "Malware payload (Dridex)", "value": "21cef3ca9b6b5e354afd14041d02c695b78ea8e51309abde33248d67e1d48b65", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649174, "uuid": "c98428ac-5645-4808-8707-23063cb65817", "comment": "Malware payload (Dridex)", "value": "5ce145759ed113b264a487c5f1a2000a824a6c0c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649174, "uuid": "6dbcadc5-c22e-4288-91db-0f2f74881244", "comment": "Malware payload (Dridex)", "value": "767e55fc40d92f23b72987e46c0ff5f8423e8b4009227a5f1b0b3e49b7b2bd91efb2c44efc3cf2ebb9f31f2c736a5106", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649174, "uuid": "b7a0c032-b9bf-4000-8e21-4393635e53ea", "value": "C014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649174, "uuid": "89498ac6-fe7c-4543-9bca-fb10c98ceb53", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649174, "uuid": "70054e12-404b-49ef-9858-b1e75edaa5cc", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649174, "uuid": "ce12952d-4775-4a6d-be12-d01c440d51ab", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649174, "uuid": "87537b7e-429f-4193-8b89-ff738738f584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649174, "uuid": "86b8b357-9ee1-48cd-8552-7eecaf2c5b95", "value": "21cef3ca9b6b5e354afd14041d02c695b78ea8e51309abde33248d67e1d48b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b166b562-960d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617627111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627111, "uuid": "2b578eca-4f8d-48eb-a1a6-2226fc783236", "comment": "Malware payload", "value": "d28f4d51e73e8b83831a801c6fe15a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627111, "uuid": "88dd6fd0-06fc-4d0b-8242-235bbe3086d6", "comment": "Malware payload", "value": "23325c95e81ab19e83ab0421b68f4e361d24a2c6adb3a675ffdcd364985671c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627111, "uuid": "4ccfe785-bbe1-4f79-87aa-a7e5b84f78b0", "comment": "Malware payload", "value": "925634b79e8e469d21e7fe7dfa89abaa619394e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627111, "uuid": "399b0a0a-ab79-4df7-925a-58bea7ab10a8", "comment": "Malware payload", "value": "61ef86a3d7a9ae774476b01a5a4281813e072698e776b0217672566331c71eae1fa5b0d40e73e9663ccbfdae374e626c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627111, "uuid": "1bcb90d4-f339-4dc1-969d-68e9658966a8", "value": "39470812EF58641AF4334070A9A4B66B46683C763419A90BF781BF4DB5357E3A8F831F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627111, "uuid": "6ae40bf0-1704-4dcb-af02-90be749b47eb", "value": "35e812c68f2af60a6601912effe11c43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627111, "uuid": "37dabd85-46b9-4296-9b1d-548d731f7b02", "value": "786432:7bW8Y3+hrVyXpwlVRPNJ/Hx7dInOswGPX+518Y6YjXr5WtmuFbm6WWvzwaGi5P+2:nzyXpwlVRPNJ/HxBInOswGPX+518Y6YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627111, "uuid": "29da6f60-1b18-4967-89c0-8aa86699ecf5", "value": 25968640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627111, "uuid": "b6dfb61e-cf38-46d5-b1c8-2c1c21d0ee02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627111, "uuid": "f5402115-030f-4a8d-bb8c-12a7f7a3a661", "value": "Acc_AccessTCart14000116_12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e18695e-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604208, "uuid": "eac3afd9-2fde-4f73-943b-86e81d1b5638", "comment": "Malware payload (AgentTesla)", "value": "c8c57aa10da4f3b4fce92bc14834b9c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604208, "uuid": "f70bc541-fbfa-4dfc-924d-bf35e0ca6587", "comment": "Malware payload (AgentTesla)", "value": "233e814f54f8fa50dde3e233107cc7d2dbf72b6a02c10ca1299170321f143bd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604208, "uuid": "23b8301c-8bb3-4948-9dfa-39b8320ee3c5", "comment": "Malware payload (AgentTesla)", "value": "b3516dd42d315d56c83ef6ad501ff23547350b26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604208, "uuid": "839292cb-f976-4754-a354-6cbb9c26c894", "comment": "Malware payload (AgentTesla)", "value": "400eaf4400715756a54c94901a96a313b2115640aa674b76e0ba10c2767b42b2093334ee630fb3e6c31c0fa42b6181cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604208, "uuid": "cd2d36a9-eff1-48d5-87d3-c605c43f79e6", "value": "85459E167677E94EC5244A3AC15F154902909E36A91BEE8DE0E8BF3A0B3025BF116F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604208, "uuid": "a54f6fdf-432d-4bdd-a8c3-b5f359b95f45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604208, "uuid": "7b039cbb-4667-4d84-843f-336b1d0e4072", "value": "24576:2o5h0d9Z+biJm8o5hX95kJy9ax6Svvxw6IRxBqGbe6VRmZy01SWCk:OZjqD0ycxVm6IE8lqEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604208, "uuid": "02a5b5d9-0271-4f5b-a5ca-974783c9ffa4", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604208, "uuid": "c35b850a-3885-4b1b-8c72-fec8db7ef284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604208, "uuid": "cf7906b7-917d-41cb-b960-a413a4c3d52e", "value": "PO_6620200947535257661_Arabico.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c0d4e6-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "c9dbae64-a693-41fb-9e6a-9eae8ab158ec", "comment": "Malware payload (Dridex)", "value": "7f845ef0c57630baf014fc5c2bb6bd33", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "770417f4-01b8-408e-9822-9f004794c036", "comment": "Malware payload (Dridex)", "value": "23ab8898b73d0ba18f413ca26d8f284cf1088a96dc8c4fbfe797f566048f1cc5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "c00df655-dc67-4571-844a-411ddd1c4385", "comment": "Malware payload (Dridex)", "value": "c8f00129adb0d6e9381186bfe7362b68387afeb9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "eefd576e-208f-4d9b-ae4e-bf018a826ada", "comment": "Malware payload (Dridex)", "value": "0d0f99427721b2e15e5331003d0851f857e854e5a92d068c3a53bc4edaac6938f62d62e68a2ca74c47a761ed60482c5b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "961a645c-bcaa-4eec-8cb7-715d6e046af7", "value": "B814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "9d74ca1d-82fb-49cc-b970-d5a761c9a26c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "a6d43d26-f4dd-42cf-a54b-0eae337ff772", "value": "3072:bBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:bBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647819, "uuid": "f0f4f6ae-0809-4e6b-a0eb-c5f682beb95e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647819, "uuid": "fd97f128-209d-4cd4-b54c-af44dbb9de5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "bb97c5f5-4e4d-4bc4-a33e-8944972739d1", "value": "23ab8898b73d0ba18f413ca26d8f284cf1088a96dc8c4fbfe797f566048f1cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cf9df7-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1617643621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643621, "uuid": "a3df8970-1f2f-47f3-8ba9-7d7fce864b29", "comment": "Malware payload (LimeRAT)", "value": "96b755d193cbfe19fd0be015f3766fda", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643621, "uuid": "2b402e75-e21e-4f5b-941d-78f5dedc7159", "comment": "Malware payload (LimeRAT)", "value": "24cda86f6fee49b4116cbd7907440ca4662332304b68be8a3cadc7daa9d95941", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643621, "uuid": "2cdd75fe-19c6-4c24-93d9-b7a347a92c0d", "comment": "Malware payload (LimeRAT)", "value": "dbc77a0c991e0f57add7dcb2d1b01c56e01dee67", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643621, "uuid": "2e21c351-82c3-4773-8f3a-c8be4a96e5e9", "comment": "Malware payload (LimeRAT)", "value": "15d67e3bb0eddcb86780ceb96d2d4748102e6863e684ac6f9d482e70e911fd367a1ec8f3a12dff3a24885a3dad684b1f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643621, "uuid": "985b605d-9b5a-416c-8a5a-fe0ebfd339f4", "value": "6916AFB876047DE6266F576BDA96ACDC03B627639ACBA4CC806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643621, "uuid": "db84e99d-b232-424e-a74e-b10f9777d6b1", "value": "24576:39uUrY1Do6F3PMtW/12W0Q/CfBj5mVRVMYYlL5QvhtBOPuR9LUc3JGgryIv7eCtZ:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643621, "uuid": "4f872f2b-5f6b-410a-8566-27f890b88f0e", "value": 4090492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643621, "uuid": "86df8a4b-879e-4044-aef0-00560733c701", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643621, "uuid": "fd6ebf5f-f782-4d20-a60d-6245160eb994", "value": "appraisal document.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf5ec02-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617649839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649839, "uuid": "7937f842-8809-4f32-84a2-8db5ab97e185", "comment": "Malware payload", "value": "f4827de47eddd2ecf6b55b073d23b04e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649839, "uuid": "4e2c0ff0-58b8-449b-b736-7936e078d729", "comment": "Malware payload", "value": "2575823f201aee56c1bdb23908f51edb314dfbbe51aa8a4434210b78c9078129", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649839, "uuid": "2cc516f2-859e-4740-b202-ac3adfc4e673", "comment": "Malware payload", "value": "4071ab8e2dac90fc2cc95faf45f0ef7fe24c9d61", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649839, "uuid": "547341d4-61a4-4b78-8e69-b61b19c56630", "comment": "Malware payload", "value": "be31203fe5231d5c27db2da4f12556f9613b16780dd1fc74b2aec2e3f864122efc09a6f842dbc792e50b697df7855390", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649839, "uuid": "1846b09e-6a66-4e49-b1a2-7015651bf684", "value": "ED14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649839, "uuid": "3d95666a-c949-4daa-9251-784df2d91653", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649839, "uuid": "1592fbc9-a4d6-4f24-afca-f12b01badc0d", "value": "3072:5BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:5BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649839, "uuid": "c5638538-a3ca-49b2-9dc9-de737552f40a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649839, "uuid": "544e8bb6-8975-4659-940a-550e45085560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649839, "uuid": "22b7c094-6929-4a2f-88e6-aa239ebc85de", "value": "2575823f201aee56c1bdb23908f51edb314dfbbe51aa8a4434210b78c9078129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021514c4-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "861a8c2e-812e-4b81-9ea7-7ef63dd29dd5", "comment": "Malware payload (Dridex)", "value": "2f29369ea00d7c5119421fddeacff9fb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "793277a9-8220-4674-a489-deb7af836d25", "comment": "Malware payload (Dridex)", "value": "25bb4763a827bd521337b25b98bf143180623a463efdb584d696bfc1ff2d21dd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "6495dd1f-8088-4992-a87b-65ee4b593eff", "comment": "Malware payload (Dridex)", "value": "fc33568998ba468ba4cf2c74cfa4545a1abcbc55", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "d9b3b941-0a1a-456a-886a-e245b47719ed", "comment": "Malware payload (Dridex)", "value": "fc0c483eb59b0ff3dcdd55ab754a655600e7e10bdca6ab43b01984384fb13903320cc556302c08d884babf5d920756e5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "2a6f793f-d618-499a-a3e1-ca94618ad580", "value": "AC14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "6440acd6-b26e-413d-8831-69ca6edfc33f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "c659bf13-0b7c-4690-9863-b76161fdd952", "value": "3072:GBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:GBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649581, "uuid": "f6c4526c-ebba-47aa-9c5f-5c152201ef27", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649581, "uuid": "56d13b6d-26d2-4a56-beb1-2a37bbbdfafc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "60738f7f-ae80-4173-b356-e767926afbf1", "value": "25bb4763a827bd521337b25b98bf143180623a463efdb584d696bfc1ff2d21dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c880cf-9662-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617663547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617663547, "uuid": "23f2cf55-c1e5-47de-ae0b-6b5c25133294", "comment": "Malware payload", "value": "31751a529a92e80b22b665adaade68cf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617663547, "uuid": "bd3502cf-d4c4-493c-a4d1-2fa379c325a7", "comment": "Malware payload", "value": "28231d403b240ca10b3ec62b59544e8f92dfb874cb513abaf89dfd2d12a8aae9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617663547, "uuid": "c468c40f-3626-402d-a696-7ac0ae63f6b5", "comment": "Malware payload", "value": "91e5bbcd39743a3a686d2e043c0c385268c2562b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617663547, "uuid": "3cdb74ee-c527-41ef-ae7f-eba0cdb6ff23", "comment": "Malware payload", "value": "96109bbb36dba4d13b0601a8ac12e5484003c08d9f2c77ae2089a10edf646ff00d04830e80d365ea5ee271a8f8f8c4d2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617663547, "uuid": "07f45541-091a-453d-8760-c462a1dc8774", "value": "3E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617663547, "uuid": "674247b1-3d82-4b22-b928-12e99e491e13", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617663547, "uuid": "b40f9d8e-fb8a-4865-be0e-76ad0d8418c4", "value": "3072:zBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:zBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617663547, "uuid": "e7af1b57-9560-49a1-90a6-8b15a7d462ab", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617663547, "uuid": "a3120032-ba87-4b45-aeed-cb2e34ed7499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617663547, "uuid": "c8d10af2-d200-466f-8bd2-3058be32545d", "value": "28231d403b240ca10b3ec62b59544e8f92dfb874cb513abaf89dfd2d12a8aae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a86417-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649558, "uuid": "e123a95e-49ef-46e2-bb3e-cac174a3c0c3", "comment": "Malware payload (Dridex)", "value": "1a95de0953f868480d8c6f81e16773d5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649558, "uuid": "29a12392-5e45-40dd-8b4d-35a11545b76b", "comment": "Malware payload (Dridex)", "value": "28966c5c109838a2e125c9dba8a86519badae02131f699c80693b3f60ea184cd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649558, "uuid": "0e976852-30fb-454e-915e-831e3ec25eb7", "comment": "Malware payload (Dridex)", "value": "6b82d5047a25df7eaccc2432a30205c47138d8d7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649558, "uuid": "c8be4161-1335-4b11-8f68-80fece784ed4", "comment": "Malware payload (Dridex)", "value": "8baad8c7f311814e8c53c8fa67d6565e75075551e8a83feb753b92f91c06c02ed643c86b1c0805d7f33b787724e3bcf5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649558, "uuid": "fc1de781-78b5-472d-a7b7-fa4cf67e5b45", "value": "5414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649558, "uuid": "ab45ee6b-4bb9-4dac-9a86-6c19b074f3d3", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649558, "uuid": "18d8ceff-a79b-4d38-ab61-9f93c2acebb8", "value": "3072:HBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:HBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649558, "uuid": "c493db96-fe87-49ea-ba1c-542da5bec990", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649558, "uuid": "c7a9e095-e4fe-4bcb-a8a7-f667429bc1bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649558, "uuid": "2e663da5-fdac-4adf-b69e-c987000882d9", "value": "28966c5c109838a2e125c9dba8a86519badae02131f699c80693b3f60ea184cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091c462a-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647445, "uuid": "febbd846-f5e3-447f-a479-4231dec2ffc3", "comment": "Malware payload (Dridex)", "value": "4a4344437267c3e8f674afbaea1550d5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647445, "uuid": "a5133622-8e27-4053-bcf5-26ae3e6c22b4", "comment": "Malware payload (Dridex)", "value": "289ef5c313646455b8090444972ce69f8045075f34c90adf738c484067834a5f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647445, "uuid": "60fb604e-1a8c-48a0-8504-bb72a87583f3", "comment": "Malware payload (Dridex)", "value": "761ede96e854d96b95ef2964642ec587d238ff95", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647445, "uuid": "da440a6b-cb3e-4fe2-b838-8d31399ba8af", "comment": "Malware payload (Dridex)", "value": "66479f256f43c3bf04e50f934213dfa2ef95bf16d1e248c4626d1640577d2df271b7e1c9dee5c6bbd01924396cd0fb97", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647445, "uuid": "cb79d198-4eeb-491a-91ca-85fabefefb75", "value": "F514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647445, "uuid": "062ada3b-ad57-4f11-ade7-bc8553973252", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647445, "uuid": "1d9613e2-8a96-4a65-94bf-95a3d001d460", "value": "3072:jBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:jBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647445, "uuid": "f7a65685-afc3-447b-aea7-a18d46a44efa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647445, "uuid": "2058e707-27ef-4d17-98fa-8aeeecaa4d12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647445, "uuid": "033ac1ff-96ad-40f9-abd7-dcab88a5bb85", "value": "289ef5c313646455b8090444972ce69f8045075f34c90adf738c484067834a5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8160ca-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617614972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614972, "uuid": "1c12ae45-6b97-4073-bc2a-d453f4ca2e51", "comment": "Malware payload (Quakbot)", "value": "611b27f49da01bbd6b68be24774924ec", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614972, "uuid": "626ce827-1b15-4af6-a39a-3e11f9b6a4ef", "comment": "Malware payload (Quakbot)", "value": "28c1ae412c6434eb0407d7333cc281dabc1d461d4bbb0f9e709780cd37400951", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614972, "uuid": "efc0853c-fefb-41ae-b9f2-6134e55c0147", "comment": "Malware payload (Quakbot)", "value": "1e30a84b6e107f87750c996f3353e9d13ae27c62", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614972, "uuid": "7e882364-2516-4784-b0b1-0ab5aba5b723", "comment": "Malware payload (Quakbot)", "value": "8029614decdb00d097a1065627a051ecb8aa7c33b4ad484bcdc689576a34217d5e1529f5dee7793e63a4fbba4ef06d59", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614972, "uuid": "a7442851-3b1b-4e19-ad21-5d67623e4a7c", "value": "87663381F092CC7AE8F3253606B7D1346D7EFD130B1049BB62AC4A537E61B92B779219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614972, "uuid": "342a0ef3-b906-4433-879e-d0a0debc0f71", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614972, "uuid": "7da83f72-2985-44dc-8d3b-8e168efcb699", "value": "196608:qbuCCCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazx:huN/HYOSIT/EVF91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614972, "uuid": "5805f510-d9b9-4b39-b277-7a10e7618819", "value": 6966688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614972, "uuid": "0001f655-a89d-4f62-a342-e373f9bf10ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614972, "uuid": "d5a7b3a4-35ea-4bbb-b2a3-c8fb4e8c272c", "value": "28c1ae412c6434eb0407d7333cc281dabc1d461d4bbb0f9e709780cd37400951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be33adf1-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650326, "uuid": "5d7956f4-1a84-470f-ba1e-34b4c20b777b", "comment": "Malware payload (Dridex)", "value": "432c0a86d06f128df822b04c77c9ef52", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650326, "uuid": "e0291bf2-ed58-4bb2-ad9c-be270d375f15", "comment": "Malware payload (Dridex)", "value": "28cb8954ccfbd6c0c2f075b355b3ad5aca6d7a27be126c0d05ee5ab05f765d31", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650326, "uuid": "7a8f1eca-db3b-4f8e-a3d7-cbe66c679778", "comment": "Malware payload (Dridex)", "value": "839bf08e2aca5722119d7373b36235ebaafe2c2d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650326, "uuid": "bf192e05-d623-417c-9ce4-fcbb2602fc0b", "comment": "Malware payload (Dridex)", "value": "a8c2581ca27d261beccc65640e5c1fec10f51a785cb2ffed73720c821e226621987f4cb5854b802a2fbe567105b559fd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650326, "uuid": "9ae7a958-6973-453c-a14f-0d0e03c3ec16", "value": "6014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650326, "uuid": "c3571143-12e4-4325-9798-5eb108d858cf", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650326, "uuid": "627a5ba4-2c54-4fd7-a784-c4cebf62aeeb", "value": "3072:uBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:uBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650326, "uuid": "f6eeaef4-f1f1-4a22-8952-0c6e3c0cbca7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650326, "uuid": "dfd0a22d-20d0-4243-869d-32dab3e248b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650326, "uuid": "6f16239d-4367-455d-af51-4bb136d58dcc", "value": "28cb8954ccfbd6c0c2f075b355b3ad5aca6d7a27be126c0d05ee5ab05f765d31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7c0c94-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604206, "uuid": "d43dcd9c-9126-4dad-9226-e5e4450a4a5f", "comment": "Malware payload (AgentTesla)", "value": "fd92e2d96c5ec04252f26f2e02df44a0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604206, "uuid": "f4d76759-1563-4bcd-bdd3-cdf1181199df", "comment": "Malware payload (AgentTesla)", "value": "28f1e6628137e202c88ab3a87bf2a238345248bc4a49b0da30da7b952423a4ae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604206, "uuid": "b385aafb-3848-4821-9cd4-2a09a4b4b97e", "comment": "Malware payload (AgentTesla)", "value": "a6f97e5c01f8f0206c6f8b8ed55433f75bff2992", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604206, "uuid": "bdacd42b-c178-452d-a33e-df41b434f61a", "comment": "Malware payload (AgentTesla)", "value": "eeadffd75b0bc83cf45f248eb2888051ed2cebc5fa02e2ebd35d459eef3828edb967b036816855ff7bbc7ce46fa9bb21", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604206, "uuid": "f3581589-a6df-4b10-aca9-44aa2ce5c4fa", "value": "7CF4330C17F4F5742DB2DE81CBC2C67E6CC98B3716E9193EE211B22484A22A395F647D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604206, "uuid": "8a800f37-d9a6-40a6-a36b-845de997aedf", "value": "12288:c2TBXHgehrc2746lwaybE3/tW7odKBYhEJ8/qT4m2xElgo/thLUfwmMTgB+8dgZT:htHfhrc28XaWEPt7v2822uq/Ykcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604206, "uuid": "483750d0-ea64-4027-a64e-bd88e53567f2", "value": 743395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604206, "uuid": "466abc8f-68a8-4c99-af07-47fc9c801042", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604206, "uuid": "871bf756-03f0-4106-84cb-7dfd65381ab1", "value": "PO_6620200947535257661_Arabico.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f8884a-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649854, "uuid": "dc2eabe0-95a6-4e46-822a-1dd5bd117cfc", "comment": "Malware payload (Dridex)", "value": "c247a2c097dfbfeb1853b08c524f8546", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649854, "uuid": "44bf8965-7f91-45f4-9f91-2173fe086005", "comment": "Malware payload (Dridex)", "value": "29c483598e911651cd19f4638646f2041e1db0c5d8dcdac820e326336575678c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649854, "uuid": "2bc37f00-3e0b-4365-af60-49328c7b4bd9", "comment": "Malware payload (Dridex)", "value": "37ce1851722b17ae2dba99a8b5bfac9e6a1b20b0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649854, "uuid": "84c7a9e8-6290-4ce2-8312-9f31844ae0a6", "comment": "Malware payload (Dridex)", "value": "5b6b52628fb406c4b878e0a8fbadb1cb8c1af1921126e778b07b1d9b320b8eeba0e0aaf45c07c7b243fc03e143f56cc0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649854, "uuid": "054c0343-3992-4272-8e05-d92fbf096b82", "value": "4914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649854, "uuid": "b8723274-4bab-4071-a525-2ba74478b7ba", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649854, "uuid": "0e9ce0ac-73dd-4756-a776-dbc141a4c13b", "value": "3072:MBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:MBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649854, "uuid": "03107b13-233b-4020-a7cb-fff3d4ad3dee", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649854, "uuid": "6d557571-8a10-4452-939d-6361bce8a300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649854, "uuid": "c48b883c-9d2d-46e2-8df3-a2c2b101a667", "value": "29c483598e911651cd19f4638646f2041e1db0c5d8dcdac820e326336575678c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bd1046-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644488, "uuid": "5c1f176a-f265-48d5-ae9e-180330eae256", "comment": "Malware payload (Dridex)", "value": "26c84304f10c5a9d6f4450015aaa3c95", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644488, "uuid": "775d6e47-8d88-474a-be48-fa5dacd6f619", "comment": "Malware payload (Dridex)", "value": "29d22784712a2927f4577ff753b8e0631559723f92774c7c776ba06a5c70ea33", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644488, "uuid": "37123e3a-5a24-4772-9105-671005d14ef6", "comment": "Malware payload (Dridex)", "value": "31d86d5a5b783415053385dce4e8c3b7da6d6f4b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644488, "uuid": "4822dd6a-516f-4f58-a2ef-8a421f33e63e", "comment": "Malware payload (Dridex)", "value": "40e775780f637187225a8ba5445a54b06fb3b54d7d0c0351ab92528a61f41ba13a2c845e8f04e714e86c6820580f5e9b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644488, "uuid": "0ccb34a6-c7fd-4468-8ee6-bd6f009e78d1", "value": "8E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644488, "uuid": "c901bd85-14aa-4c2b-b036-d79313f06856", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644488, "uuid": "b3bcdf33-d0d6-4830-a773-ac41df6478d2", "value": "3072:LBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:LBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644488, "uuid": "365249af-8bbc-4edc-a1bb-084d936d21f7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644488, "uuid": "2396ea6b-f767-4600-9bbe-a3fdb44a0954", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644488, "uuid": "1dca8144-81b6-4306-b67a-75bc8983506b", "value": "29d22784712a2927f4577ff753b8e0631559723f92774c7c776ba06a5c70ea33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01acb5df-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649580, "uuid": "51a958ad-6b95-4741-9ad7-12c16bb9ac06", "comment": "Malware payload (Dridex)", "value": "4d86362e9df9cbb662875f5e89b58ba5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649580, "uuid": "51ea9f9b-547a-4f8d-81aa-81ced0d3ea5f", "comment": "Malware payload (Dridex)", "value": "2a024249ab1bd533ca1feec0fb0332d1e0fdba274c523d3dbd7ff287fda324f9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649580, "uuid": "ba885552-94a5-4c13-a9b3-fa7dcd509496", "comment": "Malware payload (Dridex)", "value": "e38ff07c08dc4d0143bbe57bf1b8aea9d4f7e985", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649580, "uuid": "67258b27-190a-4f8c-aa1a-77c86f261371", "comment": "Malware payload (Dridex)", "value": "8cc2abbcab05d4d4dace7ce2b81e63ece012f8b82303f2b88818108bd746dda707325bce51ee0bf3b419be648b072d40", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649580, "uuid": "fb96fd92-a0d2-4d01-b0f4-d537afb156bd", "value": "B114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649580, "uuid": "61dd5fcd-4bb1-4c63-b24f-111177e94b93", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649580, "uuid": "736491b9-f12d-49b7-b4ee-daad1f4b713a", "value": "3072:IBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:IBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649580, "uuid": "22e56152-6121-4410-b764-333de5b01e09", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649580, "uuid": "23811861-6d85-40aa-9440-ae9a90e52840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649580, "uuid": "c3ad515d-273a-4f91-8eda-48688d944be0", "value": "2a024249ab1bd533ca1feec0fb0332d1e0fdba274c523d3dbd7ff287fda324f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1640696-95f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614710, "uuid": "8def62df-0fea-4d48-9c0e-9f538e448fe6", "comment": "Malware payload", "value": "21ff567a59d78b24c3fcaaba01b6a157", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614710, "uuid": "4a741d01-dad9-41d8-b548-15955ef3a02f", "comment": "Malware payload", "value": "2ad506baf005089e45769c6a7f6a37319d47834bad6375e3e3107cd263142436", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614710, "uuid": "3ce34e83-4c4a-40c1-ac98-4afb6e5824b1", "comment": "Malware payload", "value": "8dd675c4a6970d227579b5c1ccc748fd1b03de4c", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614710, "uuid": "bb127069-6ce1-4b33-8375-08dfc3ab0737", "comment": "Malware payload", "value": "5217de6980de87c7d8d2416c214bef6b6a9219bb0c3f5c60e2050a3721c4090e3524d925337eb91fbdb24bb77737fa45", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614710, "uuid": "afb7d5fd-53e1-448a-91aa-b847ab556893", "value": "15863381F0A28CB7F8FA15322AB6D13A3AB6F5130B4545EF635C46937961381A77C72C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614710, "uuid": "280b5ed6-792a-489c-a9b8-55dcf3d9f5f3", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614710, "uuid": "d02eb37c-6f2d-40bd-83d4-19445e4e7e9a", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazwf5XrIQQtIke:kfauN/HYOSIT/EVF9+NTQtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614710, "uuid": "25a07a70-d026-4e55-a716-ae141635fa61", "value": 8230469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614710, "uuid": "03ace582-383c-4273-9fe4-8c410040da1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614710, "uuid": "2ab5ddcb-ff4a-4c28-a7d3-18f9a4a9398c", "value": "2ad506baf005089e45769c6a7f6a37319d47834bad6375e3e3107cd263142436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6ccd1c-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644494, "uuid": "6f64eb05-47bf-404e-985a-b12dea62f870", "comment": "Malware payload (Dridex)", "value": "b56a084781f21418baab8b5f03eda6fc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644494, "uuid": "6d4f3589-4225-451c-95a2-ac1619df8a59", "comment": "Malware payload (Dridex)", "value": "2d82c563023c0059195a9b7ed3486a864ebed5091471cc7b2a6f7b45e5433793", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644494, "uuid": "1afa113d-cf01-4f3f-8486-dbdd183579c9", "comment": "Malware payload (Dridex)", "value": "f202580b26736d4f1dc824ab8e38135cb8a04480", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644494, "uuid": "d96789f3-1240-4281-a058-fdb250754477", "comment": "Malware payload (Dridex)", "value": "f92060ab0093671e386da597d7b21b1b5ddad173bab123cbbb4908648f8fb8525f15f86b2d1f473711e1a015cfe3901a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644494, "uuid": "ae54cf4e-b6bc-4b46-821e-b122e072cbf5", "value": "0314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644494, "uuid": "efe48176-96ca-4572-9a18-db011612acf3", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644494, "uuid": "a88bdafb-7c55-4526-b790-d27ecc5e0a5c", "value": "3072:+BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:+BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644494, "uuid": "2a68ae54-19f4-497d-af7f-b4bf7d8aa110", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644494, "uuid": "a5b97f88-047f-4c94-a1f9-307ba0cc38fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644494, "uuid": "27dd0a5c-ad6b-4715-81d4-9430047b1a4c", "value": "2d82c563023c0059195a9b7ed3486a864ebed5091471cc7b2a6f7b45e5433793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9c3ad0-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644416, "uuid": "d43f8044-9606-4321-9cf9-5540e1860557", "comment": "Malware payload (Dridex)", "value": "d0655a7aac0ef7c054e778469d5f9b84", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644416, "uuid": "8228549c-821b-448b-b03f-e2fb864d428f", "comment": "Malware payload (Dridex)", "value": "2e5ad7c692a24c2af13dc22f6bc184b63c7618d26b94253e13ac8af655e3ea02", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644416, "uuid": "5e1a95d5-d8bb-4156-b1f4-f4c676e774fc", "comment": "Malware payload (Dridex)", "value": "7778aa37a3f4f73502c74391435373b649a438da", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644416, "uuid": "f784c09d-b3e1-428f-89be-07f23cf42887", "comment": "Malware payload (Dridex)", "value": "506bd06737194052e869e55e0e72fd80382de2002e6a2ab7a78aecd968e6fd1bf2d35e7ec0d9815966df6112a06e56e4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644416, "uuid": "59ef721b-6366-40f5-b625-389461886295", "value": "FF14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644416, "uuid": "88f02984-eabe-49a5-ad4b-68f5c010f789", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644416, "uuid": "e298baf4-e432-4245-8ddf-737559b4ad39", "value": "3072:8BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:8BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644416, "uuid": "90aab701-64fa-447f-beec-e5595f4e216f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644416, "uuid": "d7f358e8-3f12-4e60-9d22-6df196f07fbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644416, "uuid": "7bbd1176-dbc2-467b-bffe-4072880a4d8d", "value": "2e5ad7c692a24c2af13dc22f6bc184b63c7618d26b94253e13ac8af655e3ea02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fc66b1-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "7ed5562d-5caf-42be-a751-4c36eab2b37d", "comment": "Malware payload (Dridex)", "value": "f10332d2de9506a0691d7535eb506c9d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "d539e526-fb54-47ca-98bb-fa395dedfc69", "comment": "Malware payload (Dridex)", "value": "2f6e97476d43c095732eb21192be914b9064a1c6aafbcd7b560de06bb92c66d0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "9447a31e-cc96-4151-a002-2f92b197c360", "comment": "Malware payload (Dridex)", "value": "2730163778e4738d109cf9e34ad54866e0f76b03", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "639c2ff7-8cca-41b0-afed-c5a9a8408b19", "comment": "Malware payload (Dridex)", "value": "64347cb5bc39b1945747663ea911f765fd69196c26b1c104f9427ac516c753225acee7e2b74ae241c4ca5458b9004914", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "b0f8dc48-36d0-4b62-b336-6fd27fe75c80", "value": "B814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "14ec0637-f648-4c10-b821-3073cfb2b7bc", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "d6afa092-d217-4d4e-9593-a7778a5adc6e", "value": "3072:2BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:2BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649582, "uuid": "d383e9e1-975d-478f-abd8-46bc9657b0d8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649582, "uuid": "5a578406-6e76-4ed6-bb4e-8ecea6f053cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "dff4a0f8-1cca-4b87-a0a5-9f1a09ab3b6b", "value": "2f6e97476d43c095732eb21192be914b9064a1c6aafbcd7b560de06bb92c66d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61921da9-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649741, "uuid": "a75460ff-f37e-4abb-8e24-952e4d058c32", "comment": "Malware payload (Dridex)", "value": "3a6063e211bf6870eba113d60eb60580", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649741, "uuid": "d97c8c94-09b7-4099-9c65-e2d6c457df46", "comment": "Malware payload (Dridex)", "value": "2f8505da288a8ad329b9a1236411651e2de15c595cafe50682ff1823d94994f5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649741, "uuid": "cef70177-99fe-4aa7-af6b-a945e8d134db", "comment": "Malware payload (Dridex)", "value": "7f786776bbce9d90ff4abda8091336c2a166726d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649741, "uuid": "59680686-f260-4032-af09-49c4374467ab", "comment": "Malware payload (Dridex)", "value": "63a3cfcb1303603c539e96519bc92439ba77b080dafa244598d1c6d7752dcc89728af0589067d2c7a1f52b9865aab45e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649741, "uuid": "b39556a4-8b46-478f-8ac5-ad1a219fdc4e", "value": "E814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649741, "uuid": "f1e99288-8ddb-43df-a856-06d889ea0441", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649741, "uuid": "515f4f83-300b-4a79-85b3-dbb79a9e4786", "value": "3072:MBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:MBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649741, "uuid": "b6132178-7268-45c9-8113-05bc17af3014", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649741, "uuid": "b7aa488c-65d2-4040-a214-4d83c3d72417", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649741, "uuid": "8c359b75-e244-44e2-bac3-cfc01c20dde9", "value": "2f8505da288a8ad329b9a1236411651e2de15c595cafe50682ff1823d94994f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4eba84b-964e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617655062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655062, "uuid": "5ddbfc7b-e02b-466c-9500-9e86ca351e93", "comment": "Malware payload (Dridex)", "value": "ee6fc4328aa86fc0e4df4b5e0e0b1e40", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655062, "uuid": "ed9aa8a3-a5bc-49a9-9a63-6abb53467199", "comment": "Malware payload (Dridex)", "value": "2ffd4870e5921cba39b9c90545601199a68d4d5d4c7988e73f8931419500ba2b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655062, "uuid": "fb0563fb-7973-4917-a30e-6152ae7ce815", "comment": "Malware payload (Dridex)", "value": "d2be399a145d4af6f90e100e8a5c2b555bd25ed0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655062, "uuid": "86a55661-1c12-4511-b1fd-820f5b9c1572", "comment": "Malware payload (Dridex)", "value": "6f452fbf27cf28e450c8918df25b87db9ec9dd9b694bb8eab2b6cd59681b877bad0ecf681f165dc0332be29266f45328", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655062, "uuid": "30c4511c-af87-4f17-b64d-09e50e140739", "value": "1514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655062, "uuid": "49c4ed84-6316-474b-b182-19ea2df5fc76", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655062, "uuid": "268bae73-fc55-4c58-b061-458a3807d1d9", "value": "3072:oBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:oBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617655062, "uuid": "0ac535b1-19c7-472b-98c7-ca31f105dc07", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617655062, "uuid": "2e9ff331-5787-4f1e-b2e5-f0779012647e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655062, "uuid": "d1ecf2b9-4ddc-4e9d-8551-811b6647a3fc", "value": "2ffd4870e5921cba39b9c90545601199a68d4d5d4c7988e73f8931419500ba2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fb10f4-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647846, "uuid": "0fe20fee-29c4-42d9-9519-b2d53bc7fd54", "comment": "Malware payload (Dridex)", "value": "1f05d1fa842b76d769e5df2fd5495692", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647846, "uuid": "9e978822-536c-4cfb-9218-2d1920c713f2", "comment": "Malware payload (Dridex)", "value": "3018b0944d7ef0593426cd6b2a74bfe77a35c9670dbd3a99116c991098057854", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647846, "uuid": "be1334db-b8ad-4383-a0a0-25a1348e5abe", "comment": "Malware payload (Dridex)", "value": "e6b58b5c8ba230d69f7b006d441de95ac4adfb96", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647846, "uuid": "6441dd7c-18f9-46c8-9927-15796586fbf2", "comment": "Malware payload (Dridex)", "value": "e8fbf435ecfa49e6eb34a80dd9f78361e3e2d41068cd304a4be907835e83e7ec670f275ad395a4911071197b98445b3f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647846, "uuid": "4851c31a-e105-47db-a233-8c1aa19428f0", "value": "E114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647846, "uuid": "7ce33037-6c9e-40b0-9f54-34321c359b5a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647846, "uuid": "22197cbd-dc29-4807-9c3d-8c0e364d2002", "value": "3072:fBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:fBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647846, "uuid": "6aa08ebb-5e7c-4ac6-a2fa-e8364cd7def4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647846, "uuid": "3d979ce2-3117-4343-9965-01a5ed68e94d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647846, "uuid": "1028ef15-c889-4fec-8f79-c2a74fde68ae", "value": "3018b0944d7ef0593426cd6b2a74bfe77a35c9670dbd3a99116c991098057854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5db764e-9667-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617665747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665747, "uuid": "4aea230c-4495-449c-aeca-6936a9ff18e8", "comment": "Malware payload", "value": "8e04203444ed5ea1a1cf9940e134e731", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665747, "uuid": "9723ca7c-b948-481b-904c-73674068e31a", "comment": "Malware payload", "value": "302f3a1d5ee8d1c3ecce7f47c8807d24d44e2df142d40a548043d5c92690a5b7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665747, "uuid": "27e68abb-31f9-48cf-b7a8-261ce4522fee", "comment": "Malware payload", "value": "7772ba52cb61bf3a796a9e3b1194dae5317131f2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665747, "uuid": "7164406f-89ea-4272-8a41-424b6807de96", "comment": "Malware payload", "value": "aa3bccf604a4630765154694708ec8614cca9b9c1181a4b545cb7194c2aca5ba909ceb9b05e86db063d5c79decfda491", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665747, "uuid": "7dfa2605-c578-4570-9229-81d246c743aa", "value": "87149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665747, "uuid": "f2169f05-723e-4e1e-b7f7-a001acf43128", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665747, "uuid": "eadd9292-961e-4c64-a751-400d62080746", "value": "3072:l6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:lZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617665747, "uuid": "f3e8974a-d29d-4452-a2be-e8330f8644a3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617665747, "uuid": "8b29a2d7-1b27-4808-aeb5-2c549798cda9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665747, "uuid": "51cf9309-62a8-43ad-a28b-ff3911bd2c39", "value": "302f3a1d5ee8d1c3ecce7f47c8807d24d44e2df142d40a548043d5c92690a5b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc24178a-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646511, "uuid": "a072daea-8884-4908-bf63-c998e5044590", "comment": "Malware payload (Dridex)", "value": "85e94570fc58dc4242958f71c5f97d04", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646511, "uuid": "b35cab2c-4664-4aa9-bbca-3a6971a5aef0", "comment": "Malware payload (Dridex)", "value": "3084d12b4462f321683c2c16e6b9126350f30b35dc08126abc26388ee93d2ce6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646511, "uuid": "b0123e84-a3ed-4f1b-9ecc-da11a6de1021", "comment": "Malware payload (Dridex)", "value": "5c67de9f8fc1cfea74b9de28305ffc951852ec34", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646511, "uuid": "594a557c-6b6a-4050-9bac-c0400221dbc9", "comment": "Malware payload (Dridex)", "value": "a0fd5493f60b10af0ab631cae9d748ed03eca4dac6c1c849cac340b8465875fc22cd7c0b705789cf16c61bd91495bb6d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646511, "uuid": "3b7d7d6d-939e-4588-9d9b-fe5af5169c79", "value": "A5149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646511, "uuid": "695879c5-1933-4735-b124-2c7b16a63d8d", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646511, "uuid": "0bd0ad8d-e50c-4aea-a0f5-38800078e21b", "value": "3072:K6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:KZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646511, "uuid": "296fd1b6-f805-47d5-b951-a6db1799d51a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646511, "uuid": "cb554df0-fc4d-4d2f-bc58-27e7a42a7711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646511, "uuid": "09bff9d9-398f-4a2c-8ebc-84f61687678e", "value": "3084d12b4462f321683c2c16e6b9126350f30b35dc08126abc26388ee93d2ce6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4890e87-9600-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617621641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617621641, "uuid": "b08fad3c-8c5b-46d3-bb4f-4d305f763494", "comment": "Malware payload (RaccoonStealer)", "value": "da6cfd49cbda7f2613301f4040d1cd35", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617621641, "uuid": "dea6d828-fe07-43f9-bb50-1f9045f87d92", "comment": "Malware payload (RaccoonStealer)", "value": "313c10bb9543e370b3017177671899b850975eef576f643ca6648ecef512e114", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617621641, "uuid": "2a38fda6-2745-48ef-a20b-8c0aa0627faa", "comment": "Malware payload (RaccoonStealer)", "value": "314a8e68248e596c72ba1b97039a85d3f4980aa5", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617621641, "uuid": "6f80f534-4c39-407c-a0d3-e09d677c288b", "comment": "Malware payload (RaccoonStealer)", "value": "0ed733effcac6e19aa129440bb24785f20e2eee210722af18bdad7cf03d639da28dc0a0a3cd965da92d68ee714fd87ce", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617621641, "uuid": "b9be5d91-37b0-4a14-ac9e-13e31253e86d", "value": "ADC4E01132E0C072D1A261B54A25C3F54E7B78722B75AACFBBD41AB91F143D1AB3934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617621641, "uuid": "08de1003-986f-4816-98d2-f5a689e146cf", "value": "757fe3cc049352cdae367297a43bdc84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617621641, "uuid": "88b94036-911a-434c-b2cf-449810f45d30", "value": "12288:k0p6pckUhlv85nfDaxoe2yOXe2KWfoz+NYmcpjq1fLc9Sca:rYck4MnfzelOXe2KCoincFqxc9Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617621641, "uuid": "86659695-8b5a-4583-9b1d-fe909456ee0d", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617621641, "uuid": "f5bb70ce-aed4-43a4-b87e-715a1d641649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617621641, "uuid": "75ce694f-f5e5-429b-b1c7-4f6b43ac02ed", "value": "SecuriteInfo.com.W32.AIDetect.malware1.25113.4236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7447bca4-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617604246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604246, "uuid": "95e5871e-b568-477d-868b-8c86bbc23bc9", "comment": "Malware payload (AveMariaRAT)", "value": "b8a397c2bb7b7b13dda84893c34707de", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604246, "uuid": "b61cc821-f237-4b68-a028-2a40ac1788b3", "comment": "Malware payload (AveMariaRAT)", "value": "321b6f97457bc64a7fa264043d5f7ce3b6dc1ddd735daf77820580b2f7ff7a93", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604246, "uuid": "c8610883-e714-4f71-9149-adad8a2133bb", "comment": "Malware payload (AveMariaRAT)", "value": "aaafe2fbb98d4d52b47fab269efae6fb30882288", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604246, "uuid": "dd348755-ad79-42ad-8236-f8d4b29a6086", "comment": "Malware payload (AveMariaRAT)", "value": "29037e7cfb9241db58ba720bc5d2697df68afc7b6f6edf8e775739787f68957917d72032d2907ca2a167e79f02f7a0b8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604246, "uuid": "6a62c89b-890d-42cc-a07a-5feea51b514b", "value": "23B2C981A35C9207F08875B1BBE91204D3E6D5DF7C869F143ACF8AB406C72A54AF495F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604246, "uuid": "c42ef5cb-0dd5-440f-bece-e553f75b88ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604246, "uuid": "b577cd3a-6b7a-4bdb-ad67-b7898e72da9d", "value": "384:wq9dKEjZe3BrN7TxgyJKGmqvY5BCHpRXqmnWss7gf:w8zjaBo5Gmqvb6mnWss7gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604246, "uuid": "3f70dfd8-71ee-4938-8120-ab78b894b219", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604246, "uuid": "394e2b34-8f6b-4d08-a548-f94a288efa46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604246, "uuid": "02277219-029d-428a-bce3-031029dae960", "value": "DHL ARRIVAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4207da9e-9645-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "c68e4b7a-8eab-47e7-91ad-6d0f9a50f711", "comment": "Malware payload (Dridex)", "value": "25ec42ae33706c3528400c68a809af5d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "68ee0e62-800a-4655-8f60-390ac56b3b09", "comment": "Malware payload (Dridex)", "value": "32308c8f222dcff8fce5d487efd03e3c122afef62a19d0e232f20f03deb16a0e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "c06f6873-ca7b-43a7-b7a7-b7c9ca40c867", "comment": "Malware payload (Dridex)", "value": "45b6a89a34225b62d667ef7820cec5b07a9d9203", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "5583b079-19b0-4084-bc99-6defa0e8105b", "comment": "Malware payload (Dridex)", "value": "a62bebec2f19dd1b49973283ad9ed1541a7af88716ed0449da90e8c78f4c74a052417117f955f8c736e159d412218fa7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "62e5115f-2023-499f-a734-bc9f9d6b6b54", "value": "6614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "0a4b5bef-2c6e-4366-8e87-0a4cd94684cb", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "79f38b02-8c07-4b22-a936-35cfa7396faf", "value": "3072:wBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:wBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650976, "uuid": "c0785eaf-5198-4c93-a3d5-433d33738ee4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650976, "uuid": "1beae65d-6a17-4458-a796-5bfb7408b606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "c6e4bfe1-5e15-4371-9705-27940fca3dac", "value": "32308c8f222dcff8fce5d487efd03e3c122afef62a19d0e232f20f03deb16a0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afa6a13-9647-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651958, "uuid": "2b74834f-ed9c-4f66-91a8-f61e382adebd", "comment": "Malware payload (Dridex)", "value": "e1cc9fe1f8cc05f8e659b60ba07fddc7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651958, "uuid": "c56a5b7f-c215-462e-a56a-b5abd4c3641b", "comment": "Malware payload (Dridex)", "value": "3317d1f402397cf81dbb7ec8564e5bbf2b64fe3f9a2508ece241f5d0958a87f3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651958, "uuid": "0bc65ed1-a7c1-4b8c-9e57-3da69e660385", "comment": "Malware payload (Dridex)", "value": "a3970d52782dec7008a75fd80a06f11cc1d13eb3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651958, "uuid": "29461bd1-b9a2-433e-b67e-e71eacfc1364", "comment": "Malware payload (Dridex)", "value": "a24e6d8d6e05c8398be385498145e2818641d5d4ce43eb456f77dbc7556035baff208a499b3f93495edd11a18127df87", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651958, "uuid": "4e1db77f-fafb-4696-8ff7-55c9a50746a8", "value": "0614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651958, "uuid": "a066defa-4378-4c47-8390-4ce783e7e846", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651958, "uuid": "27eb67ac-3b61-4455-b90e-ab4d359314b9", "value": "3072:JBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:JBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651958, "uuid": "6b17d7bc-fcac-4a30-a043-a6c397cc3d79", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651958, "uuid": "2a00ef61-e1bd-420a-832e-9404083ac8e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651958, "uuid": "fbbe145f-ba10-4c59-afd1-bb557dbf575f", "value": "3317d1f402397cf81dbb7ec8564e5bbf2b64fe3f9a2508ece241f5d0958a87f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1138d9-9612-11eb-abe1-42010a9c0039", "comment": "Malware payload (Heodo)", "timestamp": 1617629060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629060, "uuid": "d46113c8-bbad-465c-92d9-b750534075c5", "comment": "Malware payload (Heodo)", "value": "482d5eeb93da4af923922a49746219c8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629060, "uuid": "2efe42de-d754-4505-895d-c450491961a7", "comment": "Malware payload (Heodo)", "value": "336eb996b05cc6c6e5c6d2a4fdc13c1a686dbd710e1bc3e6050472247cd50145", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629060, "uuid": "3e10b3be-894b-440f-b8ff-1ca151677cd6", "comment": "Malware payload (Heodo)", "value": "4f62946bb88b31a4b219df93009f5cffba1dda3a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629060, "uuid": "55590cd1-9ca1-42c6-bf19-41950d59bff1", "comment": "Malware payload (Heodo)", "value": "0fd82bd9719487909611867835591eb45a574a71d70d0a0b75554aecd0943a24c4f58d9943edc6a7f707a4f901b2eb85", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617629060, "uuid": "5a8782fd-9605-48d2-9366-19739006fc42", "value": "BE04811FB6D8CE6BE52871B86B035FEC1F636E0D9C8166FB51313F4A38772624848199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617629060, "uuid": "5921309f-ac57-4f61-99e2-c912c20dc6aa", "value": "3072:VwT4OUNzBgQEPcnc2vTdcrrXyQBsc0vWJVi4IrwVdZPt4D5bdYPeFmfG5/+vGeou:VwT4OUNzBgQEPcnc2CPIIMcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617629060, "uuid": "fe2c15e8-c5d1-42a3-a7ea-77c873e11567", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617629060, "uuid": "92959187-99c3-4e31-9b2b-061e05dfd705", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617629060, "uuid": "8fa93658-7bfb-4884-999c-578e3facb215", "value": "Sample.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab683a4-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650427, "uuid": "261cd36b-4709-4447-87c5-fcc6f953d595", "comment": "Malware payload (Dridex)", "value": "f05431df7cb0a025f09ef12df4ac9e37", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650427, "uuid": "04b81737-5e19-4404-a2a9-70ab8d2c6e1d", "comment": "Malware payload (Dridex)", "value": "3471f273c8a5131cb6b5cb85f6c1f828b96566997e5af01e99a5b842598b6d2a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650427, "uuid": "cbf27381-299b-4676-b16d-4b40d2da916e", "comment": "Malware payload (Dridex)", "value": "dd7a3966de4ae4c40ca8b28097214a1f708dc248", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650427, "uuid": "191c5d30-b106-42d2-b55c-54a6e1eebf58", "comment": "Malware payload (Dridex)", "value": "aca6cccd4bff4db2b3c5705739a224ce614693d6b97294c5876b40337a0a042d2f6e01531d94fcc0af38628fa697a99d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650427, "uuid": "138a842b-73d0-4b18-a5c2-4061a431b34b", "value": "9C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650427, "uuid": "8f0e76a0-a219-44d2-a5da-9977853e9121", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650427, "uuid": "6c8a9eca-5e71-461d-80fa-ff7aa2a57b2a", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650427, "uuid": "0e267ecf-76c9-43a5-b733-fb3b495ea034", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650427, "uuid": "dc3a1d80-7bdb-4219-af40-649086fff021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650427, "uuid": "18acc954-eff0-490b-aa6e-47a979d07685", "value": "f05431df7cb0a025f09ef12df4ac9e37.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1385877b-9644-11eb-abe1-42010a9c0039", "comment": "Malware payload (ServHelper)", "timestamp": 1617650469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650469, "uuid": "7f796e05-a602-4a0d-945d-e488d93f586a", "comment": "Malware payload (ServHelper)", "value": "cbaa090104209f49dd1711191f93381e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650469, "uuid": "2c0b9142-9b91-4100-a458-b3bac1f6bfb0", "comment": "Malware payload (ServHelper)", "value": "3483fe37e2e76078baf3aa19bd3709bed4c8ce95757debb368c4415009a5a24e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650469, "uuid": "67bbd894-c05d-4ad9-a337-0e642fdd1163", "comment": "Malware payload (ServHelper)", "value": "545325f4fead17fff4d2ca97ab78f75837f8dd59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650469, "uuid": "6c618b15-dac4-43dd-96c8-9b188ff0231f", "comment": "Malware payload (ServHelper)", "value": "eaedd999f576d5827910c69c36829c754cbd9265d4aa1b8bf00fe079b68ca3e34fddcb9c1af1f1e36d973a77e71959e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650469, "uuid": "01c1bd16-8471-44be-a918-4c0a7e9c863a", "value": "4F56E012B8D208FAC17EE1708596936176727CA487323BD72EC4766A1AB5FE42F3D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650469, "uuid": "1bf162ef-7c5c-42a0-af29-b50adbfe17cf", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650469, "uuid": "995ed80e-020d-4025-8021-7646c5b49f3d", "value": "49152:kUlCX5h1mLjAzcvG53voOaks2oU8vaQmNpcvYm75UPCiYN3KVTniUXOP4ErwU1p:cXb1mXA4nDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650469, "uuid": "83581461-60f7-4906-9871-2d2244ed4fc1", "value": 6340608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650469, "uuid": "6fa856d3-834f-42ae-bf93-33f12cc11c5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650469, "uuid": "12059f80-4929-426d-9f07-7c64cce398f3", "value": "cbaa090104209f49dd1711191f93381e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd43ec5-964c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617654080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654080, "uuid": "2db7c5a7-c0f3-4364-b3d9-613a789c3121", "comment": "Malware payload (Dridex)", "value": "7da3c7da540016b011b0f8b80690b342", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654080, "uuid": "93092be7-d106-4ddc-8e9f-f33450ed7be3", "comment": "Malware payload (Dridex)", "value": "3546b514d55c8ef510962163cb76a2301432204ab32280a5bd258fe7c91adcda", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654080, "uuid": "1a0de18f-bede-41ef-8d83-a30b2ca4a3cf", "comment": "Malware payload (Dridex)", "value": "79d6b4b4e8bb89213b26f7d2c1640e152092f531", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654080, "uuid": "7ffb8d6a-07a3-44a7-b702-dccc3f0714ea", "comment": "Malware payload (Dridex)", "value": "3bb4bf4c018fc3b48738519dde1788c9af9188c48fd7b3eb9d1cf2af2b72f09c1076c94d66ba32dd5a6f4b8fd432cedb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654080, "uuid": "484e551e-8820-4fac-9328-43d640d593d4", "value": "2914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654080, "uuid": "7b425541-d884-4bd8-8ae6-290e64ea8401", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654080, "uuid": "2f6d1902-8d4b-4fc0-8b03-7086d186916a", "value": "3072:MBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:MBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654080, "uuid": "764ae574-ac1f-44e1-be9e-e2b361783b73", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654080, "uuid": "63760b6c-b443-4c48-9d3a-d48d918bdff5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654080, "uuid": "38b46447-6ab9-408e-afbd-c6dcdf05a124", "value": "3546b514d55c8ef510962163cb76a2301432204ab32280a5bd258fe7c91adcda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bd0231-9644-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650446, "uuid": "66fa9d02-ea7b-4070-816a-061147085f08", "comment": "Malware payload (Dridex)", "value": "dd42284edeac704e0a3ae45869b9ceae", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650446, "uuid": "25676be8-1bf0-4793-ae0f-1b5f646d24c4", "comment": "Malware payload (Dridex)", "value": "3594926242d919abf9875320dd83927a7f03d5e7e15df060cebb6af7a69a368f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650446, "uuid": "a3bffd4e-53d6-49a3-9355-1b165cb158c8", "comment": "Malware payload (Dridex)", "value": "b40edd7cf3b34773f73457a2dfab761cdd1cbcef", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650446, "uuid": "fc37f4ec-ded8-44d9-a5b7-9a4f3c4efdd7", "comment": "Malware payload (Dridex)", "value": "c64e6e9df2c5d29adab395201ecd63c12cd8e0cf94efcfa7da50f5f7398562b8c5cb0827be13f8b5fe2c9d4301f8faa9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650446, "uuid": "e34429d4-6677-4a71-bc6d-00331eeed732", "value": "1314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650446, "uuid": "ffbe3bf0-4d35-4e6d-aef7-b7dc4cdb1e5d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650446, "uuid": "afe13bad-ae84-4ae0-ab5d-6e0e6eadd93e", "value": "3072:RBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:RBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650446, "uuid": "b4875a47-46bb-445b-8166-07fbb5d6d897", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650446, "uuid": "a8db7874-897c-48c7-abf5-af780b1a68c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650446, "uuid": "0b21c418-a320-49b1-a9ef-91ea3b4f9d22", "value": "dd42284edeac704e0a3ae45869b9ceae.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417e5164-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617627353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627353, "uuid": "50e0ae63-95ed-4127-b96d-30b104f16280", "comment": "Malware payload (AsyncRAT)", "value": "a5d997b0cbb6f535c8dc3e28cc62afd4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627353, "uuid": "13b5edc6-9c0d-4f3f-87e4-e4bfc8115b12", "comment": "Malware payload (AsyncRAT)", "value": "35dcbf854bded7a05d9c724eae755e272f9c976e9202217195eebcf9abead846", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627353, "uuid": "06cbaf91-f10a-4227-a158-eeb3b9a117c6", "comment": "Malware payload (AsyncRAT)", "value": "38918592ce7e1eab6707fb3561d2805771b2e3af", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627353, "uuid": "6f1b40f4-99f0-4d55-bba6-091e44938cf5", "comment": "Malware payload (AsyncRAT)", "value": "662ba7f33f8fc0b542322fd1beedb932266206391477363427a4a6d7c73f149fd2c060c952817d8753ea5c7f04570140", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627353, "uuid": "79492b0f-3450-478a-82da-fbd3a915167d", "value": "3CD4F120B3CADB06E42937F59AA7900743B9F1ED6913DBA80D9853D6302574C5DCAEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627353, "uuid": "6c6c1f2b-95d7-48b9-8510-1e62b36952b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627353, "uuid": "177a002c-f7d1-4e87-800b-6011a52b7519", "value": "12288:vofCE1Jj6a9nxonV6R2I5tGsTnKRuQJDBClmHpGFdwKXKh3QF3Ch:voaE11xzbUsT0rqlmHpYpjFyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627353, "uuid": "d16b9956-32c5-4835-854e-46a6d1d30edc", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627353, "uuid": "0faf9007-584f-4434-b06e-14b71309c5da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627353, "uuid": "b6f62fe9-b88a-4e03-acb6-481076711b88", "value": "a5d997b0cbb6f535c8dc3e28cc62afd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a80ec5c-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604256, "uuid": "d251d228-fa4d-444a-90b9-3d9c1093260e", "comment": "Malware payload (AgentTesla)", "value": "f90a156866c5d6a9f3d388d50348d7ca", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604256, "uuid": "3c490b20-8053-45f1-8e05-79483245c3ee", "comment": "Malware payload (AgentTesla)", "value": "35f024728f43c10ff3bda2090b9333b12bd5a3ab5c4e4f9a68fa1b4e93ff651e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604256, "uuid": "b70797a7-5202-4d7b-82e5-d4cc2475d5e2", "comment": "Malware payload (AgentTesla)", "value": "ded25a06900171f6c46e2f2e32745d335b016713", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604256, "uuid": "9c12d9e3-15bf-45cf-acf7-461ea33d0c6e", "comment": "Malware payload (AgentTesla)", "value": "f769b56fe613ea2ee16a50aa655437ad72c97d2e275ada55098d8157839e29bce3751c56f92622cfd8ea2cd6dc8ab2b4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604256, "uuid": "48750859-b9dd-4f72-a9f6-9361f487d236", "value": "5CD433E2C4B09D1B894FFB8EE5A6D66D7E8747E41217DA40677E0BC38105BB72214CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604256, "uuid": "0ea8f653-2568-47c0-b3ae-3a602d95b039", "value": "12288:2tRUNg7mNYiLT+XMcJ3XiFvsFGyOLaozSegI0Y+kCq:sRU67mOASlpF/Yao2vkCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604256, "uuid": "8ce68263-9a61-46fd-be71-cfaf61ecaacc", "value": 615855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604256, "uuid": "d48a51a5-2621-4d8b-93d3-30eca43c892b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604256, "uuid": "33d181c4-5b2d-4d75-995c-c4eb31324090", "value": "Port DA MV Erge .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228d2362-965b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617660373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660373, "uuid": "2eeb5c37-4658-4833-9b07-3a218d78b5bd", "comment": "Malware payload", "value": "acb09f5cc6f4ce03fda1d121740914df", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660373, "uuid": "36b7d20c-fc27-4c88-b5da-708e27e269db", "comment": "Malware payload", "value": "36091cfea5b30816fa31a42349d2d40f0879697273ef6907540fb312233760aa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660373, "uuid": "34e82d52-de53-45a0-a69a-c7996aa04c7b", "comment": "Malware payload", "value": "f4bbad243758753611abdfb380829e5dd93cbf49", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660373, "uuid": "a180cb64-532b-4955-9e2b-d936aae9456b", "comment": "Malware payload", "value": "9714d1c06d830e32a4d8ae949e61f5dffa65a51817acba0bb153748481c448acbff661f1a53026eabe3bc8e5575dc79c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660373, "uuid": "0969aa64-00d1-483c-817e-060536247b8f", "value": "6C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660373, "uuid": "4c983e7f-c969-419f-83ba-6c2288d7e0aa", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660373, "uuid": "1f1d1358-754a-42b0-8d03-0afb13fd8468", "value": "3072:IBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:IBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617660373, "uuid": "cd6e126c-1797-489d-80e2-df83add6a8f1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617660373, "uuid": "ea9b0dee-1ea2-4e0a-9d3c-40cdbca8588c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660373, "uuid": "ad3eeb6b-ecea-4ddf-961a-51e2e54a51c0", "value": "36091cfea5b30816fa31a42349d2d40f0879697273ef6907540fb312233760aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536a4464-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644563, "uuid": "84ef641a-5014-4b1d-bdc5-29aea4506787", "comment": "Malware payload (Dridex)", "value": "67d419242db8a33bc6917f7001960503", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644563, "uuid": "d17a8cd8-7ef7-4227-8a78-6611f6741fb1", "comment": "Malware payload (Dridex)", "value": "3753927b638f2da476c5425a5252b7ff51bf5adccc3f8905bd694ea8f596960e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644563, "uuid": "6d19c5ca-7d5c-4a0a-85bf-356f72da469e", "comment": "Malware payload (Dridex)", "value": "c2dc6a783ca2a53657a96d198ebf6c6c2ec29d12", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644563, "uuid": "f0e8c4e1-8646-4b70-b512-0d521ddbca4c", "comment": "Malware payload (Dridex)", "value": "ce7c273447c0a2b47665ab410b4d355f81934dbdb1bc21ee6c7f2c6b5b34fd473ffd2b5237615eb16f9a9e192814693f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644563, "uuid": "04ee86ff-5616-4f04-8fa0-2fcf054978e7", "value": "C714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644563, "uuid": "1ee2dcc7-3753-4627-966a-29542c63be63", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644563, "uuid": "3c5012c1-8cae-4903-8798-096870f7c3cf", "value": "3072:BBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:BBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644563, "uuid": "825b4c91-702f-46d3-bd1f-2e908df13a70", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644563, "uuid": "d20e03de-54bd-4ea8-b655-2bd08f82c2cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644563, "uuid": "4890aa2c-5a91-4ef4-bd23-4ee28e486fa8", "value": "3753927b638f2da476c5425a5252b7ff51bf5adccc3f8905bd694ea8f596960e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea41a3a2-9651-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617656413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656413, "uuid": "634e8620-b38e-42ab-a58c-e0b3967a9c58", "comment": "Malware payload (AZORult)", "value": "270ed0b099c269f4505da20a35956a1f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656413, "uuid": "330f9857-1cf7-4f9d-bae6-f2c2f383ce3c", "comment": "Malware payload (AZORult)", "value": "38806d8372f8465c4775009362b83b94024fc6a280e3c83c476dec3852bcd2e6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656413, "uuid": "5a82b743-fcdc-4863-b4bb-b48a31eff5bd", "comment": "Malware payload (AZORult)", "value": "54990b8e1331f68ed52b46f1c365e18a46de8326", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656413, "uuid": "0315fe16-693a-4238-8e7f-2c4af5ee4e51", "comment": "Malware payload (AZORult)", "value": "8811a082c660d6cae5388121c21461ddec7436ecd4f664b3b4ec99521ecfb8b8c074355195541f5d807d0ba263710c61", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656413, "uuid": "3153a53a-20e7-4b50-a38b-e38228d090fb", "value": "04B3196EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656413, "uuid": "55557b5a-1c42-4298-b5b1-c60d5a7d38b3", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656413, "uuid": "c388794e-f479-4bef-a568-1b2f25320065", "value": "3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeheWginlq:faO1tme+1win8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617656413, "uuid": "8d726de1-9e49-41c7-9cc1-3cf7d48fba2f", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617656413, "uuid": "6cb81e68-a27a-4bf1-9007-d8db4c155d9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656413, "uuid": "68331fc8-d3bd-4731-9279-6acfcb7e6cf6", "value": "270ED0B099C269F4505DA20A35956A1F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8746db26-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617615015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615015, "uuid": "e1699758-19fa-404d-a8c2-d360d3cfd09a", "comment": "Malware payload (BitRAT)", "value": "d415e0455e926cb830e089caf1ada218", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615015, "uuid": "e124e4a0-6c74-4858-b311-87abaf364bcd", "comment": "Malware payload (BitRAT)", "value": "3936db5f71715f5ef3c4807c9fe0913943ae3b0aa3f000f40ec95558789a2450", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615015, "uuid": "5fa3e5f1-2841-4f36-92ab-9894a9bf2db8", "comment": "Malware payload (BitRAT)", "value": "ab2886e44b893746273e557072b5e485f48d93c2", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615015, "uuid": "2b8081b9-767d-4db4-bc82-c5c0cd4a48cc", "comment": "Malware payload (BitRAT)", "value": "d385014823151c186e3dd4341d366146c178e09f94d580caae053e5ff58268e61b477abf69f8542845cacefc751671f4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615015, "uuid": "90ab4f1f-bcd7-4964-87c4-25f2d49281b9", "value": "A5B5231073DBDAA2E86A37F6D9A2C40613B4F0C47423D7584ED5A2C9325670D0EDAEE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615015, "uuid": "90a129f7-87c1-4401-8145-945d9e4aec59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615015, "uuid": "3080b136-ddb5-4edf-9d0f-3b0f5b403e93", "value": "49152:Pt2VdS+BfRvSw+2MybNvfep12sw+PUhQYkSnyidQPpxl:PIVdXBfRr+2VxOb2sw/hZ5ZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615015, "uuid": "6fee039c-3cf1-4e55-a176-a5c5fdc152c0", "value": 2482176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615015, "uuid": "2d4f4f85-1bc2-48c6-ba8d-0cbf98b869d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615015, "uuid": "5598bef6-8700-4916-986e-c9c8a7850b33", "value": "Payment Copy #6578965432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d0c805-95d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617602579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602579, "uuid": "fb38449f-25e2-4e4f-9929-5c959a75980e", "comment": "Malware payload (RemcosRAT)", "value": "a835c67afec8ad2a01bb09c3e5b24dd8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602579, "uuid": "ec5b4c23-a105-4466-baa9-c62b680714cf", "comment": "Malware payload (RemcosRAT)", "value": "3966b4d4d55cc4b7e85f1b0bbefff031463e4de4b3ab4f33d879f648a05335d4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602579, "uuid": "1cb75eea-7689-4a73-a760-38dd34ac8a02", "comment": "Malware payload (RemcosRAT)", "value": "8cc5ba016438cb0ba794c6a44b0551a3f8749ecb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602579, "uuid": "c727f43e-c237-4305-81c3-d379ad2a348b", "comment": "Malware payload (RemcosRAT)", "value": "7ce0f76dded31e8d4c1a39bf31eb3624fb2bee3bd8be844bbf976b53fa143af36c13882e0c747bd1cf0bbabaf78fa8fa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602579, "uuid": "3e0fe447-8329-4df3-a9b3-f63a02739224", "value": "1C9302DA7A2A8138FB12F27C52D6EEC580E034FE9D13F4975642B0C81D299B59D738C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602579, "uuid": "59a9027d-1e96-4f30-a1d8-677c08443b6f", "value": "1536:77YTuUqTWUQdNkTo64ExewVny84RSnvnTIt3FIaxm4MPAoszOSJszb96CSCvmu:YSHQdzExesvnTIt36/4MYos6gsn9Jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617602579, "uuid": "599d3d6e-ac01-4db6-8fdf-de612131ced1", "value": 91319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617602579, "uuid": "7c2e5976-5b49-4b45-b33d-adb5fa3e08cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602579, "uuid": "e299324c-8a1a-4f6e-a135-2c8167581b2a", "value": "PO-21055-COPY.xls.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc0973c-965f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617662188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662188, "uuid": "5e58fa93-117f-486b-a123-25fb87661429", "comment": "Malware payload", "value": "11f6699c0a814aa6fd21d6d05c9ab6ff", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662188, "uuid": "548cfd5b-1919-418f-a7ef-8f6350ae85e2", "comment": "Malware payload", "value": "39a7b8e12e0ff156e47840e7eda4e07df2545fb9ce96ede14c82c4113f38477e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662188, "uuid": "b6c0d3f7-40ee-48de-aff6-cce994804942", "comment": "Malware payload", "value": "4ba9951056214da74312c9799846be9f6df28454", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662188, "uuid": "b82ab392-dad5-482f-915c-b15efff2b17f", "comment": "Malware payload", "value": "156659b5686d0136ba8c75829da015500acc466a2f041f2c44164cec53d2a5aa4991ca679dfc15210075aaecff371d1a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662188, "uuid": "9cecaf21-0e54-417a-96ee-0b12eb6a9f3e", "value": "D314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662188, "uuid": "115067d7-6cb8-4f7c-a693-b26ffa1ea6bc", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662188, "uuid": "9fe41264-e2c7-4998-975a-509dd9888332", "value": "3072:9BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:9BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617662188, "uuid": "337d8391-1fe8-4b92-80bc-a471a2fd8d65", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617662188, "uuid": "86eab212-f221-48e5-b7ca-8676b8ef691f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662188, "uuid": "7f490764-f58f-4d9c-8cbd-8e78758ec797", "value": "39a7b8e12e0ff156e47840e7eda4e07df2545fb9ce96ede14c82c4113f38477e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690cf55d-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644599, "uuid": "431616fd-cfe4-47f8-bb5e-444decbcbb9b", "comment": "Malware payload (Dridex)", "value": "76634d238964e92cb9a11bab8560781d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644599, "uuid": "d1f09236-67d0-469d-8cbb-d66402def9a1", "comment": "Malware payload (Dridex)", "value": "3bf9fd03a6b7c898c3851d94614b58b05b705bd8ca8c23be2472d0e3bb29d443", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644599, "uuid": "d27540c4-d114-4552-85ac-32d420a61f20", "comment": "Malware payload (Dridex)", "value": "c6ad4342a4f3329f7a6721b08b585f9e11da2979", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644599, "uuid": "1cd28df4-f9b4-4ce2-bab1-ac00e2dd7414", "comment": "Malware payload (Dridex)", "value": "45c26893deb45d688e6489e64a591443441db5d23e96b3eb182269d0c58eda217952d2df68bfd6afaf71e0cc588dcacb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644599, "uuid": "e8d911ff-3fac-4256-9763-7ccc8b517c68", "value": "C414AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644599, "uuid": "b593fce6-54e6-4c1c-b474-b5d0965d2cfd", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644599, "uuid": "7ac6de0e-beb1-430d-820c-c96240570616", "value": "3072:/BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:/BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644599, "uuid": "7f7080d4-157a-4a84-972c-e8010c1543d1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644599, "uuid": "68ff30bd-4d5b-4bcf-9409-5e0bc49fffee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644599, "uuid": "7aed46c8-1846-462c-825b-f72beed3efc0", "value": "3bf9fd03a6b7c898c3851d94614b58b05b705bd8ca8c23be2472d0e3bb29d443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66811b6b-9656-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658339, "uuid": "88cee731-3bfe-42d3-8bfd-ac9e84cdcae1", "comment": "Malware payload (Dridex)", "value": "490b1711d820fa044b3545db19e96615", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658339, "uuid": "2debbad2-e761-44e5-81f8-1ffbfb105e11", "comment": "Malware payload (Dridex)", "value": "3cac9e16b93fa79e2881eb173ef8c01d40f2376cb56538930ded9cea698e028f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658339, "uuid": "f7771d78-eb5c-44bc-9caa-9a451f552a99", "comment": "Malware payload (Dridex)", "value": "35b46a9fd92dc9883ca5b09fa5fae66b67669e30", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658339, "uuid": "86d4e506-2a92-4aa6-8ca2-762bc077e9f5", "comment": "Malware payload (Dridex)", "value": "ee767ebfefcae9985b1b37fd9b57823fa0052153635714ca89481008aeede2a4ebc8dac89a3660c71f251795da6f80e7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658339, "uuid": "2143bd5a-f337-4136-879b-227ae76fba13", "value": "B1149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658339, "uuid": "08fb5620-38ab-44d7-b9d3-ec26cae35957", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658339, "uuid": "5744f0f2-1fe4-4c5d-957b-0f2110d3f03d", "value": "3072:L6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:LZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658339, "uuid": "2a72bc9a-12e5-48e1-88de-cc00efd2d7c2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658339, "uuid": "39d45e2a-0566-4733-b346-99031abd15e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658339, "uuid": "3f3f2527-5958-4b68-bea2-5f8f4cd4d610", "value": "3cac9e16b93fa79e2881eb173ef8c01d40f2376cb56538930ded9cea698e028f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f8b332-95f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614741, "uuid": "65562e4d-396a-461e-af3c-5463ab97c4c1", "comment": "Malware payload", "value": "08fe09bc6948799da8cd0b2e90f7c319", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614741, "uuid": "a278718e-0847-474b-ab13-a66c7214d915", "comment": "Malware payload", "value": "3cf73175397d134b891111c13bb7b6098ba3e37d630b2d31c162a7e29771ff17", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614741, "uuid": "8b763559-1621-4f2a-b9f4-8591451941b8", "comment": "Malware payload", "value": "c648cffd12c31237578a6891744cca28695d5171", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614741, "uuid": "7fb16faa-7451-4d88-9b77-7a85e16ddde8", "comment": "Malware payload", "value": "f963b4820db3d37b21f9bd1e7eb337344d68ba9ab4f4af3fbc28c409c66523e0b2df842eee0a929739024a5c771dcbc9", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614741, "uuid": "27b6d8a1-9ef9-407f-9dbd-23714f743a91", "value": "C2663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF63AC5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614741, "uuid": "2f810abd-8056-4a8a-a5d8-28632b394e47", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614741, "uuid": "b0646b33-0c54-4151-a459-45e1c10a625c", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKaz3:kfauN/HYOSIT/EVF9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614741, "uuid": "f2a33385-a8e2-485a-97ba-ecc699877b51", "value": 6967343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614741, "uuid": "3879d335-6914-4915-ac23-4d49d9096c46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614741, "uuid": "530a2b89-e7a1-4ea7-a623-aa25b6564779", "value": "3cf73175397d134b891111c13bb7b6098ba3e37d630b2d31c162a7e29771ff17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444540cb-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "ca46acae-c9aa-4638-9182-6e6981e3961c", "comment": "Malware payload (Dridex)", "value": "0aa6f32626ebe95722ae744be5f87af9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "ef30ac9e-565a-4d91-b905-c7c1c34e1423", "comment": "Malware payload (Dridex)", "value": "3d0f67d6078400afbd1b22024e031793ef234857b8ee8f39ae05755eb7b7b6a2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "2f3ebb95-b85f-491c-be85-bc40c8e045ab", "comment": "Malware payload (Dridex)", "value": "0dac20483badc7f75b985c387cd0da9795335777", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "480d1399-6986-40ff-8db3-ceb91ff21a96", "comment": "Malware payload (Dridex)", "value": "ef7b06c4b78bec5dedf112905f0b78522b6e10348246e0d5e6d98c452a928ef186a34f3895cbaf1713015f35c11ceb70", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "c3b3cb21-f35e-48a2-a0af-b4af207abd29", "value": "9414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "8e04da6e-2b24-447a-9d25-890c3c97ae32", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "5ecf341b-025d-43d5-a0e9-9cdfd8aa0216", "value": "3072:KBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:KBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647974, "uuid": "b3a0f82a-5e0c-49d6-ba8d-03494c3d1cef", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647974, "uuid": "81e10834-0a0a-48ec-a4c4-ffe1d6f65662", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "0667f1e2-76ef-4340-ba1e-0542737df5c8", "value": "3d0f67d6078400afbd1b22024e031793ef234857b8ee8f39ae05755eb7b7b6a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbf8aee-9611-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617628793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628793, "uuid": "b331b547-d081-4f29-b7c7-3cf50b1ce781", "comment": "Malware payload (SnakeKeylogger)", "value": "9551e35ecf18617721b6c2a4f175fe46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628793, "uuid": "01ad762e-7735-4b17-be14-96490ad19b46", "comment": "Malware payload (SnakeKeylogger)", "value": "3d915e89eeb0c4e1793beb2c85a12116ef93b822fe8af88156dcf54cf5362fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628793, "uuid": "9535a842-06cc-4876-b2fe-09000d50d1e5", "comment": "Malware payload (SnakeKeylogger)", "value": "2e50b50394d17bcbea727bba6bb86cb53af6cdc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628793, "uuid": "2ac97efa-d078-4406-bc14-93d3f5e6b963", "comment": "Malware payload (SnakeKeylogger)", "value": "47b1fdf062442ca80ede693203750960e7160866ceeb8a20769ca4571c5a13436df468d7d8689ff6f499affe53dad079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628793, "uuid": "16927d9a-3fcb-413c-833a-6ad2f23b7d2f", "value": "D9F40120B3D9D746E07937FA8AA6500683F5F1DC3413DB6A4D8962C72161B4C4EDAEE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628793, "uuid": "c6eaad47-712a-42ac-944d-e9fda8399cf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628793, "uuid": "c24a51d1-ff36-4b79-8c28-0ac71cbf16a7", "value": "12288:lJA3YsSIJjx1tdYTVeA/8aCpJA+SefpFUk1sdak6K4+PqHuCsF7Qo:lJAIsjJwV10aCJsefIYWak6SWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617628793, "uuid": "e432177b-41b7-47d7-b37b-2e251010276b", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617628793, "uuid": "c7592ff6-79ff-451d-b55c-027bf90005a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628793, "uuid": "7c61f973-3ad7-4997-9d1d-55a2fb1c18e9", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc24a916-964a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617653436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653436, "uuid": "30289464-ed06-4b83-a05f-bb979dc92d70", "comment": "Malware payload (Dridex)", "value": "adf30f58eb4d3f85bc8f81e6fd77d68b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653436, "uuid": "626ed61c-acc5-4187-93dd-2edd15ed355d", "comment": "Malware payload (Dridex)", "value": "3e06354459759da76a9f97c7b862f64221300a9cbbd9bc76f55149deba354338", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653436, "uuid": "d2a7f62b-0302-45f9-88ab-df7c800e16e1", "comment": "Malware payload (Dridex)", "value": "715d92ee139de7318434a2cbb293edfeac738839", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653436, "uuid": "eca7c4ee-6197-4d2c-90ec-ac9ed6bd0fae", "comment": "Malware payload (Dridex)", "value": "4203e2c0a5d07c3182e878cb4d1fb0137ec2f5be12fef40caddb5dddbe2425780a791da87a112440099976a5adfc0212", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653436, "uuid": "7fbeb313-0292-46d0-862d-545c0a6e1cd4", "value": "D914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653436, "uuid": "4349e737-35c7-40f8-baaa-f9273dfd19f3", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653436, "uuid": "3c93fa18-4595-4894-8ed7-1c51b7106de9", "value": "3072:WBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:WBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617653436, "uuid": "f07fb8ff-4783-40a7-b722-1c2db6e636dd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617653436, "uuid": "42e51b07-ce62-4406-89b1-341817876598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653436, "uuid": "e4f39334-1a0f-4da2-9661-3c42efec7975", "value": "3e06354459759da76a9f97c7b862f64221300a9cbbd9bc76f55149deba354338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fb48a5-9650-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617655785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655785, "uuid": "358a22aa-2792-4072-823d-f69468c2b308", "comment": "Malware payload (Dridex)", "value": "a42be4a105c8007fdb70dc3e053d4431", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655785, "uuid": "e3e11902-a39a-49c4-a766-989733259aa7", "comment": "Malware payload (Dridex)", "value": "3e7cc40084bccd95672c087442039054769c7e69336d863c16a73358d20cbacb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655785, "uuid": "2014b4bb-86bc-46b6-9eba-776b91e1bc3c", "comment": "Malware payload (Dridex)", "value": "11f493b0f005844799cc11ea2a92b18ba1d2aa6c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655785, "uuid": "319b6293-9388-4fbf-9cee-4186fd4db561", "comment": "Malware payload (Dridex)", "value": "638f4093cdfdf16a686c3a6902b296dc2359422c72a24d4ba8d31f938018ef7d4a8ab82c865184f204f53c453ecb0906", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655785, "uuid": "c9568114-94d6-41b8-9074-3cb5ac7c717e", "value": "0014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655785, "uuid": "211d2fd6-612e-43b7-be94-0443dde3a4ba", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655785, "uuid": "c1e65071-678c-4772-befe-045adf4ad988", "value": "3072:YBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:YBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617655785, "uuid": "a2945f7a-e752-4949-9cfc-79ca2c9cc6e3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617655785, "uuid": "6806091d-28f9-43bc-b9e6-13973e8501fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655785, "uuid": "31592941-9309-4935-b548-78a9ecaa2ce0", "value": "3e7cc40084bccd95672c087442039054769c7e69336d863c16a73358d20cbacb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2aa626-961b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617632978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632978, "uuid": "53449795-f5a5-4193-97e5-c23635f06d23", "comment": "Malware payload (RaccoonStealer)", "value": "e670238bcd7f028acbf39a8c35332215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632978, "uuid": "2ffe4646-3f77-4d88-a323-b8ae189d7396", "comment": "Malware payload (RaccoonStealer)", "value": "3f7631475db3c73d38a22ebdad553d0b0a430f7f570f6878aec9d69742c3e349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632978, "uuid": "8812caba-0964-4360-a0b4-d8c832f4aab1", "comment": "Malware payload (RaccoonStealer)", "value": "c18bb403c7086ab779f372dba1387757f69f45bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632978, "uuid": "02116594-81ae-4ba7-8ef2-e3ac7fcaefae", "comment": "Malware payload (RaccoonStealer)", "value": "6b173cf15d64799e3e9db5de0aaf451498c4589d4d888560463daa24822fc52e83ca9e8cb8035de7a2c94acae9cdbb8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632978, "uuid": "78d4bbc3-1dbd-4553-9cab-9b3ca552aaeb", "value": "AFC4E01232D0C032C1A265B55669C3F14EBFB8762B665ACFBBC41AB90F247D1DA39347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632978, "uuid": "c6de80a4-dd26-428c-86f4-ee63c794a5dd", "value": "2f6204fbe7d12f9994fbdbc383c525c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632978, "uuid": "7a4f04b0-8d30-4260-987d-ff52d2f1b23d", "value": "12288:5VLUpsUGNIvm6gQgHJwRJ5aFv+4yZy3g6evxBBGl903:rysU/OKgpwRJAHyZy3g1vxBgl903", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632978, "uuid": "fe624771-d330-4d7f-9b28-86eff8a0e203", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632978, "uuid": "7c6cf13b-b35f-462f-afa1-80475cbff547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632978, "uuid": "7ee9ed55-9e34-4f02-9feb-3a4f23a37a14", "value": "e670238bcd7f028acbf39a8c35332215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa8a71c-964d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617654722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654722, "uuid": "6a42bb40-cfe2-4db3-98ed-9dbf9029eb9c", "comment": "Malware payload (Dridex)", "value": "46f94e90cbb4ddf008a3c330cb7f53c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654722, "uuid": "07e51f0e-02c5-4149-9d31-254b518d133d", "comment": "Malware payload (Dridex)", "value": "40ed1720d3c5d98f37292be2cd7fad3aaf9d74714cdca8eb424fc6f2eb5f3f5f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654722, "uuid": "89085c3e-285f-4de2-a94e-9552e94f57ee", "comment": "Malware payload (Dridex)", "value": "5e8f7041df527506b450f4efa23decd3f6139e81", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654722, "uuid": "85a700f8-cc41-454b-914b-274459c6a55d", "comment": "Malware payload (Dridex)", "value": "3b11a5ec6325e5d58ad7fc53c1e6f988469afa5d6be0f4a6258381fb98461d10af67c918d336afb312cbe56ddbc319c3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654722, "uuid": "4b4f453e-9214-4c38-8474-4c28c44655c8", "value": "6D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654722, "uuid": "e0d2ab2a-48c9-4ff0-aef4-a52c1bc1ba1b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654722, "uuid": "c5d47c29-90ad-4780-ba86-60deb1048641", "value": "3072:pBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:pBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654722, "uuid": "598f6961-186e-400c-9d39-e9685ff29ad0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654722, "uuid": "44aea4e1-9567-4704-bd28-1e133fc87223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654722, "uuid": "f802d25a-3008-4e91-acd4-a0bd90f7d971", "value": "40ed1720d3c5d98f37292be2cd7fad3aaf9d74714cdca8eb424fc6f2eb5f3f5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22f312a-963c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647407, "uuid": "5dbbc28a-3fc4-44ae-b44a-1b284be5dec5", "comment": "Malware payload (Dridex)", "value": "3883e6c325efaa7bd1fa066524eaf7ba", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647407, "uuid": "6e2951e0-3074-4a9b-afd3-16bf2f978895", "comment": "Malware payload (Dridex)", "value": "41c5215c028a36c63e95245092d2dc12d023ab0999ba1843154c9c5ea4774d92", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647407, "uuid": "6434b45c-a7fc-4d31-b78a-f384b6df60c7", "comment": "Malware payload (Dridex)", "value": "a893dc44ef633e1fd28929dbf2fb3471c3a5730c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647407, "uuid": "d5ee5732-a6e9-4b1e-bf62-f75766b2c515", "comment": "Malware payload (Dridex)", "value": "adee33900e24f9cc584e5597dcafc734b0a2e2b0263901c55d253806ab61cc05770864427ed68e20d6003755e1807209", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647407, "uuid": "27764690-5f5f-47ca-817c-aed06c3b2f21", "value": "DE14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647407, "uuid": "cdf57150-cd44-44d3-ab86-14523fdac9f1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647407, "uuid": "a7d56725-2267-48c9-b25f-20a7b2429f8f", "value": "3072:Lopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:cpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647407, "uuid": "0a16cad0-0ea5-4fc3-be97-958ee20f612d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647407, "uuid": "14047792-d395-4a18-957c-f6e6258edd99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647407, "uuid": "cf52176f-b4bc-4752-a880-a4edc26f4196", "value": "41c5215c028a36c63e95245092d2dc12d023ab0999ba1843154c9c5ea4774d92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b3f833-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617604085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604085, "uuid": "2deb5996-9fa2-4a43-a159-5a168f1477c8", "comment": "Malware payload (Dridex)", "value": "123d1ef0727f59f4b88204f55ba1550d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604085, "uuid": "10b27361-e4f0-488b-be9c-0b0fea85d684", "comment": "Malware payload (Dridex)", "value": "41e90602f0ba2fa255e6a6ee8e2b427e05883031ac85c2f95ec06fca95bf2e63", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604085, "uuid": "d69fbfcb-5209-452d-84b2-3ec385cb71f8", "comment": "Malware payload (Dridex)", "value": "cfb275d1d540a33bd9499ab53f0f7932855075ad", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604085, "uuid": "7eafefc5-8a2d-4893-ba6d-4c0e660b5196", "comment": "Malware payload (Dridex)", "value": "77e819f18c3eb1254e9db6de11b2cd6ee14c268e5e75ff0f825915743a2d9907476b6af7f3bd8304ef3df8c89ba12cdf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604085, "uuid": "e921c0f7-1a0f-46a0-a619-61424f6f8cd3", "value": "7214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604085, "uuid": "03552c62-e49f-4fce-aac5-fceb94a53f53", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604085, "uuid": "4694c59c-497d-426b-8ecf-582432e5615c", "value": "3072:Vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:6pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604085, "uuid": "2f912e0a-4d7d-4155-a030-438262bc0c92", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604085, "uuid": "46c2641b-a65a-4521-a9a9-d4e574bba000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604085, "uuid": "b05e92c1-1bfd-47b5-bec7-bcf560b6add9", "value": "41e90602f0ba2fa255e6a6ee8e2b427e05883031ac85c2f95ec06fca95bf2e63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e84026d-95a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617582278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617582278, "uuid": "842da2af-dac5-41b0-b55a-9f9fc5dc82f3", "comment": "Malware payload (Dridex)", "value": "7fe5dbfae9614eebd33f3c7fb15c6199", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617582278, "uuid": "94d1d581-4a34-4cd8-a9e6-021057e5f4ef", "comment": "Malware payload (Dridex)", "value": "4221781e84ed42d3c59fbcb40a96c20060cb90148ddf06f280a0bccbfbb39506", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617582278, "uuid": "589aa3dc-56bf-4a3c-908c-8df4d1d22037", "comment": "Malware payload (Dridex)", "value": "ed775353bdd934bfb2537396d2c65214c6387d3f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617582278, "uuid": "2968bea0-3fcc-4355-93cd-7b58cca54924", "comment": "Malware payload (Dridex)", "value": "b67361da7873540193444f7afbf6fa45fd3890d96b0fca27800c27df8ecab15ad574f9f300c493bd5d8d99a2f5674d42", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617582278, "uuid": "d8a6daa3-556b-41f6-b41d-16a99e106823", "value": "EF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617582278, "uuid": "6e82bee8-43ab-4e1f-bdab-181ecf175145", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617582278, "uuid": "524919a2-e4ff-43ec-8be6-5c8af67f6ccc", "value": "3072:4opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:vpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617582278, "uuid": "102ad69c-c089-4c2d-8f28-f13ec8961575", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617582278, "uuid": "c3dee866-adc1-4930-b2be-91b8b1acf6d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617582278, "uuid": "d97b201f-ae32-460d-8348-90f87fd2b967", "value": "4221781e84ed42d3c59fbcb40a96c20060cb90148ddf06f280a0bccbfbb39506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53eb91b6-9647-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651865, "uuid": "a0d9fecc-a50e-40b0-a2d6-9715790a211c", "comment": "Malware payload (Dridex)", "value": "7894ce8bb68c2e0f7eb6d51c2486d049", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651865, "uuid": "f958b1ad-bb7e-4b35-a8d7-35e27381e533", "comment": "Malware payload (Dridex)", "value": "4339552fb737428de6e5934a975826687ec599f49c4386ec5eb6db636d4a8d77", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651865, "uuid": "ff03712e-2af6-45aa-b6c1-a0ea0fecf2f8", "comment": "Malware payload (Dridex)", "value": "9c342284a7e127686910d95c7d9a5b35a63ad868", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651865, "uuid": "242a0e2f-8ddc-4167-9f70-e44695d58e50", "comment": "Malware payload (Dridex)", "value": "29b9df29d0b57c8c6d424d5a4ba7db4e971e4ca342168e4b290fd4815447f6cc78b5273c8a123ac4ccf428b6f7d822cb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651865, "uuid": "7ef0e334-b435-4973-ac57-c0703917b52b", "value": "8114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651865, "uuid": "4ab829ec-cae3-4794-81a1-1bd2ea9f6ca6", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651865, "uuid": "86f53ac6-c957-4f0a-9880-f5940f14b052", "value": "3072:GBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:GBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651865, "uuid": "f7dee4eb-5111-4bd3-956b-e7d245d58fd7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651865, "uuid": "571476c7-ee5f-493d-84a1-99932e1c4795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651865, "uuid": "e3d4cdf3-c548-442b-bc83-9e63e2f419a7", "value": "4339552fb737428de6e5934a975826687ec599f49c4386ec5eb6db636d4a8d77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f8f733-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649500, "uuid": "cc2c204e-c71d-4cf7-a56b-8b11f3c2275a", "comment": "Malware payload (Dridex)", "value": "5e13946ed4dff47bd5a204fa886afbb4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649500, "uuid": "5fd08cda-671b-4d3d-8999-3ef8495f069c", "comment": "Malware payload (Dridex)", "value": "4340988d8700a8871990e7adaa77475f2525e0b96b7a04fcf369622006458604", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649500, "uuid": "5342e1d5-ea2c-48aa-881e-2608505d1b1d", "comment": "Malware payload (Dridex)", "value": "54379a84de4c079afba9b2cd31be8dcbda811d9d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649500, "uuid": "cffa4bc4-a7f4-4010-84de-63bbe2a29007", "comment": "Malware payload (Dridex)", "value": "270ad81a19ef388625242d5cb95a0fb5ea38e79d31814691d4068f36a1cba538c04cf21036e5aaef6438b60a6e845a92", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649500, "uuid": "9a941288-f4b4-4330-ae67-11cc3683fbad", "value": "2814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649500, "uuid": "a188e805-5264-445d-891d-c60f9a27cf6f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649500, "uuid": "fb64595f-a529-4692-ac09-071ef8b7f168", "value": "3072:2BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:2BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649500, "uuid": "c246fb19-cb7a-4872-b2ea-c18ccf22e793", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649500, "uuid": "05850f86-f5ff-44ba-9f10-5f1200a06d1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649500, "uuid": "56090d3f-7a4b-41f7-b797-99febbbd41c9", "value": "4340988d8700a8871990e7adaa77475f2525e0b96b7a04fcf369622006458604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ce5e93-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617648248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648248, "uuid": "f3cb09b9-aa2d-4a2e-8884-fee62b39d2e4", "comment": "Malware payload", "value": "b80b37e5dfffe037af878648d17504c8", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648248, "uuid": "cdac8715-52a3-4a7c-8595-4afd431f2754", "comment": "Malware payload", "value": "43a73b0ceae1a255caa99d4945f572e064cb1dfd55995a640ec4531320ca5576", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648248, "uuid": "527ea2d9-35bd-4faf-8207-4121a75a6a15", "comment": "Malware payload", "value": "f961abeba313cb64c8fb54cd905e113d3fffdb21", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648248, "uuid": "1293b896-8e6c-4e65-a5ae-945a0204ce8e", "comment": "Malware payload", "value": "3dd84f700e83987a3ebf472917e7c56df23823bac8f98532e4775ec6f630b994adcc0f6b89dd98670658981fd52fed5c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648248, "uuid": "92b2f2af-1733-45b0-9d4c-f9181b82afd4", "value": "4444DEE6FFBBA055929B84C86A3E718B7F14B4A8942A0B0365CF277578CF09F64D3114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648248, "uuid": "3c8b8189-cc5c-49bf-b414-c7e89ce4a0ff", "value": "6144:IBZFbsndSq7+IU5MqYOqtBG+dGXMZIqw+epMOPgG:2HuSn5tuBG+g+IXTPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617648248, "uuid": "e14beebb-d454-40c7-814e-56164b56f90d", "value": 261712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617648248, "uuid": "33b63b59-6936-48ec-9222-899b967cf28d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648248, "uuid": "28a03cff-67fa-40a8-a606-9411101469ca", "value": "gifs20210122.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76013ba7-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649775, "uuid": "48a4d736-016c-43e8-aa78-19e3d55046d1", "comment": "Malware payload (Dridex)", "value": "4c6242c1fb470c32d458453b4bb28329", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649775, "uuid": "327be197-3631-4d24-a40b-3933ffc1f5dc", "comment": "Malware payload (Dridex)", "value": "43d591fe8547f680d6185d6b06f7115f7b19f47295ae7234c997a4354112117e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649775, "uuid": "b18d0d5c-2c96-4928-b819-4bab9aaa63b0", "comment": "Malware payload (Dridex)", "value": "2c664e4ac2a22ac3346a350c45800fa2f352e571", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649775, "uuid": "3174041a-beeb-4ca3-8ce4-800265733d46", "comment": "Malware payload (Dridex)", "value": "4a376bf65ecfa2c4c41adc7db04f75a69ad3bf4204cdc81dec3443c4d95ca4d7f9ac40863e713f4b18dab9712b5570b1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649775, "uuid": "707c8391-086d-4e1c-934c-6c543423ed59", "value": "B114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649775, "uuid": "6a5b6cee-4db7-4ec2-ad7d-909e32b32ec2", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649775, "uuid": "4856d49b-4f59-46d7-bad8-380614eb40e5", "value": "3072:YBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:YBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649775, "uuid": "2de7aa55-fb59-4427-ac44-84ce38800802", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649775, "uuid": "937d1925-eb93-43bc-b2d2-ed1d2fd83d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649775, "uuid": "690551a3-2219-40b8-a22c-db8c295e65ed", "value": "43d591fe8547f680d6185d6b06f7115f7b19f47295ae7234c997a4354112117e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff709df4-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647858, "uuid": "623aff86-c571-42d4-92b3-3a4d7befd313", "comment": "Malware payload (Dridex)", "value": "7b4f0cd2fffbb7735db95ea2dc415d35", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647858, "uuid": "6ff0c169-0bee-40f2-b866-f266df0de325", "comment": "Malware payload (Dridex)", "value": "44375654752aeed7ad0d14ab59bb6cd0b14e3f5b0d0593afd8f1cb7ba114f01f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647858, "uuid": "56e6267f-df7b-4519-b98c-203574060035", "comment": "Malware payload (Dridex)", "value": "bf841bf360b823a10ade47e15d6babe2681ba18d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647858, "uuid": "8cc01346-61a2-4615-b69e-de1a29ec14fd", "comment": "Malware payload (Dridex)", "value": "72f7985a2501b36e00455ff5cd0b89a0ca105be274251be0ad077d5ca9ae0a058d6d0bc5c6fc94b2239d7434630ee682", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647858, "uuid": "921c1e13-c9c4-464c-9d35-056d7b8de233", "value": "5D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647858, "uuid": "54df964e-db46-489e-b94d-e500286eb081", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647858, "uuid": "cc7dcc4b-de93-49a7-afb2-590870fa5d86", "value": "3072:7BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:7BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647858, "uuid": "e4201721-6074-4fbb-94a2-3fe1f42f87a9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647858, "uuid": "5af54cb8-4f14-495c-9a78-5d2dbe2db7bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647858, "uuid": "1e6c9f44-49b8-4c33-97fe-05ea7e143e8e", "value": "44375654752aeed7ad0d14ab59bb6cd0b14e3f5b0d0593afd8f1cb7ba114f01f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e71b6c1-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647937, "uuid": "2b2eb9d7-f049-424c-a61a-1ad860a357d4", "comment": "Malware payload (Dridex)", "value": "f017516511ecb77287c1da86ccee842e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647937, "uuid": "2484aa7d-ba36-42dd-b58a-bf7088b85012", "comment": "Malware payload (Dridex)", "value": "4469dfdbe3c94f3adcd59380db71d929685002672ee2d1d8410cc726fb0d5e74", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647937, "uuid": "ccfe09d2-8951-4eb6-a953-0ad5415dd69c", "comment": "Malware payload (Dridex)", "value": "c1ee3d8ec4b033def3eae73e50a3d29e1c4226ec", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647937, "uuid": "951325a8-45db-4c02-b925-0c7bcdaaf8e0", "comment": "Malware payload (Dridex)", "value": "638716ed9d301f1141d68c235f463286c5e2ab72f8ab392ce3cf6b3012c8f379d5d9e3f360133595dc8bf397f1f724ad", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647937, "uuid": "d4ad5f43-6d33-410f-9f4b-945d27288fb0", "value": "5A14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647937, "uuid": "110f1523-c156-4b5f-8430-244236cdb865", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647937, "uuid": "9fc70871-8117-4949-b05b-4c2676da2754", "value": "3072:yBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:yBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647937, "uuid": "1902e9e1-be4f-41b0-8bc0-d85af28584bd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647937, "uuid": "bbda49b7-d091-4c70-b71c-f678ebee365e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647937, "uuid": "4af85d0e-4d39-446d-ab16-3da4578742bb", "value": "4469dfdbe3c94f3adcd59380db71d929685002672ee2d1d8410cc726fb0d5e74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac0e52f-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617643797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643797, "uuid": "49dffe60-3f5e-4819-94ac-38ffac06626c", "comment": "Malware payload (IcedID)", "value": "bf2fbaa972fea133272c367c0f8acb9c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643797, "uuid": "cf863cc0-89d9-4ca0-b6d6-f2638bd81fab", "comment": "Malware payload (IcedID)", "value": "44862b98e91d9947959ff40171641a98a8cbd2a67b64ae259185d1d94bbf8333", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643797, "uuid": "9ca54d42-9e31-4623-8996-e107f6e1ea8d", "comment": "Malware payload (IcedID)", "value": "5b8f328004e3b99d6eba775294ce7d69a635ae6f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643797, "uuid": "d5f14ffd-c513-4099-8a7f-5c160fa2eb2d", "comment": "Malware payload (IcedID)", "value": "908cbb9090f76723fadf3a94adaf622399ecca9045e7a7546d4bc85505d28a1894d215dcddb94e57b748b7912cba41b2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643797, "uuid": "ae0ea291-ae1c-46d4-a5c7-fbbd0dc8e40e", "value": "4204123CD06A4D58C2E5543BC858C55A6C262027BDF8A9BD758C7948EA632F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643797, "uuid": "dfdb971d-61bf-4a33-b3ef-2b2b41a27b42", "value": "3072:4HYXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGUmh:4HgE5SDvbXAyHbVt15wTQDjmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643797, "uuid": "f81f5d81-a6b6-4bb4-bb07-b5e55dc66ce4", "value": 178369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643797, "uuid": "f97fe85a-0a15-4122-8127-dcb5c2f2c01f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643797, "uuid": "328576fd-dfcc-4742-8d3f-2285cf95cf83", "value": "Contract_657752239.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959b2af1-9616-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617630930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630930, "uuid": "a7700843-272c-4226-9732-9e932f825f9e", "comment": "Malware payload (Dridex)", "value": "e4915b71fd4377cef7b8943d00cb643a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630930, "uuid": "a143ca21-7d81-448b-be06-13aa994eb4e8", "comment": "Malware payload (Dridex)", "value": "4563ab8f6df49ed6b62d00e2bf99b2162d2a7bac7b15e16a0dc50070ff4c1380", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630930, "uuid": "187a5fd2-c4ab-4230-ad41-9fc134de5da6", "comment": "Malware payload (Dridex)", "value": "93972f2ba409ceb6012792a104fb2b49207e37ec", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630930, "uuid": "8c56e09d-de00-49aa-99af-b02a932b22f8", "comment": "Malware payload (Dridex)", "value": "618988683f7dd27ea036ae0ed1790b0f36981ae5575c3981bfdd039416fed76d9460e64201150c3ffbe20051ee39b3c2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630930, "uuid": "68b8dd67-920a-4dcf-8365-5e5339084705", "value": "3614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630930, "uuid": "5b05c683-0758-4cc5-a41c-3ef3bfe95c2f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630930, "uuid": "fabca232-4e23-4d1b-bc49-206863bba39a", "value": "3072:Vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:6pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617630930, "uuid": "ed490fa6-6a03-4060-8a1c-b0043875f78b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617630930, "uuid": "ef2faffc-a2e1-449b-a74b-6676576df608", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630930, "uuid": "e51a23d0-e84e-4dd9-924a-39fcdcb2d3f6", "value": "4563ab8f6df49ed6b62d00e2bf99b2162d2a7bac7b15e16a0dc50070ff4c1380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60539d13-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617627405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627405, "uuid": "7d511c01-084e-47a4-87c4-0a429a60c745", "comment": "Malware payload", "value": "fb98b0b099a3d8da623cfa47077bb6ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627405, "uuid": "d85173f3-82d2-4895-bed8-4431c526812b", "comment": "Malware payload", "value": "458be789500a1e8a836f9cd8f756a7eff52eecb6343c2d938f952cc258de57c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627405, "uuid": "800c7e06-0e1e-4cec-b272-ceda5b7cbca1", "comment": "Malware payload", "value": "d6e543f97f91b1f4f8fa0459bfd59d310eb29858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627405, "uuid": "08bad06a-b988-4792-9762-ce7812bcd2f9", "comment": "Malware payload", "value": "8431c3e1e624b19de2881efaa53a947e496701341cf5de3428edd088f9ca7754a018a12005a0e8b6ccf8f11614ebd68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627405, "uuid": "3bca79d6-7be4-4066-be76-1d35527c82f4", "value": "0D2522A03BE84726F27CA7F9B935481087B6B21A25B2D34D4DD4A0DF1DABB815500FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627405, "uuid": "2924694a-4904-4149-a5e1-ecf848c9261e", "value": "24576:wrNX8v7dYpALWlQvz+/6xTkBFm61p/M1JocXzQPHQvkpI06:wrWp2ALW6+/eTkhS1OKzQPwvYIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627405, "uuid": "262e47ca-7298-473a-9d01-347db85d5de4", "value": 1044423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627405, "uuid": "55a19c9a-538e-4122-b0e6-b9b5c06b9a1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627405, "uuid": "ad6e40a1-1a68-4acc-bd77-90cd7330e78a", "value": "fb98b0b099a3d8da623cfa47077bb6ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d5524d-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647892, "uuid": "cd8b19e8-0dae-4dc1-9bf2-6c7a5382b549", "comment": "Malware payload (Dridex)", "value": "55ea5ea55bdfbe7901cdd98b99b2bc70", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647892, "uuid": "23dde0af-b964-4b9f-ade1-37cc11c53113", "comment": "Malware payload (Dridex)", "value": "4603bad5a583d9717ce98174d2ef20416ede092e3f87d4faca93e9aa6e2394da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647892, "uuid": "d1d5d964-6f93-4534-b6e7-2ac83c340d58", "comment": "Malware payload (Dridex)", "value": "84c307b8b59e1d400792697e133a2582ac826d44", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647892, "uuid": "33190f75-0582-440b-8403-589a2ff65347", "comment": "Malware payload (Dridex)", "value": "b792460cfe94e157f8e33d9badf6d93136ee426ecae82db1f788330b07e0c707defc694aaa9bdd00bc7399f04fae5b26", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647892, "uuid": "b324cd7f-a245-442f-82c5-8d21b01ff56d", "value": "0C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647892, "uuid": "bbe78cc2-375a-4cf9-bb72-90efc1f59eaa", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647892, "uuid": "83b7ba17-1350-4541-902b-e6fc8667a41e", "value": "3072:rBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:rBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647892, "uuid": "815f5ca9-a8fb-4a3c-939b-d2bd669d526b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647892, "uuid": "514b4fa7-5f57-4019-81fc-2dde55f24ca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647892, "uuid": "f5d6da5c-e4c0-45ef-8596-3df87e5b9095", "value": "4603bad5a583d9717ce98174d2ef20416ede092e3f87d4faca93e9aa6e2394da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7270daa8-95bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617592217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592217, "uuid": "daa50309-d54b-4c75-8822-8bffbaf406a7", "comment": "Malware payload (AsyncRAT)", "value": "ff3b0abded45444a0fe0bc585d92cb4a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592217, "uuid": "76c94a53-ab1d-499f-b2a7-045ca80479b1", "comment": "Malware payload (AsyncRAT)", "value": "46395c1900d39199b23333ab9891e3d630920e27655fc829ddb492148505ad86", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592217, "uuid": "66aae255-456b-4695-b9f9-0b3764347d97", "comment": "Malware payload (AsyncRAT)", "value": "a83f102516c0cabdefe2b2060fc5ef707ddfd187", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592217, "uuid": "52a98e21-e8ce-4e78-b080-c64fe35d56c0", "comment": "Malware payload (AsyncRAT)", "value": "d9e7a673fac99dac24d3e7f11e6418c89a5036cd18c96ff9e78d42db74189fc58890ddf72b2f09476a32ae0f41b8c1f1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592217, "uuid": "3314ac70-b84a-40d5-a5b9-90385b8414a6", "value": "8C13FB07DAD4885FE1C4CC710EE937C22337A858D10CBF351AC6671667F60D8A68ADAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592217, "uuid": "b8e618bd-17ca-476e-bf47-bfee1bb50818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592217, "uuid": "ed2e5f61-e74a-485f-83d7-f4f308677fec", "value": "768:q49fQK/2V19NIAw14y5x+I/P3aMSMA73JfZ0Zbbu8:39o62/9hG4S+I/P5DA73JfeZbbu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617592217, "uuid": "42bff4c4-9e94-42bb-9c43-f8c32d14c305", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617592217, "uuid": "8fa7c64b-2de1-401e-a8dd-1b7f513517e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592217, "uuid": "656a1246-3743-4503-8e56-3e73b41cc1e5", "value": "Purchase Order-877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ba33de-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614985, "uuid": "28931930-6317-47ea-b535-6f9906129f86", "comment": "Malware payload", "value": "04835a90e4f6fe989a8da7fb72e2c03f", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614985, "uuid": "63034d7d-6e5d-4ae2-afb7-85b186fa228a", "comment": "Malware payload", "value": "46b5cb844bf60c66e3c40a267cf62452cd297be1180e84d97ddee8862924ffe0", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614985, "uuid": "79366ea5-7863-4777-be46-009554f4325d", "comment": "Malware payload", "value": "2cdd617641ad4e7291b0f3babf54e57f5d355490", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614985, "uuid": "988a6ea4-c84d-496f-b98d-69a1c49706de", "comment": "Malware payload", "value": "ab31655a713ea1e65d6b0b7d0f8ccb1526bbcb509161a568c3f0b418736efad68dfbb5cf719dd62732d260af062cccd7", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614985, "uuid": "bceb89ff-d12e-4c25-8507-73750a84c05f", "value": "21663381F0928CBAE8F611371AB6D1353A7AF5230B0585AF63AC5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614985, "uuid": "da3609a9-41b5-436a-b3b0-170728f0e72a", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614985, "uuid": "0e87816a-200a-4707-9964-efff9249ba38", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKaz0:kfauN/HYOSIT/EVF9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614985, "uuid": "f5e5dc91-3255-40f0-b885-7380529abe0d", "value": 6967144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614985, "uuid": "01f59106-ce25-4b98-af35-f10bb7b4301e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614985, "uuid": "bffa20d6-4d12-4da7-b886-e3e56ddc34de", "value": "46b5cb844bf60c66e3c40a267cf62452cd297be1180e84d97ddee8862924ffe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e674f17-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615000, "uuid": "9ba380ba-8914-4cf1-8348-72e380d27491", "comment": "Malware payload", "value": "95389362dc8e4b2002743639285b50b0", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615000, "uuid": "e38cce86-4641-41fd-b3b4-2a4578996a7e", "comment": "Malware payload", "value": "46d9c3c7fbc8fec248998ec585e59602ed884122ff2f158eefb9d127f6ff7b1d", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615000, "uuid": "3b10d59d-5c35-4dfa-8873-55301b4e3f6d", "comment": "Malware payload", "value": "e1b87ed6b14b7856c024d473d5c5cddcf3cc883f", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615000, "uuid": "1bd14a08-2458-4a85-8220-47b8e6e5b7e6", "comment": "Malware payload", "value": "069a6296d3f05020e14409f2fa0446715e58b41bf45f6d5da109189a1ff1391f38db418dc91277e446e41eb5470b308f", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615000, "uuid": "d6d01ce7-5bf0-4e25-8319-849119eae03d", "value": "6A663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615000, "uuid": "a10b8b5c-dca5-406b-bc35-cf04da765c38", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615000, "uuid": "9254778e-08c7-4e46-a6d7-f8bfb9d33ca8", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazB:kfauN/HYOSIT/EVF9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615000, "uuid": "5813be02-bdba-4fad-b022-fd7e1c964259", "value": 6967056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615000, "uuid": "8f1dcbab-94c0-414e-8290-59e1e1861c18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615000, "uuid": "48fdef18-8256-4b18-95a8-ea26d004e230", "value": "46d9c3c7fbc8fec248998ec585e59602ed884122ff2f158eefb9d127f6ff7b1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8798f2-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "23bb3500-c7eb-46f5-b7a0-7c7d7a0856f9", "comment": "Malware payload (Dridex)", "value": "810bb2b21f9ac9da4a619e282dc74760", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "fafab4bc-cd40-4288-a5ad-a85e4a293685", "comment": "Malware payload (Dridex)", "value": "48f5f685ca9b6c756e3f84fa5ccd77bbf8d81845124ae8084fe27d967a5e4521", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "2aa4c97b-69a8-478b-b073-3145cec267c9", "comment": "Malware payload (Dridex)", "value": "f513ef69c43a551d02e85d7692d71d0d57d4a3bf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "6afbb098-34b4-4a40-b094-acc9d19bc3fd", "comment": "Malware payload (Dridex)", "value": "35dc5ad5367171d7430cd696db61676501c93526c79e7326b7b3079069ea9dc4108deae08aeb4d527e911eb05776b464", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "b13efea7-10ea-43e7-9bd6-80a9ff4358bd", "value": "7C14AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "eab93c36-5552-4472-ae59-d0c2fbd7ac99", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "e1c5fde3-cb3b-4b50-a2ff-204449aaebdc", "value": "3072:VBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:VBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644258, "uuid": "5e8e16d2-1ff7-4d4b-a5a0-5b67bac0fc51", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644258, "uuid": "81ec0baa-ae7f-4fd3-b9e3-775f9d55c926", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "6967f635-7bcd-4682-aa27-5acc7381011f", "value": "48f5f685ca9b6c756e3f84fa5ccd77bbf8d81845124ae8084fe27d967a5e4521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8805e145-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615016, "uuid": "0829ac2c-f4b3-48d3-829c-7ca9c2573f44", "comment": "Malware payload", "value": "7b84c26aa668dc3ccb020f4ed7653a56", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615016, "uuid": "ff2e92f3-4d94-44f1-a3b9-dafa02790c56", "comment": "Malware payload", "value": "49d79369e23bf979b3a6c1163c857f177fa7d1bdff018565d459579a0333bd76", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615016, "uuid": "9e9123d9-daa0-4038-8242-f2e2cb9d9297", "comment": "Malware payload", "value": "9adb88e96d00241661acdfe77caefac00ca4a7d0", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615016, "uuid": "6abda2d4-2637-4def-86b6-7e5bf7e1d2da", "comment": "Malware payload", "value": "61ec9e9289b0e31cf33c016a5f65925fafb2a14d10de7fc188874a7ee494e234d79d1975ff1a596d5df201bcb8faaca1", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615016, "uuid": "1da41962-f251-44fe-a027-eab3832db2e0", "value": "20663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615016, "uuid": "096b5ce0-c381-4fac-b370-880d4fda4ca2", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615016, "uuid": "f86275b5-62ff-410d-8e87-7690f448c459", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazT:kfauN/HYOSIT/EVF9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615016, "uuid": "cb3a3035-2696-4025-bb93-a3a3bb1dc23c", "value": 6967129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615016, "uuid": "7e5cc506-caf3-409a-bbe3-579dd2f19c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615016, "uuid": "af13b164-a958-44b7-9c44-0621d3486644", "value": "49d79369e23bf979b3a6c1163c857f177fa7d1bdff018565d459579a0333bd76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6330c257-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "82be787a-f5a1-4c15-81ee-33b0cbfafa79", "comment": "Malware payload (Dridex)", "value": "165d681c309b2deb51f6730de1061c0c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "cc54d9e0-179d-411d-9a52-46f694095778", "comment": "Malware payload (Dridex)", "value": "4b571e47cf353afe75f0bdd8b5f8fbac94651c6a038d725b80ec9141dd5fe06b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "c56587a0-29bf-40f0-b111-37f375b84665", "comment": "Malware payload (Dridex)", "value": "09fb3e820ad2a8145f5c3497de60d4edacdce103", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "bc94c33c-2ff8-4656-96f4-ee11cff580ba", "comment": "Malware payload (Dridex)", "value": "656f34b471233008c2509c564dfd38ce2601d66e3a9fc7f4b1b70ddf0ac150f2686dd1f959524431530b568c9625b93b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "4e7b73a4-2091-4430-a296-77d47e1cca67", "value": "2214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "3eff89dc-db16-403e-860f-7b4c91c2673a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "e77a6f2f-e0da-443e-a8c3-cdf40b6f96de", "value": "3072:pBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:pBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649744, "uuid": "725f7d0b-f406-474c-af87-cb76caf11068", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649744, "uuid": "ac6fb417-86a1-481c-825d-b6c1006111b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "3b9174df-0bd1-475b-bd8f-867778bd08ff", "value": "4b571e47cf353afe75f0bdd8b5f8fbac94651c6a038d725b80ec9141dd5fe06b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a406972b-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604326, "uuid": "7c4e4511-547f-489f-b5f3-15f96cb0ac5b", "comment": "Malware payload (AgentTesla)", "value": "80c419bc2a429d1de73c9ebc1328b3eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604326, "uuid": "fca992df-d850-41fe-9847-9651a604fca8", "comment": "Malware payload (AgentTesla)", "value": "4c2b5eff5d4a6f4e736a6300c3369a6afc5cba9c754f8f5538d38415847698e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604326, "uuid": "d1768c60-6b22-4aae-97e8-f7f8433d2792", "comment": "Malware payload (AgentTesla)", "value": "65c678e6f407008e242e7a3bd4dda30178a45ecf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604326, "uuid": "e7360118-5618-4fc9-be92-f8cc138bd3cd", "comment": "Malware payload (AgentTesla)", "value": "d9efaa4cfddbf7f3dee9ddb7ae161d1873774634957e2910eb4b75fd040f7ec30764b634cc19a9d37738801c8a199b77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604326, "uuid": "9f0d113e-c088-49b2-ad24-43dc2981bdcc", "value": "AC859BD1ED87D204D8561AF0D82FC15C5662EF086F2DED09698CF3490B72A8ECAD56F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604326, "uuid": "404ca078-1684-4ac8-ba70-9c9e814c9f89", "value": "12288:Bvi9zIyVW443SZaCv4YbWFyhEt88V5Sz3onFMwsnIBPjj13FzRD70apKEeTUoGzQ:4983bszvdE5Sz4CfnAjTSD/TGPKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604326, "uuid": "ee4ee076-726d-49da-bb4b-8adb75118b5f", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604326, "uuid": "a4a65a38-4b2c-40e0-8f19-ab08aab25965", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604326, "uuid": "bb6fdb59-c21b-45b5-b9f1-9fdd4348f7d8", "value": "TT Copy_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f87b830-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644503, "uuid": "cf528fec-c1f5-484b-966d-759edb5c2e1c", "comment": "Malware payload (Dridex)", "value": "6cd715d71b4269ee51fe6b5f4870d6a3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644503, "uuid": "5e5fb7b4-f44c-476e-a0e2-7f0e97deea46", "comment": "Malware payload (Dridex)", "value": "4c5f99be08af5adfee91e21249ccee5d080ce228495fa05900f6be5f493b6964", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644503, "uuid": "b11c03a1-fd08-44f0-ba34-85691f0b8837", "comment": "Malware payload (Dridex)", "value": "0889a5809c5d1d8cff3a8631f8af37c66f5d3da9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644503, "uuid": "eebd9a95-6eff-4dea-a71d-4f57760c79bd", "comment": "Malware payload (Dridex)", "value": "fa27642ee4143dcf96e44bc426cba499900857aca11adf0687d72d464be41b34555a34b328dba886a07126dcc3f47d6e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644503, "uuid": "a82e578f-2928-4b33-bb88-90da9fe8d696", "value": "A914AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644503, "uuid": "3c0df317-95d0-48b3-9535-9a2057b18fc9", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644503, "uuid": "dc7c9389-feb9-4ea3-b4ed-790a70e7946f", "value": "3072:kBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:kBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644503, "uuid": "8c9db18d-58e9-4ac4-abef-9852ecf5b57d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644503, "uuid": "fc78da26-88c3-4348-a4a0-446253c725ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644503, "uuid": "7ada456f-beee-4168-b830-8d694fbd549a", "value": "4c5f99be08af5adfee91e21249ccee5d080ce228495fa05900f6be5f493b6964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eec978-965b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617660397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660397, "uuid": "a38f0a90-b739-4ce4-9fe2-869c6cc60809", "comment": "Malware payload", "value": "907e2c03bdf31eb0242e3fe0562bd3ad", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660397, "uuid": "ce542926-28eb-4dc6-912e-a8dc739a7470", "comment": "Malware payload", "value": "4c7f58a5f95a6ce5860ae28ba3614536e1c43b13fd25b6b3588b956f59e7234d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660397, "uuid": "fa224b85-f650-40ed-bdb2-cfd0c7b9ee55", "comment": "Malware payload", "value": "e710f554046067d02eb7558b255631206eb73f08", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617660397, "uuid": "432de487-395f-4e93-ad2e-5dd7473d6647", "comment": "Malware payload", "value": "720bcf0f4b0bea9cc2179ce31482502f0cc2f41fe61ee6eec740daab329235234de4aa04a6d65da5567a538b0aa4e744", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660397, "uuid": "5a3b9741-c0c2-4c59-88ee-3248b9bbb7b2", "value": "6514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660397, "uuid": "ada9b23c-90cb-4b96-9594-5b656c43420d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660397, "uuid": "b86bb0ab-0d22-47ce-8020-7f94f3a381ca", "value": "3072:OBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:OBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617660397, "uuid": "8a7f8aa5-f867-42a7-9116-506eeacd835b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617660397, "uuid": "fea69e40-a50f-40d4-9680-e6c3c1a9797c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617660397, "uuid": "5b3adda1-fd5b-48b7-839e-2b8ff245466c", "value": "4c7f58a5f95a6ce5860ae28ba3614536e1c43b13fd25b6b3588b956f59e7234d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6ee97-95f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614755, "uuid": "e3fb1337-86fb-4fa9-98b1-2464ecae0bd0", "comment": "Malware payload", "value": "a32d320d509f77603814563f21d26788", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614755, "uuid": "b1ab63d8-cb51-477c-958b-ecd6f39bca32", "comment": "Malware payload", "value": "4f1053c6311fbf24153eab86e7307ec6455aaf768c87064f32ceb984f4474dd1", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614755, "uuid": "e4674535-8ef5-4008-9aec-62222cb4dda4", "comment": "Malware payload", "value": "7d0bd9eda07c3e96d11595b0825fce5f0b8ec597", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614755, "uuid": "8ddca312-6c1a-4bbe-9b57-257615ab3787", "comment": "Malware payload", "value": "c1af111fc4b4084320580880547f330529274bcc0d58153361e9e01b85dd327ccc58ccb3155a975ba7fec31ac6aad3d7", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614755, "uuid": "c9be5f88-afd9-4c5d-abd5-c1ab4d707571", "value": "E9663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614755, "uuid": "3cd4c449-f4ad-4123-ab12-160d9373394c", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614755, "uuid": "49897f35-6564-4628-9b62-91c31ad36812", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKaz6:kfauN/HYOSIT/EVF9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614755, "uuid": "03fd5492-167e-4b5d-96d6-3130f0fb3030", "value": 6967100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614755, "uuid": "fc388d50-9413-487d-ad27-50c822a94658", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614755, "uuid": "97a26a8a-e9cb-4169-9d02-16b934798540", "value": "4f1053c6311fbf24153eab86e7307ec6455aaf768c87064f32ceb984f4474dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a84681-95a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZeuS)", "timestamp": 1617584147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617584147, "uuid": "355f16c4-6c89-483e-8797-7b9025ec166d", "comment": "Malware payload (ZeuS)", "value": "ccb2db4a8a284f62db7002be470ac542", "object_relation": "md5", "Tag": [ { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false }, { "name": "zeus 1", "colour": "#832350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617584147, "uuid": "6532e7b8-802c-4fc7-b138-a98b10d2ee1c", "comment": "Malware payload (ZeuS)", "value": "4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea", "object_relation": "sha256", "Tag": [ { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false }, { "name": "zeus 1", "colour": "#832350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617584147, "uuid": "dbe07b49-f3eb-41bc-b77f-74906c43f9ee", "comment": "Malware payload (ZeuS)", "value": "b2bdb5ed1ff743117cdf8500a498e247febbb6ec", "object_relation": "sha1", "Tag": [ { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false }, { "name": "zeus 1", "colour": "#832350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617584147, "uuid": "5b7962ae-6883-40b5-915d-5f272f56e068", "comment": "Malware payload (ZeuS)", "value": "7a1506216e1d2151b139e04f0143a2d8d4dc17c30e1aefc4f925450ba1e2eb9623892c2a3fe4542c42d5e0c19497e7c5", "object_relation": "sha3-384", "Tag": [ { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false }, { "name": "zeus 1", "colour": "#832350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617584147, "uuid": "3924dadc-221f-4426-8a51-d83c182f16bf", "value": "5D530224AF215F37CD8A0EF7F4F57723919D93D21B447EC659D89A83481B1AAE0C445C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617584147, "uuid": "376dbfe8-fafe-4bb3-92c4-0709c351dc89", "value": "41da589848b0ea7c32b44ddd22d7ade5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617584147, "uuid": "3d1c53da-b23c-4593-bb89-e421ef23ea2f", "value": "768:dtwaDQxDzRaaLoXfZ1yjpenwgb4uDAv5RhahPUCrjtrSfnnd8LCPCct8WL6pPlBa:puRuXzjh4k2gUgoPdNLYPba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617584147, "uuid": "f1cebac4-754c-4e52-845a-03f2fac031cf", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617584147, "uuid": "d2d3fc05-b554-4258-8bac-23ffb419470f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617584147, "uuid": "d564e0d5-046a-4c59-a237-9dbafab052dc", "value": "4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdab51a1-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646486, "uuid": "9fb8be56-0901-42c3-b5c8-d98df7b73e9b", "comment": "Malware payload (Dridex)", "value": "a45e5920ecd24a614b934fd8ec6aa936", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646486, "uuid": "c112fd8a-3d9f-4c26-87b8-50c987c9a1e8", "comment": "Malware payload (Dridex)", "value": "50caa8ba7cf4e81627925bebd6c4fcd7d41eae215290b7016ed2b19cc59a68c4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646486, "uuid": "784757b8-e31f-4799-be5c-b3ec845ad391", "comment": "Malware payload (Dridex)", "value": "571b054b1d41b69985a5e28efe3b44237214b8b3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646486, "uuid": "35b8a0c0-f879-4661-84cf-42688134cd79", "comment": "Malware payload (Dridex)", "value": "d88dc0381df054769eabf169b406862aecc80ae4cb5f68225ba330a5e44b19d8a11b84dba213f9df1762cde088e1809e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646486, "uuid": "82ac2cab-0bbc-4048-928b-d970a737aee7", "value": "27149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646486, "uuid": "9f7015f4-b6fe-43dc-82f4-bca42f57e684", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646486, "uuid": "c8f5d7b6-e807-4ac2-823d-86539cb3b703", "value": "3072:m6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:mZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646486, "uuid": "2b9d89a8-1ea9-4257-be38-312b0d4f674d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646486, "uuid": "52182709-b517-4bd6-8234-1e0c9d59d501", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646486, "uuid": "aa43df82-44da-4f65-9cac-5fabc08f7119", "value": "50caa8ba7cf4e81627925bebd6c4fcd7d41eae215290b7016ed2b19cc59a68c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891e2d44-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617643794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643794, "uuid": "0bee5f85-cbb2-48ef-9981-2d72a6e84901", "comment": "Malware payload (IcedID)", "value": "8b32841ce24bd52a2c39d6b4ab62e65e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643794, "uuid": "2b24c670-deea-49b8-aaaa-062357a75a01", "comment": "Malware payload (IcedID)", "value": "5141af36017068492e5c0d92ea15a626400966c7c6f80928eaf1483aca89de90", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643794, "uuid": "970e1163-9369-4298-bfd8-33312a587755", "comment": "Malware payload (IcedID)", "value": "46b93cd0af7a8f0e82b9a264d19cfa95c4331a8b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643794, "uuid": "084db321-ba5f-400a-8aae-15bf84601208", "comment": "Malware payload (IcedID)", "value": "936f51e8490193aae0bc726da2f07cc1b0f9b81a81bacded1633821e9beffe8694f09882d496e539fe60c6cba8cd4af0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643794, "uuid": "6a43c319-4593-459c-a0f2-9ca597c04ac9", "value": "7A04127CE0654E9140DA507B9CB5C209EC722122BEFC8AADA69D3954F9A36F30D77B04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643794, "uuid": "5e544417-4d54-4ec3-8790-733b3199110b", "value": "3072:A+w9059bYDEdZY4yvqCilynhVx12A7bJ8mBc/wKw5ZkiEZTcDqU2nh:A+wi5GD9blqybbjD1ZaZQDfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643794, "uuid": "92230738-c387-4f65-8829-d68b053530b5", "value": 174601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643794, "uuid": "fcd4f602-ca5d-4502-9d1b-cfc378302ec8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643794, "uuid": "2ca3ab68-f174-495c-bff3-ada8b8a1e19f", "value": "Contract_657752239.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b56684f-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649757, "uuid": "8928bd0b-c683-414b-976e-3cb35ddf3ff1", "comment": "Malware payload (Dridex)", "value": "324b3a5bde45cb6b226eefb61ee5a697", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649757, "uuid": "7c7be3ac-17c0-45c4-a7ff-e80c878a0f03", "comment": "Malware payload (Dridex)", "value": "52c18f3164f497b4f03a86ca6edd3bbaa908dc7c5b493b2446a15b1849932b36", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649757, "uuid": "a912d7d4-beb8-40b6-87ba-32d4c3225e1d", "comment": "Malware payload (Dridex)", "value": "f51d22126e9d02dfebfecf7c38221f250844337c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649757, "uuid": "471c31f8-f5f9-41a4-941b-1602a1a6c7b1", "comment": "Malware payload (Dridex)", "value": "865d2a8cf5de4d8d800f657be618523dd4f5cb90497b6d19567bd1b2e65e15ea36fdf08eece84a08797d3c7f9542b6e9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649757, "uuid": "e5cdf559-6684-4bef-b943-e732f5db05d1", "value": "5B14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649757, "uuid": "5307a36b-523e-4aec-b688-a1e1fea8bc1c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649757, "uuid": "190b3be5-928f-46ad-a21e-fcf2d70468c1", "value": "3072:/BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:/BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649757, "uuid": "3aba140f-b881-47b1-b2ff-ea5a7d601fc8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649757, "uuid": "64e5aaa0-ae76-436d-b2d8-0d0b27d3ebf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649757, "uuid": "de82eb41-ed21-4255-8f3b-87011d2167bd", "value": "52c18f3164f497b4f03a86ca6edd3bbaa908dc7c5b493b2446a15b1849932b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6732f8-9654-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617657626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657626, "uuid": "5f489590-7f08-44e0-a482-d99b5ec8f4ea", "comment": "Malware payload (Dridex)", "value": "dc4f2a3a016d6b624e10cb8376e2ae38", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657626, "uuid": "64b86b2a-52d6-44e1-9d45-b8fb9840281c", "comment": "Malware payload (Dridex)", "value": "535def7c2bb3ad3772e199a99188f99e8a7702bd71596de4c52597d03eb5af0d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657626, "uuid": "48f77c99-f5ff-49a9-9b55-a117230b03af", "comment": "Malware payload (Dridex)", "value": "509d42c23ed1309f303810dc1f78efec8f83b6b6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657626, "uuid": "cf700b48-298c-42cb-9a0a-32e912527003", "comment": "Malware payload (Dridex)", "value": "9b25427ffb2f5ada17ce0e2d56d1a8b4b32ac13663a6a44c8787d5679d9c7fbbbe9c57852b75f10e6d6efcd6953b71aa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657626, "uuid": "912b2c54-b1d7-4b61-9660-6914947f2d5f", "value": "BA14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657626, "uuid": "b763559d-a1cf-4294-833b-635024b4277b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657626, "uuid": "22d40f25-f946-4e26-99d6-bd61a09be3fa", "value": "3072:8BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:8BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617657626, "uuid": "e389c121-5b68-404b-b993-840b393ac3a0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617657626, "uuid": "4077ca42-3591-4e18-8d45-3438d83d0a92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657626, "uuid": "d49f03ee-3ea3-4f49-af6a-60567ca10422", "value": "535def7c2bb3ad3772e199a99188f99e8a7702bd71596de4c52597d03eb5af0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233f76d6-95d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617604539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604539, "uuid": "5cc23203-cd83-4c72-b0d8-f461db7692fd", "comment": "Malware payload (Formbook)", "value": "5fbecfdf60693b2f3e620d85155c0979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604539, "uuid": "bd72b594-07e7-4b5a-ae15-0ac2533490f6", "comment": "Malware payload (Formbook)", "value": "537a68d984e9b974cd9dc6977e0fab23ddc151bcd1010427b274d0895499ac2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604539, "uuid": "9a7a5115-3e0c-4406-8851-0217c35f2063", "comment": "Malware payload (Formbook)", "value": "84536032b875b73fba422aa519645dfe5f0366fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604539, "uuid": "3af670c7-7c5e-4823-9282-d20284c9ca82", "comment": "Malware payload (Formbook)", "value": "8678f8c61c7f06405148ad0798b1da99fba2ce64ea2e5414fce8f531e15f7686c2a5818f41141c954b9c9d8acb08d833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604539, "uuid": "1354f1eb-e6f0-4ae9-98b9-48c7e26be3c1", "value": "8D25E01139A54224FDAA1F740863907103B7BE417D2CE98EADDD3E0D7F33AC6D6126A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604539, "uuid": "d04437fb-a99d-4dce-965e-a1342d54ad5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604539, "uuid": "eb6612bf-1dc3-4377-ad2e-adfef712155f", "value": "12288:HfRVxFDVp0PRkqDVl6+3NRPOUI3a3bi1Zh+I9tvAlTnvuRftPzG22AczjJCp+5bb:pvF+RkqWyPQqLibh+I9tolTnMlqmYrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604539, "uuid": "b0d5bdaa-f7df-4662-b058-e2cae7baefab", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604539, "uuid": "6a8b88c3-8aed-49be-a7fc-b446266a958c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604539, "uuid": "6aa52445-8cbb-479a-bcd8-68c0f3b4002d", "value": "RFQ-415532-Refractory Materials for KNPC PROJECT_Tender in Kuwait...xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3802d54f-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644517, "uuid": "2d76b755-6cbe-4c4f-af8f-42e850c96be5", "comment": "Malware payload (Dridex)", "value": "6ea676a7e6d300c2c153a36945a29ca2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644517, "uuid": "f2a1fb51-4474-4240-bb58-60d8e16f35f0", "comment": "Malware payload (Dridex)", "value": "537ebaba08af9bf870b82db11fcd9201064f358b43e660c2c2fdb56ce08b7399", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644517, "uuid": "02856a12-2912-45a4-b15b-fdfe89fdecc4", "comment": "Malware payload (Dridex)", "value": "384af49e10db5cd62eca1d06443526a42d26c81f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644517, "uuid": "234751f9-8bcd-493b-aa68-c7d9458f5532", "comment": "Malware payload (Dridex)", "value": "0d2d45b179cc6c30810c42a9fa952845d2bf771a46ae98615f3c18c9daeaaaa2a18badc328090dce4c36c005613c3ba5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644517, "uuid": "c4263465-f96f-4ca9-9f51-6dcd248475fc", "value": "6714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644517, "uuid": "b2a7dd80-1962-46c5-990e-96356956b3c1", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644517, "uuid": "ca92590e-b6de-4b3d-9027-0e4754bc4051", "value": "3072:PBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:PBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644517, "uuid": "704e54b6-5837-43a0-b1ef-586d7e12527a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644517, "uuid": "0157320b-eef9-4db1-aa39-be8973d8e00c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644517, "uuid": "6ae20ed0-cdc9-48a7-b676-a27fe77c5c12", "value": "537ebaba08af9bf870b82db11fcd9201064f358b43e660c2c2fdb56ce08b7399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e333d6-95cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617599010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617599010, "uuid": "d46197a8-3910-462b-9e5a-a5af0f9d3a1e", "comment": "Malware payload (Dridex)", "value": "dee6a7a5ef3044bed7aced10d2dec0d3", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617599010, "uuid": "e1be2f68-5ef0-4b7d-912b-e401412342a9", "comment": "Malware payload (Dridex)", "value": "539e7484c6fa16eefb8ef3d763d50c029db6f0a87f00e9abcf9f0c852ee94968", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617599010, "uuid": "c35a69c1-717a-434f-86e0-940a343ab3be", "comment": "Malware payload (Dridex)", "value": "0909fb780ce145862fec3baf78b4ed4337740293", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617599010, "uuid": "58cf1aa8-3aee-4663-9e0a-b511283a1d28", "comment": "Malware payload (Dridex)", "value": "23f58583b69182fdccb651faaae4e43c238f84dfeee7650d2caf3ddb62858ef31201f2bbd7bef17f38b38f6d5536471c", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617599010, "uuid": "d6e70f5f-a7d2-4b72-91b0-1e507d985764", "value": "1A058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617599010, "uuid": "3542b6c4-8a14-441a-b270-b648c80a4973", "value": "523b18dc1c7a7f2ecc8f20b6295beddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617599010, "uuid": "c07cf184-37b3-455f-921d-9aa8d390f0fc", "value": "12288:HbqkjZV1Vu8MpJYosZUmc16RWdrpo8+FFcLxT8HoxmRsDJteMKT281MOU7qOkQR1:HbqkjZVqxYjxoArwQobmMKNiOUFkK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617599010, "uuid": "6aee006b-a7d6-44cb-b0bd-5035c05cf256", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617599010, "uuid": "495e6480-0871-455c-b0ee-5978b8b44df5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617599010, "uuid": "90c23b26-9553-4001-8e4f-ce5bbf816d84", "value": "539e7484c6fa16eefb8ef3d763d50c029db6f0a87f00e9abcf9f0c852ee94968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaed926-9651-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617656313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656313, "uuid": "76390205-dc40-432b-b827-dabaccce84c7", "comment": "Malware payload (Dridex)", "value": "872024c06c1c49c26500ec8a610f77fd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656313, "uuid": "4e22580c-65df-4a63-abd9-5a60a63a338f", "comment": "Malware payload (Dridex)", "value": "550afaa641e643b9acff503491443eedb1d0cdced66daf3fbc75997ab0850d90", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656313, "uuid": "d72def7b-89c0-4d6e-8de8-96d8b4a77783", "comment": "Malware payload (Dridex)", "value": "758d0a7d19df6481479b34cf0803111a5507cf1e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656313, "uuid": "740c7339-8e6e-4d70-94e1-e0787296280f", "comment": "Malware payload (Dridex)", "value": "4b24b15333f4523bae11d26aa54620f23d5a3bbcdad14e9e96f19b9b62f7991f1ee3a905742721cb07684b8c46534c17", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656313, "uuid": "dcf23bda-3233-4797-8a00-de3a576098c7", "value": "E914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656313, "uuid": "bcd81f04-8403-47a9-a803-d1baa25882bb", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656313, "uuid": "2320e200-4b87-431d-bafa-7656871cf56c", "value": "3072:eBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:eBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617656313, "uuid": "b6fc0a4e-6777-4a32-852e-df30db3e66c8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617656313, "uuid": "4f60589a-237c-42a8-805d-a7a40f97bc14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656313, "uuid": "f23de6d6-4ead-4405-bdc1-9c9a1623c8bc", "value": "550afaa641e643b9acff503491443eedb1d0cdced66daf3fbc75997ab0850d90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc30c462-95e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617608715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608715, "uuid": "83355b15-d999-45bb-b887-fe7559b6db5c", "comment": "Malware payload (AgentTesla)", "value": "d7f1499b6958a3bfbe8a454ab094b73b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608715, "uuid": "82bc36b1-c054-4c72-be47-b39906df3e1b", "comment": "Malware payload (AgentTesla)", "value": "56526ec39f828ce1f9c0ee1ddcaaa574d873191fc901f460ae08952a97fa2992", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608715, "uuid": "1ee145df-2eff-4a3e-9d15-9e2ec3c8395d", "comment": "Malware payload (AgentTesla)", "value": "ebe24ffa520b6b807de2c8b58418ae309bc4a420", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608715, "uuid": "9184ae33-f52a-4c54-9201-f506eb6b5d52", "comment": "Malware payload (AgentTesla)", "value": "20d14534627c15564982395ee93ac9a51a7b5fa3897a4aacdbc4fe23693797f5697aa4fd7970a24106f6fa14a853f923", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617608715, "uuid": "70b060ab-f589-4d23-b5cb-d121c5098bbb", "value": "06F423D90B03A215311DE6C8663FE8A8E4CF6C2450C07B8554B1BBFB44C7F72A5B2997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617608715, "uuid": "61a0929f-c284-466b-a758-425799d90e63", "value": "12288:136LZslj/Qfrny1ds+d40HrzV684uat+f8uxVTwKXZjv+xMJxItIEwQHrkjpijuM:1uTfrn6KE+gf1CKXdv+OrI6EXLoptzyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617608715, "uuid": "8fc11a02-26bf-458c-a843-b94284659444", "value": 764329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617608715, "uuid": "89f6ca1e-5e44-4d9a-beb4-5d2b4bfb9482", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617608715, "uuid": "936cb886-6860-4321-af62-4eac18e244db", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4204465f-9645-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "0e90d664-0b4d-4ced-a198-364736b6b2d2", "comment": "Malware payload (Dridex)", "value": "a79afb89a6f28757222bb69b765ebd37", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "5cc12ea2-bd81-4ea4-8c42-aecc14e68e3e", "comment": "Malware payload (Dridex)", "value": "56630ac478c94fc82af5b4f1744eb508aa1bb624c39bafcc56322e9b8f124515", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "c83bb942-928a-40cb-b28f-74f872dd7c8d", "comment": "Malware payload (Dridex)", "value": "f65bfa8696aab8809b5ed6c3bba492fe60507267", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650976, "uuid": "32e654df-6a3e-45f4-b939-764696e2c275", "comment": "Malware payload (Dridex)", "value": "f947ab34efe1f1604d63046e2eb844afcc36321203235d73dcd30d9d5753a38edd4d6bb09a271fbbea12c30bc16039dc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "c276032d-e490-46cd-bfcc-e13c0ffbc047", "value": "6414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "b293d00b-6942-4945-ab9f-64310b770534", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "1389f30c-9e8e-429d-985f-98d4675d0cbf", "value": "3072:mBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:mBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650976, "uuid": "bd492601-468d-413d-b5c9-d0dba6daf761", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650976, "uuid": "952266e0-b4c1-4a5d-be7d-c6c199b52af5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650976, "uuid": "495c3319-68b7-480b-bbd9-52decf4dbde5", "value": "56630ac478c94fc82af5b4f1744eb508aa1bb624c39bafcc56322e9b8f124515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e55b57-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604253, "uuid": "a7f56f84-c080-409b-9ef8-701934596562", "comment": "Malware payload (AgentTesla)", "value": "3a7e5b56f57e9a8ba689ae95b58beea5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604253, "uuid": "5b2e2ab7-e2c2-4b0f-95c7-dfd0b0bfefbe", "comment": "Malware payload (AgentTesla)", "value": "5700f9cb1f8277f84653a6ed9307eade654262cc37a141cc0c1cff1fb1096e8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604253, "uuid": "3d062e3a-82ef-48a4-8929-529e4aff1017", "comment": "Malware payload (AgentTesla)", "value": "2b632728b725320e35bcd329ea33acef9eb38a82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604253, "uuid": "47d5c57d-b564-441c-974d-547c5b5b84ce", "comment": "Malware payload (AgentTesla)", "value": "c087c1aac110467bde9271beae8b5aa1ab76d27559e14f497a4b2ba0a52852cad8bd9968a351422f3e8db96e7c086264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604253, "uuid": "d2365826-86b1-4fcf-a764-070611de8da2", "value": "DB15D02B3B61D954C11C0D3A441B92DC83FA5A0B79D2F79F70EE2B8D1F202B6975B489", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604253, "uuid": "c2d866c4-c806-4af0-a74a-7dcc6c6f7b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604253, "uuid": "c9393fcd-c430-4f79-a04a-4259ce810d44", "value": "24576:HsRkQoo5h0d9Z+biJm8o5hFJVzw9UPeiELJs95EK:HxxZjanzw92pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604253, "uuid": "e3903d07-96ba-4adc-9587-55e7c85b5e2b", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604253, "uuid": "848440b2-6d98-4165-92cf-8c763bf249cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604253, "uuid": "686da8d6-41a8-4c39-a2b5-248bd5cd3b53", "value": "MV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec70b3d-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617643911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643911, "uuid": "c3c994d2-a8f6-41de-8e74-6aea06cd283f", "comment": "Malware payload (Dridex)", "value": "c6937bf4b8fa38f9ea0a1a25fb600a91", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643911, "uuid": "c48f8416-0495-4627-b73f-ea60b176c0b7", "comment": "Malware payload (Dridex)", "value": "576035a7afb7e4ed354f4b5f204fb7af19b3ef7a0bed5f3ba59b61010f8551a2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643911, "uuid": "870b5b50-43e7-4208-a860-d2bd0d01615b", "comment": "Malware payload (Dridex)", "value": "6a12ae8af0901d2af754272b2fa6884e9c7e0834", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643911, "uuid": "17e489f9-77db-49d7-a1e3-3162ae70d8b8", "comment": "Malware payload (Dridex)", "value": "981a72f4632ddc2fa4a63046f50818d04eb0f2754d63b13342bf2c13832f8068f71ed6581b1cd83a193662366b99ef5d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643911, "uuid": "c3146baa-36fd-4b3b-a16f-372fac16fa91", "value": "0814AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643911, "uuid": "37f8fc43-f2e0-4a90-9f8f-9cc49f43e81e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643911, "uuid": "46a8936d-2f95-4c3d-a056-ef56c54c1b5c", "value": "3072:FBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:FBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643911, "uuid": "d72b8122-7509-4ab6-bcdb-e79cd83a105b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643911, "uuid": "a91852ad-4d40-4b6a-9f2b-1b6d0210712e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643911, "uuid": "b2f83888-15b3-410c-ad18-214a30e4704a", "value": "576035a7afb7e4ed354f4b5f204fb7af19b3ef7a0bed5f3ba59b61010f8551a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226437dd-95d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604538, "uuid": "0a93edcc-9d43-43b8-939d-4c8630c2eba6", "comment": "Malware payload (AgentTesla)", "value": "81ee5e72632c8148f758f6cb3b788806", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604538, "uuid": "d650332b-7e2b-473d-8a5f-6e163a4066ee", "comment": "Malware payload (AgentTesla)", "value": "57bc81f09c26a67ebfbf6ed01a86c622b298fcb166ed09e93c4a03db6be28910", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604538, "uuid": "7cca6927-a0a1-4b6b-9d72-b6209a2f9e57", "comment": "Malware payload (AgentTesla)", "value": "8c0f04d37ada61e18e9c6d8a7819e7ac6e6c6cea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604538, "uuid": "d1e2a4ca-e503-42bd-b0c0-a49d939e4f6c", "comment": "Malware payload (AgentTesla)", "value": "e5e26e839b7e2b7c9f4a514c689a8d490f9dc9cee334a254dc0706038a0924acf2501b4f38cc1c0eefe2437a1c538122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604538, "uuid": "781d0abe-1f87-46db-8e8f-11413dc91797", "value": "1F459CD1EE93D204D84A1EF4C42FC11C5662EF086F2DDD09698CF3491A72A5ECAD56F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604538, "uuid": "571d1846-26c5-4270-bd77-1792abce55e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604538, "uuid": "a2ff11ac-7c8d-473a-b5f1-550fc9e70621", "value": "24576:MQjmy8geoGDrdqBCdqvC/+k1Kwu2bTic+:Dj78NTF7dqC/+fSbTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604538, "uuid": "9bdc2241-f9e2-4db9-822f-9b47eb27bca8", "value": 1270272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604538, "uuid": "56806c97-c079-4131-a82a-9951b09c8e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604538, "uuid": "cd0982fa-5cac-47a5-ae7b-1d84eacc4fb8", "value": "RFQ#GH55564I_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f8f8f9-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647735, "uuid": "4b194c6a-e25e-4892-b864-2c534fe15c44", "comment": "Malware payload (Dridex)", "value": "02623c21827f3a2034f305a63e33d398", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647735, "uuid": "5efef62e-da6f-4655-b097-1395c0455bab", "comment": "Malware payload (Dridex)", "value": "5897a6e268f237d7d505d0c319d89ef116a60da72cdb30d0d8b7f4a644863f3e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647735, "uuid": "19954be6-5301-4f35-8fa2-80115b484ad2", "comment": "Malware payload (Dridex)", "value": "55cd03bb600b04ab970d3b578d9ba37dfb4cbc47", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647735, "uuid": "e5d746ef-a469-460b-b6f7-db32b4444e4e", "comment": "Malware payload (Dridex)", "value": "61aad8d7276f6318d65818289aef7b46c3f000384b827e946507a902bfea3b2239421136a65ce0d4d07b2f777e7ae020", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647735, "uuid": "1bc7e1ed-14a5-4633-ae07-f6cc9b35f712", "value": "3914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647735, "uuid": "88616744-1fae-4e8c-a394-fa044f46cfbd", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647735, "uuid": "9dd6baa8-3588-45d5-9c0e-80c124043eac", "value": "3072:iBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:iBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647735, "uuid": "ead3a57b-eab6-4010-8083-92e335c3a926", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647735, "uuid": "479c8c4b-c8b5-4395-81d0-fe6c34748b89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647735, "uuid": "edbff361-61c0-49ee-96df-ce269e853f9a", "value": "5897a6e268f237d7d505d0c319d89ef116a60da72cdb30d0d8b7f4a644863f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6dc5a7-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649813, "uuid": "fadc0140-b759-4b88-be44-0e3cfaf84662", "comment": "Malware payload (Dridex)", "value": "f1f936adb2f3e03b9f9d65f218987ada", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649813, "uuid": "4e6de6ee-25e7-4066-9149-2061261ca26e", "comment": "Malware payload (Dridex)", "value": "592afc3f91f993e9a67df69b0993b13b04e7238817adbaeaa9f82f674d85938c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649813, "uuid": "1cf88b57-d512-43bf-be82-8860dc2e1206", "comment": "Malware payload (Dridex)", "value": "81110205224ff96da4243ebe2fe35ec5c97c5b27", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649813, "uuid": "6dace605-4039-43a7-804a-b6f659f83765", "comment": "Malware payload (Dridex)", "value": "bb96514909d516f5f1050470639b23f9a81977caecb13fb9e80d99ce023619766c8e3fdc969b923128b990a7753b4eb3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649813, "uuid": "c8286944-01f9-4fe1-bfd8-5d62ebf6da91", "value": "2714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649813, "uuid": "e62535ff-4d8c-4943-9f39-8fa1b5c7c4c9", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649813, "uuid": "e7f381a4-511e-4fd6-95ba-cb57dd3087f3", "value": "3072:GBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:GBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649813, "uuid": "80b4d9cc-2e6c-44ec-b40a-d851e41d4a7c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649813, "uuid": "17d92e11-15cd-4f2e-a69d-95b6cf0e6b7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649813, "uuid": "b31cc34f-f455-4585-a7a5-cbfe142d9ebc", "value": "592afc3f91f993e9a67df69b0993b13b04e7238817adbaeaa9f82f674d85938c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a67e59-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615032, "uuid": "1ec8f708-22c9-4de5-8724-28b977ea7bbe", "comment": "Malware payload", "value": "6eba4d0c276fbe868538114ccaeff112", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615032, "uuid": "8c754f14-73c0-4712-bbbc-778c78c144d6", "comment": "Malware payload", "value": "59a9070703cf67481acab89f7c77d54da976f2922075dd81894b837cca0b1a21", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615032, "uuid": "118dab26-1b0c-4088-b021-1a24a06a41d8", "comment": "Malware payload", "value": "7b392be081fb5354041303ce56048fd8d6c923e5", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615032, "uuid": "391281f2-7197-4215-884b-a90b5f0e75ca", "comment": "Malware payload", "value": "f7870f1dcfd9ea14764c51902fb75503fe322cfaaec837e70671be6edb479b5868572853e1accf6d659d0467bfbae82e", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615032, "uuid": "fda5d878-a411-47d7-9496-d43523f64832", "value": "EC663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF63AC5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615032, "uuid": "b4b78d6e-0df1-49f2-a658-821b51a4358b", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615032, "uuid": "d933da59-ffe5-4126-858a-004b0729ff88", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazH:kfauN/HYOSIT/EVF9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615032, "uuid": "10497cbe-3f81-4d91-bcde-d4ac26314889", "value": 6967077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615032, "uuid": "e04df036-928a-4098-86ab-4361a0027c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615032, "uuid": "d482c9eb-bf3d-4075-9752-6f417ad1009e", "value": "59a9070703cf67481acab89f7c77d54da976f2922075dd81894b837cca0b1a21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410803a8-9645-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650975, "uuid": "84f6717a-8bc2-44df-9e96-6133371df6f4", "comment": "Malware payload (Dridex)", "value": "0b1bea9b9195339a565d01bc4b8f3935", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650975, "uuid": "ce6d7363-6097-4e40-ac25-a3c9c4048553", "comment": "Malware payload (Dridex)", "value": "59b7ff7f98bd2c6d82bade8d564cc492449f0a98f7ab41fea47468ff332e24e6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650975, "uuid": "1786c996-d03e-4c07-b81b-718ffdf00637", "comment": "Malware payload (Dridex)", "value": "a5f076d297fcde669ba0bd3121b3917062242f5a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650975, "uuid": "f0a904d8-bec0-4754-a55f-a2fc1d585970", "comment": "Malware payload (Dridex)", "value": "713f94df8c223461476995dcee3bedf7f2f30c9ecfbc3ab26014baf234bcb599c31b28889b2991498a2327045d3c575f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650975, "uuid": "3593ebbc-95f1-483a-a382-b8dbbcf4eb48", "value": "0C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650975, "uuid": "93bffebb-b563-4c4f-b38a-54819bb719fb", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650975, "uuid": "2f9e7e80-1057-4b38-935a-0e2b0d0032dd", "value": "3072:VBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:VBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650975, "uuid": "001ea9f0-af11-44c5-9e25-4fc99016c1a0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650975, "uuid": "a521dba4-e937-45d1-835e-13513c8685ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650975, "uuid": "0778d3cf-1960-4449-b7c6-2f7fc5e43b64", "value": "59b7ff7f98bd2c6d82bade8d564cc492449f0a98f7ab41fea47468ff332e24e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8aa52d-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614807, "uuid": "2207d0da-343a-4d76-a572-d6e8ff002369", "comment": "Malware payload", "value": "4fd8837d4d61592caed82ac2cda2b773", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614807, "uuid": "e8bde248-82d1-4f8a-8efa-d8b8aefc850a", "comment": "Malware payload", "value": "5a793b0d7422c599f190d907f38c095e35964b3deb1c9726a413173c2650a621", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614807, "uuid": "760b5748-88e4-4f80-a9e7-6cec9f5b01c6", "comment": "Malware payload", "value": "917143ff4aea20d6b2e94fb2c201cb89fa87f6ba", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614807, "uuid": "46755de9-4d74-4172-88c0-a1b8e5db0d8a", "comment": "Malware payload", "value": "834dab05bc0f59acbd98bcb711725644c490b491dfbc18858a80a1a9c4331f9789142316d772c7c7323c9d4449a8d578", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614807, "uuid": "2aa6625c-9980-430e-abca-0a4391bed2e0", "value": "B4663381F0928CBAE8F611371AB6D1353A7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614807, "uuid": "8ecebfb5-ae97-4f36-846c-dcac0f9a894f", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614807, "uuid": "ad352b7b-5523-49fc-90f2-e5af48aaba2b", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazt:kfauN/HYOSIT/EVF9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614807, "uuid": "c5185720-c5dc-4076-b2dd-2e850f3f6aec", "value": 6967161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614807, "uuid": "44402ed8-77f2-4369-88ef-331edb86188e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614807, "uuid": "fb4aab72-4ee6-45a1-bdb0-d06bc46dea71", "value": "5a793b0d7422c599f190d907f38c095e35964b3deb1c9726a413173c2650a621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f10ea5-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614826, "uuid": "1abb474d-4dd2-4b26-b239-b7f82cf0b7f9", "comment": "Malware payload", "value": "0909225de438e0b387a0b184e6fcc852", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614826, "uuid": "b64e11fd-f18b-4d1f-9ef7-f259bb477a01", "comment": "Malware payload", "value": "5b29fd421e1874ba8b156dff9494e219c35714ea149865053a88a83108a45ed4", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614826, "uuid": "347bf1ae-7df3-4f5a-bdb3-df10077bc9d7", "comment": "Malware payload", "value": "1befc5ea0bd95ded2a66c13ceb80a440c69fa039", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614826, "uuid": "777a1ce3-f680-4a1f-ac97-11879169a03e", "comment": "Malware payload", "value": "c7ef7e645e26de86cf22d1930a15613559f0be2916f850eb5669178514a35e9d24dd03975f7a7f5eeaadbfe8d7d87694", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614826, "uuid": "b2dcffc3-3e25-431b-9f54-9b7e47227fbb", "value": "F2663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614826, "uuid": "8126b48d-5fe1-40a0-9235-2648874751ce", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614826, "uuid": "07974a59-662e-472a-b767-c7c1a543d564", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazE:kfauN/HYOSIT/EVF9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614826, "uuid": "23d5cd31-3239-496f-a0df-4d12b60520da", "value": 6967148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614826, "uuid": "680928de-f9de-4620-bb6d-cdc2c775b904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614826, "uuid": "6348d935-ce02-484e-8cfe-9f4d6753bb41", "value": "5b29fd421e1874ba8b156dff9494e219c35714ea149865053a88a83108a45ed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4515733-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647786, "uuid": "6063c0c6-1e9b-405c-be8f-6b3ca5263b2f", "comment": "Malware payload (Dridex)", "value": "bf90c93d27101bd7d4d80d92f43a789c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647786, "uuid": "3cdd69c6-c412-4f0b-8fec-e9d4e4ab4bde", "comment": "Malware payload (Dridex)", "value": "5b39655b1b7c4e41096a9c775c4216e31cea8af9f9ef6e1b78c0d060ff5bbd52", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647786, "uuid": "e16c725d-b2f0-47a1-8244-c23f408d9af6", "comment": "Malware payload (Dridex)", "value": "80e1732e52615e2560e41beaff8b7bc879d3f877", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647786, "uuid": "6525d0c1-d818-44b8-992b-f0694b538fc0", "comment": "Malware payload (Dridex)", "value": "9134125dd9ab76ecc1e5992279c8fea01d9a95f674fbbf18bb7e6812051cdcc59a04963d89ce77661bed013b95430328", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647786, "uuid": "5becef21-17f1-4431-a4a0-ad8b68ff3b2b", "value": "B214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647786, "uuid": "0e1bd861-7fb2-4a66-8afb-ec8ad5761921", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647786, "uuid": "1816b688-fbba-4e7d-8d14-cd7fd9735afa", "value": "3072:5BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:5BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647786, "uuid": "6dfd65a2-d247-47a6-940e-e4f1ca54d4fb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647786, "uuid": "c64bab17-8974-4e20-9ae3-822057b996f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647786, "uuid": "4be938b3-30dd-432a-9cda-3909d1e63b9e", "value": "5b39655b1b7c4e41096a9c775c4216e31cea8af9f9ef6e1b78c0d060ff5bbd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003c995f-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647860, "uuid": "2368aa97-72bc-421a-877c-82f8e0084994", "comment": "Malware payload (Dridex)", "value": "9672fc796120f2347a6895cbb06b3f64", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647860, "uuid": "ecbb0826-4b17-4533-896e-195c7bcc714d", "comment": "Malware payload (Dridex)", "value": "5b5839ec82d8e906e2e50e04634da18ce98a2f98544c12f99bd20aa0fe98cdb2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647860, "uuid": "bb45c67e-5d15-4eb2-8d4e-1f74785a7c14", "comment": "Malware payload (Dridex)", "value": "807ca0061e2d73913d31fa3323630837cd238a1c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647860, "uuid": "6c0a6461-54d8-4717-bada-2033fff5c9a4", "comment": "Malware payload (Dridex)", "value": "ae2f8d7c4c8a92240195fc2bb206c4f1434c6658d1d416f66bcfe1ae2e668f7c717c67ebea1a4c3cfd614ff17cbeda04", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647860, "uuid": "ad62b2e2-6ff0-4c73-8897-6d2fe33a3933", "value": "2114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647860, "uuid": "9a0aa60f-29e1-44ff-9906-863fadab5b28", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647860, "uuid": "d592d686-f1da-4e6d-935e-e35b246fec7d", "value": "3072:2BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:2BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647860, "uuid": "6c3da219-7ca5-490f-919b-34fbe14859e9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647860, "uuid": "02b259d5-f2f3-432f-a502-88ede949f8c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647860, "uuid": "da5c6487-b3ed-4ac0-8e26-9fd552b6d6fe", "value": "5b5839ec82d8e906e2e50e04634da18ce98a2f98544c12f99bd20aa0fe98cdb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f20fb0c-95d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1617604532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604532, "uuid": "4204ccd3-85be-4f47-86cf-27a048e605be", "comment": "Malware payload (AveMariaRAT)", "value": "bf2da3e5994261e3b37b66785f1e2df9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604532, "uuid": "656636a5-9819-47cc-8633-d74e8d16a71e", "comment": "Malware payload (AveMariaRAT)", "value": "5ba2e4021682f2700ca05c93eb32efb3c93d7bebd816842bdcca6cc768771cbe", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604532, "uuid": "2fd84f72-b5a9-4289-8502-be3669b9d0c0", "comment": "Malware payload (AveMariaRAT)", "value": "4e3cb839e6e1b5181ba36847a7c8ea243d22443f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604532, "uuid": "0cf3d849-8672-4c49-a4f5-6e6b731fd0c9", "comment": "Malware payload (AveMariaRAT)", "value": "606cac817aba17d81fc5b20a238d378abd04b2d16d21bf75be7f363376d6c365087e12a141dd42141c3b89d40e268709", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604532, "uuid": "5e1153ee-5511-4036-b6ac-d530f53b1e80", "value": "9C15BE0162904351E8EAAF349C37C7500AA3BF01BD2DEE4E7DDC715A1FB379796126A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604532, "uuid": "318aeebe-ad81-44e8-9912-b18f70c5ec8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604532, "uuid": "af5748f1-0946-4995-b72f-e78b7abb93ed", "value": "24576:RYdZKoEBsDYbFH2uymRy2hbpDZILvXdOO:WdZKoEOOOmM2vGLVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604532, "uuid": "d1545e55-af56-46a2-9ca4-ebacb78c9592", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604532, "uuid": "0547f652-ccfc-4942-8967-b183432f6dbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604532, "uuid": "7866e786-d99b-43ef-bd68-1ec59be27513", "value": "FRQ_05694 revised quantity.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4491d478-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "60a8b5c0-dd55-41c5-8ebb-4976dc989030", "comment": "Malware payload (Dridex)", "value": "4b1c032202a20245c387785b225d6c85", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "17db5cd1-9e39-4512-9492-9cb33a918818", "comment": "Malware payload (Dridex)", "value": "5c5577a041c2f9906f04972fe181be4fa5fbf54cb4a4ab2bf48bff0b54a4be20", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "8e30f66c-ca40-4fdc-8ad4-b1ed77e91770", "comment": "Malware payload (Dridex)", "value": "9eef09ee99f37cb7ec5236302a456494c0b1d0fa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647974, "uuid": "0b16b4cb-b3b7-4d33-b2ac-a5368224d924", "comment": "Malware payload (Dridex)", "value": "eb306d576bb34c5a38cf35914d50916d617a32806b744f8d178c608a38fc511205d37390055c4b6056a607590b117171", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "4d6f4c0a-4b3a-4eca-a3fc-171296eb7f45", "value": "5A14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "cd8ae608-ab57-4b94-a876-69ae5aae880e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "0d1208a1-bcb7-4ed2-8a68-218464b3f1d3", "value": "3072:OBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:OBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647974, "uuid": "70ec32b8-dc47-455f-808a-720e19391a22", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647974, "uuid": "15983b23-166f-46f8-969e-71ad380dcd6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647974, "uuid": "e7e8a799-63aa-457c-b922-f8ee0edf42d9", "value": "5c5577a041c2f9906f04972fe181be4fa5fbf54cb4a4ab2bf48bff0b54a4be20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d97ba0-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644562, "uuid": "024e8115-e234-4fff-9d17-1856b426203c", "comment": "Malware payload (Dridex)", "value": "b48f1f4d6e6842a8aba9d8cd6926378b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644562, "uuid": "d32f9d40-32e7-4ffa-b37f-b9670d72f3e8", "comment": "Malware payload (Dridex)", "value": "5c88544508611c9df42bfaab71e9d564a49752cdc26b9f17ed2321eeba0a899a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644562, "uuid": "5356c998-5d5d-424a-8f22-b6c2e827df26", "comment": "Malware payload (Dridex)", "value": "eb27d904bf0976e2d44f2b3179fe32388b6d52d2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644562, "uuid": "ae2e79d6-9ef8-40bd-847a-928c1bcdfc35", "comment": "Malware payload (Dridex)", "value": "124a150055e4fc3df63af6cc3065179fcd3170d493608ec669b1e9d91b9363e290cec23c3e1a093c5f9fb7b3d49fabe9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644562, "uuid": "0ef82fee-91e1-4b7b-86b7-cf5ad2db5580", "value": "4214AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644562, "uuid": "543ff3e5-b014-492e-811b-fc30ab3fc868", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644562, "uuid": "6e449e98-e77c-42f1-8197-161f4170c485", "value": "3072:wBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:wBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644562, "uuid": "b252a5df-f78f-46e5-bd6d-2a863389f3c5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644562, "uuid": "8156f2d8-37aa-4312-99c6-8a7962dc4835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644562, "uuid": "4068fb6e-a5b8-468e-b3b7-f040002e498b", "value": "5c88544508611c9df42bfaab71e9d564a49752cdc26b9f17ed2321eeba0a899a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dfd703-9656-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658531, "uuid": "e574d347-f0da-47f3-bc78-8776e9122ee6", "comment": "Malware payload (Dridex)", "value": "037e8d3f2a9754ccd6817b56f68fc913", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658531, "uuid": "02933b5c-d140-497e-bc31-1e0db7003422", "comment": "Malware payload (Dridex)", "value": "5dcd03cb73a7c52d92f79b758cf0e88d1b25e593d93f4bea450ec493316a1e08", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658531, "uuid": "e2c7aeb9-2e7b-4db6-a908-a03239b4e90e", "comment": "Malware payload (Dridex)", "value": "a69521d5eaf625c28152c2fea422b7425dcfe260", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658531, "uuid": "e1e21e4e-e4ae-4102-a2c4-6a29bf65481a", "comment": "Malware payload (Dridex)", "value": "6f59724116541b9bc8d9a2bb903af25ca26c8760ff55877296fd8fa13e441da44f901bec5cf1a19ae487c5abeaaacc93", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658531, "uuid": "8b934222-4830-4e2f-8fee-a8f44906d144", "value": "C9149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658531, "uuid": "6b11eaf4-6055-4283-bf38-40d293d58df8", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658531, "uuid": "7c4f8720-758d-43de-98d4-34c32b502317", "value": "3072:s6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:sZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658531, "uuid": "e4eb0386-db6c-42fc-a6a4-c9459595371e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658531, "uuid": "116f7f84-bae1-4f73-b495-22341a7033cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658531, "uuid": "8a2ac9a6-7a4c-43e7-95ce-85a1dc845203", "value": "5dcd03cb73a7c52d92f79b758cf0e88d1b25e593d93f4bea450ec493316a1e08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17903c9-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644345, "uuid": "0abe8632-c401-4e56-bfc3-9df621b96980", "comment": "Malware payload (Dridex)", "value": "cb9fdd0309191c63f625022883536ca7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644345, "uuid": "e35dac85-16b4-4e11-bf0f-2d98e860aa04", "comment": "Malware payload (Dridex)", "value": "5ddcfcda4d2ec012ca71efed8fd1e630fdf2a3809865ab8205a67159744f13d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644345, "uuid": "6da8d785-45a8-4149-ba30-03084afa36d1", "comment": "Malware payload (Dridex)", "value": "393ec69fd13b3602796c2549ff2659258d19b185", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644345, "uuid": "e13c0da8-8af3-4c3c-be78-a6d1d38ce85e", "comment": "Malware payload (Dridex)", "value": "73ba822fef10382a660d59c71b14c2f2de13feb5e9ca74230248a2637aa5de997e058f65bd3b6aeb9e292c55497d7ec1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644345, "uuid": "d373347b-c93a-4bdf-b48d-f77fb6401c20", "value": "9714AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644345, "uuid": "834ffcbc-aa10-40c4-9dca-c2f91a45ec92", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644345, "uuid": "7d728277-3458-45f2-92cb-9c2080b49b63", "value": "3072:kBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:kBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644345, "uuid": "1488b070-1eb5-44c8-9575-ec33076bde5d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644345, "uuid": "7676e60a-7d18-4e40-bf00-48da04eed5e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644345, "uuid": "f8d0e075-1db5-404e-b927-2cab476e4502", "value": "5ddcfcda4d2ec012ca71efed8fd1e630fdf2a3809865ab8205a67159744f13d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d24e59-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647807, "uuid": "5ee5aaeb-39c8-4443-8099-e0fb53736066", "comment": "Malware payload (Dridex)", "value": "3ff70074340fac039d2ec9c70c36c604", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647807, "uuid": "711553d1-aec3-4ed3-a782-e5d9f96d2ef8", "comment": "Malware payload (Dridex)", "value": "6089951f7af6066461cc094da709032210848ef49f8c31a1b195669b967da357", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647807, "uuid": "f742fa54-76ea-4ec4-986a-bf77d3889e61", "comment": "Malware payload (Dridex)", "value": "b91eb11e7d92f42f11cf72920e9cd6fd6084f80c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647807, "uuid": "98abe323-af41-482c-a73a-453e3bdf4f9a", "comment": "Malware payload (Dridex)", "value": "200827bd9a80a2c98ca9a690ce1029b6b5e4b1d745bdd5c7bbde432d6ad9de34aad7f03bd19d00c71cdc1d219871c28a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647807, "uuid": "22618003-959c-412f-ac86-56552a241586", "value": "A914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647807, "uuid": "9dce63e1-2cf3-4f50-97d8-eedb56daab2e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647807, "uuid": "4d5d111e-2775-47a7-a54b-8ad081bd086a", "value": "3072:8BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:8BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647807, "uuid": "b4043751-9aab-4f94-9982-11e277c2d4d8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647807, "uuid": "a17519da-ca36-43a2-b179-205f7e7c87fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647807, "uuid": "4ba94b6d-91b7-4be7-832e-8d34c7fb6316", "value": "6089951f7af6066461cc094da709032210848ef49f8c31a1b195669b967da357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874ddedf-9647-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651952, "uuid": "f1f1ff8d-9804-4d68-babf-79db2c37ef5b", "comment": "Malware payload (Dridex)", "value": "0bf82798b2c92df41682974d4788f890", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651952, "uuid": "b2d7c546-9a50-457a-9b03-10448865cfd5", "comment": "Malware payload (Dridex)", "value": "60cbbe31bdb19388fe11b73ba96a343339432b6cf650284bb132ab7d749831ea", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651952, "uuid": "d074c5d2-4f64-4283-ae79-3a4147dff6d6", "comment": "Malware payload (Dridex)", "value": "d74e477641758621295b3f680aaa9cff1ee13a2f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651952, "uuid": "3da606e0-a910-4995-ad55-44540a0b8ab8", "comment": "Malware payload (Dridex)", "value": "5e3353ce319e52c780e1e993bb65b923133cda2e668efaea1ca8105072b533e460881dad7b3ac4dd1afe4879995e3313", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651952, "uuid": "1b927bad-5ddc-40d0-bef7-14a82876391a", "value": "EA14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651952, "uuid": "0fabb3b8-32f0-4090-b1a1-6ca1e830d936", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651952, "uuid": "06b577ab-548e-4762-9691-e05019c654ac", "value": "3072:GBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:GBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651952, "uuid": "4b3cdab1-2315-49f6-b5fb-9bd5122a1c7c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651952, "uuid": "8dd2d30d-e43b-48dd-96d1-edf0b354c9fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651952, "uuid": "7aee453b-d822-41c2-a2ae-c4e9ec18b0f7", "value": "60cbbe31bdb19388fe11b73ba96a343339432b6cf650284bb132ab7d749831ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d915103d-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604415, "uuid": "b8414f93-8d28-4e30-bbc4-62cbafcfb8fa", "comment": "Malware payload (AgentTesla)", "value": "745013fad2ace21f86e8ee3f5112ca39", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604415, "uuid": "1eacb6f3-dc91-4cd8-8ccf-3d8941b277c9", "comment": "Malware payload (AgentTesla)", "value": "61a1a2d7cf20b6b9678ce8949b80f4e9192612cf10f339e2e415fc65b6f8bf93", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604415, "uuid": "0428ce59-0fa7-4918-b776-6b7e8a10fb85", "comment": "Malware payload (AgentTesla)", "value": "44d4f4b432bd064574e2f23198f134dddea93f81", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604415, "uuid": "4d03ccfd-f7c0-4049-9c44-705b7831e9a5", "comment": "Malware payload (AgentTesla)", "value": "00e8252aa4c2612039fe881349a2e19f287b0677f865ca9290a9852639a2979821ba671350e99485d75773172d255f1b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604415, "uuid": "6b889ca8-4e6b-4718-b08f-79627fa63988", "value": "DEF423626BE203870BD822E9FE4F461A33B74AD210DA9463454640D06ABBDF375DF276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604415, "uuid": "438ca245-21db-473b-b5ff-f1f36651d438", "value": "12288:076DvpeiCTa0Acmm8iSYq0Pa4CDFmadyNVqWurOPOAML0BYcE9sAww/aEBT3Lc:08ciCTR0UnPa4CDFER2OPJMoEd1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604415, "uuid": "2b1f8684-a743-4da4-acb5-628a6b545042", "value": 764310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604415, "uuid": "8b7e1a52-4e2b-43e1-af1b-8c933b675942", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604415, "uuid": "04325e6b-06d3-4a00-98da-4830f7de6bd1", "value": "Shipment Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3450fae6-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650094, "uuid": "85121aba-c05f-44dd-b93b-0470f46f9ec1", "comment": "Malware payload (Dridex)", "value": "6967c0c5a0233dde16242f0e1706eea7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650094, "uuid": "b0d8539e-66fb-412f-bc14-8ed89502e1c9", "comment": "Malware payload (Dridex)", "value": "61d0d6f25a057f979b0dcebab3a70661146aa900cb4effcd307e4ba3af704587", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650094, "uuid": "b983c108-ad75-422a-be50-275af8886b61", "comment": "Malware payload (Dridex)", "value": "9ff72f681909cba5aa25f535beb56222115ecc61", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650094, "uuid": "1b407515-5e00-4c78-b0db-afafc9a3fefe", "comment": "Malware payload (Dridex)", "value": "fd17893c2b2a47768be82c4c0cbc9cba2e181e8ccd92ae5d4c76a56912799a56719dd1cfd9965fe89cb70d9f84166fa6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650094, "uuid": "be035273-0088-4fcf-b271-6f3edfe80c3a", "value": "5F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650094, "uuid": "319521f2-ffeb-4af4-b909-6615613dc523", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650094, "uuid": "b0619cdb-c80f-44cc-b533-6639d869bde6", "value": "3072:BBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:BBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650094, "uuid": "132695b0-7d3c-4486-ba84-de070e07dce2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650094, "uuid": "05150f7a-e4f6-4318-ad3e-2073b329fd33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650094, "uuid": "4c850b8f-5b92-4d9a-a138-a4c4e7460e61", "value": "61d0d6f25a057f979b0dcebab3a70661146aa900cb4effcd307e4ba3af704587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2908c61-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649850, "uuid": "98323428-3fd0-4243-a065-6a4baabf8509", "comment": "Malware payload (Dridex)", "value": "b622c55f869eb1367067ab8462e355ed", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649850, "uuid": "bb041c82-b7e6-4096-9200-fb463c48e988", "comment": "Malware payload (Dridex)", "value": "61d88ed8e0d0e99f9e74613c5820c491c628b7d9f9e02342e19b107813dd67ae", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649850, "uuid": "890b5ea7-6cf2-4911-88ae-0d113b518a8b", "comment": "Malware payload (Dridex)", "value": "ec611f52715cb7accfe99901e8a680b98707e23b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649850, "uuid": "5f6d787d-2d58-43ed-a431-2de6855483ed", "comment": "Malware payload (Dridex)", "value": "01571f1e2e4a9a54023ce10eeb36acd27cde247957e8c64a8190d234854287daff6ae74d73dd849dee522e81ad16735b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649850, "uuid": "6161cedf-3556-456b-99eb-53a6b9c954cc", "value": "0D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649850, "uuid": "c2a55d5b-842a-4fb1-8ad7-8941f87b6e28", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649850, "uuid": "f850fba4-f018-409d-b1a1-2fe1c66e5e80", "value": "3072:uBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:uBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649850, "uuid": "20b3ef20-3abc-40ab-9497-02487c613991", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649850, "uuid": "c242faae-bcb7-4068-99bc-8f937b908c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649850, "uuid": "d92d1fa3-9c5f-4553-a34d-1312b3543507", "value": "61d88ed8e0d0e99f9e74613c5820c491c628b7d9f9e02342e19b107813dd67ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bab92f-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604329, "uuid": "7c3cd232-44a5-4d9c-9f1a-3fc8dfa6b31e", "comment": "Malware payload (AgentTesla)", "value": "b9d093bf845f6565c9e254967566579d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604329, "uuid": "bdb6d69e-a6bb-4300-85a1-b2b1d94aa3a6", "comment": "Malware payload (AgentTesla)", "value": "629b3cae35bc68dd937d25e65631dcaa81a436286292c0be2d308708964f4417", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604329, "uuid": "143d7756-8325-4b27-bb96-684b84dbdaca", "comment": "Malware payload (AgentTesla)", "value": "90a62efd2cfb2b493d07f6d6eaf91f61414d2827", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604329, "uuid": "4629aa7f-f011-4e54-9408-925e883546b5", "comment": "Malware payload (AgentTesla)", "value": "49633e74f40824570fcef0bdbbc7a14813e79723339eaacc20e511739c01cc50684d450b2ed1fd62fa9e019fae87f2ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604329, "uuid": "2b6b2e27-3da0-4295-b602-242b90245bdc", "value": "F3459CD1ED87D204D8561AF0D82FC15C5662EF086F2DED09698CF3491A73A8ECAC56F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604329, "uuid": "cdf8e37c-a8b2-4595-b6ac-1482bd81fa3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604329, "uuid": "ba3e5cd1-0e82-4f19-8b9e-a5571bef0e07", "value": "12288:Ivi9zIyVW443SZaCv4YbWFyhEt88V5Sz3onFMwsnIBPjj13FzRD70apKEeTUoGzQ:T983bszvdE5Sz4CfnAjTSD/TGPKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604329, "uuid": "cb834f2c-17fe-4df6-82f7-bf6d9e049e18", "value": 1268224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604329, "uuid": "447b3bea-8fec-4eca-9863-e5b2d47383f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604329, "uuid": "72057c07-3c3d-42d4-b05d-46c252d9ed41", "value": "TT Copy_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0f2e6b-961b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617632901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632901, "uuid": "07ed2122-d629-4db6-8f8e-06be32d4cb64", "comment": "Malware payload (AZORult)", "value": "cd8a63f1deaf8fd925ce01ad1b9beec0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632901, "uuid": "0c19dc8e-f0c3-4168-b2a4-8e10615faaef", "comment": "Malware payload (AZORult)", "value": "62bcad1a08b9645f0b2bd969e31e3beda41ce828387eb60ce07b0749deee4c59", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632901, "uuid": "c7406bde-d3d6-4e81-be4b-a6e1c0c25d66", "comment": "Malware payload (AZORult)", "value": "50333bf88fdce3b16d0b4fbf48c9412b1a5d096c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632901, "uuid": "e4bda4d4-7a97-4d14-b20e-51b79d7270d0", "comment": "Malware payload (AZORult)", "value": "ac3b7c29a1b821e74d98707a3c2f13bc00ba3a50e9e37eed8a1a85a9a56d8fe2fd46ebc8f569d8459da0103ef91e23a1", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632901, "uuid": "fa5c26b8-f1e3-4ccb-9df5-dbb55eecd0ba", "value": "05E3029762D1407BFFDB05B00F766B1DD3B2A908181526C70BA14FF67A361E3CD4A09A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632901, "uuid": "11287a5d-6906-4f1b-abe5-a7bac4e5a821", "value": "9c523d8653da5455667e3f82274f2f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632901, "uuid": "6dbd121c-3602-411a-93a6-19bb467468e1", "value": "3072:AbLpZuEskJ1Kh8INgMnf/ifCRHxBsMA7KxbcnNcBlWXO63k3Ds+S0:AbOT9uMn6Ys7KV7DWeY+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632901, "uuid": "d1c364d8-4cd4-447b-868a-84353cffdb18", "value": 156699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632901, "uuid": "9775381a-e76e-450b-806b-b13165db7313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632901, "uuid": "5d1ecba0-93c1-44fc-853f-8d1fee9e0c4d", "value": "TKS6670.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388edfbe-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644518, "uuid": "2bff3e15-bbb2-46fb-89e6-c6ea27bd1217", "comment": "Malware payload (Dridex)", "value": "13953716167e647ef3268e9fb15f1f30", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644518, "uuid": "49c05669-7011-49eb-a630-6c0a6232b70b", "comment": "Malware payload (Dridex)", "value": "6323b5fc71c3c8315b91ae97d15842810f0b212f76b4c580d45d6039a01a4e7e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644518, "uuid": "f06e723b-a92d-4292-9d5b-e5c60a9b4ed0", "comment": "Malware payload (Dridex)", "value": "20d377c673f2004acb10cdf5ccfe8340e13bceca", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644518, "uuid": "16f6e54e-16e3-4a99-a4cd-f72de3b7c0d4", "comment": "Malware payload (Dridex)", "value": "0977cd6a58f64167d19d6c60fcf57ad094345c5397481b7682eede9f5ac791a693098d9d694e662402019a720a4989d1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644518, "uuid": "e968a9f0-d36c-4768-a076-bb1a090e1efc", "value": "BB14AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644518, "uuid": "c6de1c29-fa1d-499a-af52-092c00e9c850", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644518, "uuid": "50aa5b7a-8098-4188-acca-acd055e19cfd", "value": "3072:TBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:TBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644518, "uuid": "0d600630-0b89-4d8a-9adb-3765195c8f7b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644518, "uuid": "ba679802-3690-4e38-abd7-f60b0420e084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644518, "uuid": "1f16b677-78c9-4338-9fe6-c7d583792d04", "value": "6323b5fc71c3c8315b91ae97d15842810f0b212f76b4c580d45d6039a01a4e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aee0ee7-9628-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617638563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638563, "uuid": "ae1a4009-880b-4574-9f29-4e2148b98a46", "comment": "Malware payload (Dridex)", "value": "5c903320210ab71498a3f8fcd51dface", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638563, "uuid": "b1439efa-38e3-4343-993a-98456ee508c5", "comment": "Malware payload (Dridex)", "value": "636d765ef4c41abb326e06e04bf3d812d92f99207ce7a3abebcc87a314f4e9ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638563, "uuid": "95218bdf-febf-4745-ab8c-6711e9e6dd65", "comment": "Malware payload (Dridex)", "value": "f01b71442be101ebc7d8df1e74f034a1965ee57f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638563, "uuid": "ee6fb28d-1c30-4690-9646-a63624f4e363", "comment": "Malware payload (Dridex)", "value": "abc65424dc0c03ed432cad0e386e97333c644e145b41a8f78f0e54587d7fdf88b7fca921e819c4cacf6c4d818d50d070", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617638563, "uuid": "2aa93170-a739-4083-b066-bd05fa6c6c45", "value": "8473E19DA57E724CF73340BCE5182A9BA34D30F15E00A50DED72310F57A6ECA3A5A396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617638563, "uuid": "be359052-3c58-4bfd-ba43-67c4afb2d843", "value": "1536:MYwxIP2YdDB3AeWOiX0mT/WGH+lMVGoIahaDHTU6hryF70w:MYwxIP2YRB3Ri1/W2+2sTU2yF70w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617638563, "uuid": "04162f80-acf3-4bb4-99ee-7bb25ca7522e", "value": 80500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617638563, "uuid": "86e7d728-e9c7-4de8-82a6-d2c078fed719", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617638563, "uuid": "978f3f9f-6061-4f5e-8abd-3e2f9453f51f", "value": "Documents_1218377412_1143987592.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76afe93c-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649776, "uuid": "7c0f627c-04ba-4efb-9f78-0909086774c3", "comment": "Malware payload (Dridex)", "value": "ffb4806117f849722506ffb7ddd088e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649776, "uuid": "0854fee4-5e1e-4c29-b598-29d2fc92ed34", "comment": "Malware payload (Dridex)", "value": "63a79aac8541fbca0554f664296585786234d76f38637718ae9ea8c6e3ba835a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649776, "uuid": "a5a65e9b-0c49-4a96-a216-31fc1dc0d025", "comment": "Malware payload (Dridex)", "value": "e8b3b473327fc36467ac8a8c696476fb489a5054", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649776, "uuid": "7834df3d-5989-4d22-b5cc-ed3d357584b0", "comment": "Malware payload (Dridex)", "value": "8246bc80b0d8b4a21b2ee7e54d25ead796e54730a9b6a318c57e8bcac835dcd6feba2be207aa985e18e41f2c8c1e9f8e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649776, "uuid": "eb7d21d2-995f-4f45-acca-33dbd0d1092b", "value": "E014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649776, "uuid": "3b6f657d-ec2f-4bbf-bd85-9845fec7d29d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649776, "uuid": "d5da8cd7-c864-4f92-8378-dbacb1fa5611", "value": "3072:kBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:kBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649776, "uuid": "fdf25ef6-4138-4549-91a1-9879dc0e5ef1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649776, "uuid": "f08829a8-21ea-4e89-aded-7b7e0b70d91f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649776, "uuid": "287c363d-cd1b-4864-9a53-49620fe27734", "value": "63a79aac8541fbca0554f664296585786234d76f38637718ae9ea8c6e3ba835a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad83eb62-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649868, "uuid": "01b65ebc-f904-4e2f-b02f-53cd641e728b", "comment": "Malware payload (Dridex)", "value": "5fb1fd10cd0db88b56c7ce4db038e4c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649868, "uuid": "42d74c62-7de7-4dec-aab4-3be476389aca", "comment": "Malware payload (Dridex)", "value": "63edd43b136d8fa90d4231b3624f19133d3a0d94d8383b46cbd1b6ca498b4c06", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649868, "uuid": "037f2651-3724-477e-8182-3130321cf960", "comment": "Malware payload (Dridex)", "value": "3868d7e343086f278931d172e0bd16e0ca452ef4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649868, "uuid": "0b985482-b8cc-4450-894d-062536fddf66", "comment": "Malware payload (Dridex)", "value": "f10bdc4476bcb347596f318d31b2c62dbc0d005ffce499c7785564b003dc06075326635122c81798467a224235251d25", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649868, "uuid": "be38df7b-d57a-4045-af93-f1e90dd522fa", "value": "F614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649868, "uuid": "f87d2b5d-8c2b-4ff8-b38a-cf9f8d0fcd2d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649868, "uuid": "3678dea7-2d6d-4d6d-b02c-e3ac98c81585", "value": "3072:JBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:JBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649868, "uuid": "4db1964e-266b-45c6-9669-92aa2d9eff44", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649868, "uuid": "9f00811a-475c-45c1-9892-de76ae4e2760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649868, "uuid": "49447ce7-841c-4bb6-82fc-40205fe2077b", "value": "63edd43b136d8fa90d4231b3624f19133d3a0d94d8383b46cbd1b6ca498b4c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba52bb7-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "0c860a4a-ead4-43e1-a502-6d9e2bce7b56", "comment": "Malware payload (Dridex)", "value": "b4b4b5a501976430f651e9ec4a146026", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "150c4fa3-2acf-4dd4-bbf5-a92e1f550115", "comment": "Malware payload (Dridex)", "value": "63fe7ea296c2eba09cb1f4ffa78b6690d0cc603101038823255373aa715fd625", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "8b4e62bf-39ec-43d2-b218-8d0f51e804d3", "comment": "Malware payload (Dridex)", "value": "304b7fc5cec945f881b287b3208a656ea9212c69", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "731053f3-b245-4cda-8d2b-7839365a0d5c", "comment": "Malware payload (Dridex)", "value": "1491523c324e7988e59854b646d91aaed91bc59409b4a0c40a8cbeed6c4dce09efe6b70a525cbc7acb06362d8a9364f4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "3d210298-ccdf-475a-8fd5-455b5550f57d", "value": "4814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "58b38045-5461-4e6b-8080-7e0c32a5e35d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "cecc0ff0-388d-4bee-b769-44097bc1e523", "value": "3072:sBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:sBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649570, "uuid": "a61799db-808c-46eb-9d57-9c518e31f3d6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649570, "uuid": "a57aed79-95f2-4d30-bbd4-b3b49e49652f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "4e658a3d-31f1-4fe1-9e45-d51b57542ded", "value": "63fe7ea296c2eba09cb1f4ffa78b6690d0cc603101038823255373aa715fd625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d96450-9607-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617624542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617624542, "uuid": "eb054e6a-8e5e-4480-b844-b7de7a8bb7ce", "comment": "Malware payload (Dridex)", "value": "4cd573a8fc23a8a02d86e5e612e4e038", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617624542, "uuid": "610b13ff-2e16-4f52-b2d3-c0de2203fc36", "comment": "Malware payload (Dridex)", "value": "64139d17a767bf380ea1893f860416906ecb5e30a9551118f829ffbf3e8d5ef9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617624542, "uuid": "cd03ab4e-0b73-419f-bd45-9b76b31e5ad2", "comment": "Malware payload (Dridex)", "value": "da90df9b474ad33fb1855bf5863c1fea336317f2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617624542, "uuid": "fea7ed4c-ba18-4dc5-b895-50b75e946bbf", "comment": "Malware payload (Dridex)", "value": "2313eac306f0369a9914694c7e72370a2e797cdc478fc0db528494db974ddf3df44876dc6ca4e38c5a5e01d916fa93dc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617624542, "uuid": "f38beeb7-c9d8-411b-a18a-0b898f453aa0", "value": "3614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617624542, "uuid": "f4d46224-6c54-4d66-ae1c-0174d5c98b0c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617624542, "uuid": "d9ea3a08-6516-4d81-aac4-e1756a4c3d4d", "value": "3072:uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:RpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617624542, "uuid": "5f667197-97a1-4941-8d6b-d9833d85b370", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617624542, "uuid": "83585746-df2a-479b-ad66-76840b81eaaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617624542, "uuid": "db2b36d4-ff99-45b9-b4a7-84a780a28e35", "value": "64139d17a767bf380ea1893f860416906ecb5e30a9551118f829ffbf3e8d5ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e0c07a-95d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617604750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604750, "uuid": "46c27a45-135f-41ef-9ff7-50f44c835a30", "comment": "Malware payload (RaccoonStealer)", "value": "3e551f3813aaffe9550d5b1123782e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604750, "uuid": "94bd3590-be5c-4820-b2e6-1e5cc2b5dafb", "comment": "Malware payload (RaccoonStealer)", "value": "651adbad4b2e863da82c38b9014479348492d0e370fd928a797589873a45cb63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604750, "uuid": "3e8a9913-324a-4862-98c8-0935eda5eb13", "comment": "Malware payload (RaccoonStealer)", "value": "e2efc66daa791602073be5340c8413280cd8d04f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604750, "uuid": "9f806260-f6ff-498f-aeb9-305dbd1a2ad1", "comment": "Malware payload (RaccoonStealer)", "value": "ced49f08f5a5eb3bbe14291aa4c698962cec4f610e96d6b84843d28b308c3104bf192793fb06303e9dc1742628bd8637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604750, "uuid": "311ae5db-7f81-4cfa-8951-225822f50993", "value": "AAC4F00172D1C0B3D09662B54564C7B15B7BB87627B65ACFBBC41AFD2F203E1AA39306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604750, "uuid": "60a5fc40-b164-4cd3-b852-6b106b060af8", "value": "757fe3cc049352cdae367297a43bdc84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604750, "uuid": "6766f597-5066-4eff-85db-1227525f031f", "value": "12288:sYYO+/SXOHOEvEBnMI4uIQR0TNdz4PcE:sdRaX4OTBnMI3IQRwXz4PcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604750, "uuid": "0589e296-53b4-4568-b540-76a4e82cd8ec", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604750, "uuid": "bcece0db-8794-4393-b0d4-372682d8b917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604750, "uuid": "99f98524-a9d9-4556-a3e2-12eb3412d43f", "value": "3e551f3813aaffe9550d5b1123782e1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93f3093-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617650291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650291, "uuid": "a21390a4-9f52-4d6e-97e9-1d8df9e4a194", "comment": "Malware payload (Gozi)", "value": "a1e2a0759924852c160b109f73ffd091", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650291, "uuid": "12ec8a9b-9e14-47f8-a650-532962805743", "comment": "Malware payload (Gozi)", "value": "657455d2129ca06ee85cb534186d7d80b648e10f7f9e50f43cc5f56fbc7d154c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650291, "uuid": "b18db27a-2ede-43e0-bd21-3a3c02393a94", "comment": "Malware payload (Gozi)", "value": "7ebf1673c6661cfddfa4891c6e455111ce331333", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650291, "uuid": "161b60e2-2c77-4128-8f8f-ae315c8713d1", "comment": "Malware payload (Gozi)", "value": "6c4a029bab9c393307458f06c25dcd846a2f7049987afaa21ef7fa7947d616666ff0c80efb56fbeacc82731b0d201d8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650291, "uuid": "40055790-ca18-49f9-bf84-995241760a6e", "value": "EAC3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650291, "uuid": "46a0b8bf-3e26-47a6-88b8-11c130c58676", "value": "811de8e945c2087a6e052096546cd842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650291, "uuid": "3248f031-4bd2-4c10-b205-ad96a28b8231", "value": "1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650291, "uuid": "f5619c29-789e-4ccb-a978-797ced428abe", "value": 120716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650291, "uuid": "5324e979-ef28-427f-b4f0-ea0e1b8df760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650291, "uuid": "4dbefdc7-d38a-4413-bdfa-bb850364da43", "value": "a1e2a0759924852c160b109f73ffd091.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba6eda2-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650268, "uuid": "9336d98e-5c9d-46c8-a212-106d196c142d", "comment": "Malware payload (Dridex)", "value": "cd8e78319d51652525256b34b6478386", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650268, "uuid": "199e134a-fe62-4663-8427-97e4961ef08f", "comment": "Malware payload (Dridex)", "value": "666161622dddb780c1dba1064da60db2b2785cbf716c5085e1222cc95fbd39c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650268, "uuid": "171975bb-6239-45a5-b6ce-b7e3ea60471e", "comment": "Malware payload (Dridex)", "value": "b6d4318a460c81967d1a7b06c6931487c1f4a3c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650268, "uuid": "c1ec10d8-5557-4ca0-a4f7-5064f4e29d55", "comment": "Malware payload (Dridex)", "value": "31900ac30df59377cb39189f78679ea8f1e704a33a4d3a8e8c18fd2dd35d7d3d731631ca9eb13597e2cced34d9e2dc07", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650268, "uuid": "9f917d6e-0915-4d9b-992f-b743f50f47a1", "value": "7203F753E39FE1C6CAA768B0A111613A61A04B07624CFB61F71ACFEFD463A0B91758C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650268, "uuid": "109b0f39-2af7-41d6-8097-e46d8850ecc0", "value": "768:lQInhtkKskfqW5ZYatg647NYPrfVDx05egdv:lVnhWdKxP345EDxTUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650268, "uuid": "f0479ca5-4abf-4dc7-a795-befc06da44cf", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650268, "uuid": "6cdbc120-2008-4a1b-b87b-d42d32f1d03a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650268, "uuid": "0f8d130b-96ec-4a4a-9c08-2a4d234bd4df", "value": "cd8e78319d51652525256b34b6478386.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341b6fe5-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647947, "uuid": "4b13ffe7-62a7-4834-a4f8-e095eda919d2", "comment": "Malware payload (Dridex)", "value": "0a8ad93620da6ef49ffae37ccf6e6ace", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647947, "uuid": "5c3cc61d-3cec-4757-b787-28268469bacd", "comment": "Malware payload (Dridex)", "value": "66d690b5150108bfec98f5178549bf1675aafa5f479d017cf22c94f6867238ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647947, "uuid": "61a7958f-3ab0-4401-b6db-7f2dbec7ff93", "comment": "Malware payload (Dridex)", "value": "5232e1930ec825fac9307f6a4a6dcf1e694b4147", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647947, "uuid": "183ff35e-d323-45cb-90f3-e1e543b2952a", "comment": "Malware payload (Dridex)", "value": "98a0729221f68419cd578651eb349450b4fec5d3b90c59312fff94d396b9d7f458a13a8a69a993f595c5a0c061a932ee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647947, "uuid": "e768c712-33da-47df-9f33-878465bdac57", "value": "2314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647947, "uuid": "fc13d3a6-f97e-42cd-834f-8b6381dffc5d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647947, "uuid": "0ef9b6f8-0b99-4b50-8357-f8064254a1fa", "value": "3072:/BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:/BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647947, "uuid": "cdea21d9-16f8-49cc-abae-226dddfb3b2a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647947, "uuid": "80519c20-e180-4204-b460-f3db69545b9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647947, "uuid": "bb3f84ee-50fd-4f64-b6b2-6c6b7e53928a", "value": "66d690b5150108bfec98f5178549bf1675aafa5f479d017cf22c94f6867238ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dc6323-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604267, "uuid": "19c33270-e3c6-46be-a154-9e4c30fd0cda", "comment": "Malware payload (AgentTesla)", "value": "85fe9df1e0f556b7ba1b6a8d7ac8077e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604267, "uuid": "6980872d-8827-4ec0-b0e9-3eef618b34f6", "comment": "Malware payload (AgentTesla)", "value": "6721200d1e880c83cf3c4ee07db918abca886251cd59a10c10b515eaf026bbbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604267, "uuid": "7276cb32-1cb5-451d-ad58-348a794c5958", "comment": "Malware payload (AgentTesla)", "value": "ee24985504fefc24b49e6d82fbf4d4c72616ea89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604267, "uuid": "37df9c63-493a-4e32-aea6-f688fde60012", "comment": "Malware payload (AgentTesla)", "value": "56ce5d9d0fdef23d5f07a11d399944fd13471adf4cf67a070ab99035454090a05c488e57813b753b24f879d44c57d2dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604267, "uuid": "0f57ed4d-9f7d-4f71-af3f-693d92b09664", "value": "D1D2A547D0094F72DDECBA35AB7A5148C2F894979C81E61A8F9AFBD155A26CFD70020C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604267, "uuid": "5c0c934a-2f8d-43c2-9dd0-eab971b548bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604267, "uuid": "4c040b40-c288-4fbc-9eb7-dea2a7688e83", "value": "384:+aelzWAuFCi3ainEQh2PmM3/xikuyZboRtLup4o7ILS:CzWV1VGDBuyZcRtLwIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604267, "uuid": "a5637af3-d351-416b-94ce-8f5b247009d1", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604267, "uuid": "f4623438-4331-473c-b243-945579fb44c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604267, "uuid": "78cacd96-16c6-4ee0-baa3-73d764210fd9", "value": "MTADV_8943003157.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1a94dd-9630-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617642241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642241, "uuid": "0f01dd3f-4f03-4506-b67f-f0073644de1b", "comment": "Malware payload (Dridex)", "value": "96acaf81100728d0d0423955aee109b7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642241, "uuid": "f5307ceb-f97b-4a19-a6b3-f6118ea35ada", "comment": "Malware payload (Dridex)", "value": "67d2068bd503e1fa7efdb0a73f1e147474e5397fdee6041c6d31bcfacdba7b74", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642241, "uuid": "d3be2f1b-719d-4357-a753-3dcf44dbad22", "comment": "Malware payload (Dridex)", "value": "c088c38c433d12e1655d30e9a1836c43b25e1c61", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642241, "uuid": "e8420493-c1a2-4301-b37a-f14965a33617", "comment": "Malware payload (Dridex)", "value": "dadb6e9ea389ebc36a462b652856efa2b2c5a6a503bbcecd015f29c11d681822b7bd6da984900658f0cb63e2fb609db2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617642241, "uuid": "c8edaf45-53c2-4649-8168-974a1f03d335", "value": "8034122AC7E3E444C931C27F566850693E3267F3C0A755CC19A8703D3A3A1A6A6C6CDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617642241, "uuid": "3a51f7f4-c470-451d-8c9f-eccd97d4edb4", "value": "6144:8FTI0/kofyJ6SbpRHI+q3szKHa6LGo06+Rlsj:8//e1L0z6Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617642241, "uuid": "5dc32d4c-0990-483c-9999-61b575d3acb4", "value": 241121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617642241, "uuid": "b67285fd-91aa-4773-9320-a762f33048f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617642241, "uuid": "16332730-fd3a-46a1-b90e-cfbe0a33b488", "value": "Invoice__7477.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0387e95b-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647865, "uuid": "0de1cb15-0653-4920-95aa-977be2dbab9b", "comment": "Malware payload (Dridex)", "value": "651e94b7fbcbc7f68607c7b4e2343233", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647865, "uuid": "57336463-05f1-4147-94ab-d39c43a624b2", "comment": "Malware payload (Dridex)", "value": "693f90c45c7d9f3e8dba52b3aa7945462a43d46038ccd5f2e5f31284c16a3b13", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647865, "uuid": "f8027b93-7e9c-46c2-804d-e34039449155", "comment": "Malware payload (Dridex)", "value": "b5e5bbc00372f24f21fd4e078bc68caa5e947a41", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647865, "uuid": "f72b6dc4-8454-439f-b03c-0f868e1b2482", "comment": "Malware payload (Dridex)", "value": "10ccfcb19c9b0557f503746745eb0411947d667c07aa0779e743046013fe61e944c1b01adaa8c06958ebdc21ea724f26", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647865, "uuid": "872bec19-abfb-476d-bd8d-38122f087d54", "value": "5814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647865, "uuid": "74e5e024-482f-4658-acba-0bdeac7f75b9", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647865, "uuid": "4a786c3d-0232-44ae-a11e-78c393594229", "value": "3072:3BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:3BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647865, "uuid": "8451378a-b81d-4729-bcbd-0c83a83b5cf7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647865, "uuid": "c0aeba60-5c40-4c98-812e-16ac5bacb679", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647865, "uuid": "79155dcd-cd26-4726-adb9-d6429f39ac73", "value": "693f90c45c7d9f3e8dba52b3aa7945462a43d46038ccd5f2e5f31284c16a3b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa137a8-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649863, "uuid": "8e34133f-86d2-471f-821c-8232587b1061", "comment": "Malware payload (Dridex)", "value": "7a7c2ebef5c7a424e0510d5b2ca6c23c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649863, "uuid": "e7312bf3-7c33-4c03-b404-ece7f91eaebd", "comment": "Malware payload (Dridex)", "value": "69a891613315299404c153b7990b36511d32d394e30e123285e0632558246cb7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649863, "uuid": "3e00284d-8032-43f4-a0d1-293ec07769ae", "comment": "Malware payload (Dridex)", "value": "1a58690e3d76506c53f6951e85deb4834d35e4cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649863, "uuid": "9a87f7ed-e389-48bb-82c6-907417f7034c", "comment": "Malware payload (Dridex)", "value": "fdaaccfbf90a188783e02fa70f35fa3d6bd621eb1ed64d1bf4f53dca42b5c30e401de2f2ca792ce5e955a75ba08d5657", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649863, "uuid": "91aa04f7-e0bf-4fdb-882a-cf048204010d", "value": "2914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649863, "uuid": "6c6b251e-5462-47e7-8b44-348007462886", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649863, "uuid": "d7688535-ac4b-4ce6-801f-342e6d09d431", "value": "3072:CBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:CBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649863, "uuid": "5996dd8d-a1a0-4ed5-8f5c-dfe44cd76a05", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649863, "uuid": "8d4f9898-f50a-4392-a3e5-6e2e14bc2b48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649863, "uuid": "e43a1af8-3b2d-432f-8669-b706c1197e25", "value": "69a891613315299404c153b7990b36511d32d394e30e123285e0632558246cb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f063fc2c-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617650410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650410, "uuid": "d433ff46-c369-486b-a7b0-ec8ff3ecdbfa", "comment": "Malware payload (RaccoonStealer)", "value": "b55697a759c13229c737edf27a3cde07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650410, "uuid": "6ccf9f05-ef80-47fa-b516-42c37cac67c4", "comment": "Malware payload (RaccoonStealer)", "value": "6a3449edd66599b768a57c56bca1cd880fd5099d465cc435c0579083c059e943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650410, "uuid": "ad8152c8-a793-48cd-80b7-590abe5c81f8", "comment": "Malware payload (RaccoonStealer)", "value": "9e1dbac281c370747c0392098932515b9bfcf16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650410, "uuid": "1867fcef-431d-41c0-a964-f24434b6d818", "comment": "Malware payload (RaccoonStealer)", "value": "8b242cdf58822e5e9da78607e98b4e181f5a2e4ae5a0bfd52368d839d136b073f733b9d3618bd6a9509967d5fb0c4414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650410, "uuid": "275c5d3a-7deb-4bbc-9aff-ebc0aa9fff44", "value": "EBD4E01133D1C072D0E365B68269C7B09ABBB8754B3599CFB7C42BB91F207D19A3934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650410, "uuid": "dd5e2d2c-4425-41c8-a766-5baaddad849f", "value": "2f6204fbe7d12f9994fbdbc383c525c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650410, "uuid": "d92e90ca-b602-4b41-9039-b3d42db2d0f0", "value": "12288:5pZERTr95P3jPWFpd0KG6kxYdAsRyIMuUm/L/iHmEk:5ziTPPjWFpd5rkxYdAHInt/LqHmEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650410, "uuid": "a041a1d8-499d-4d2f-bdf9-e43d9cc1b2da", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650410, "uuid": "f106095e-88c9-46da-b253-3e0d9f3f6e7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650410, "uuid": "698104e8-09b0-430b-8999-1b09eb69f04a", "value": "b55697a759c13229c737edf27a3cde07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b1819d-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617650278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650278, "uuid": "63795a52-18b5-40cb-881b-58a61bdb55e2", "comment": "Malware payload (AgentTesla)", "value": "a712afb703e6be79cb8b016b22726dca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650278, "uuid": "6cddab8e-8406-4fd6-8123-5fb5b06bcc75", "comment": "Malware payload (AgentTesla)", "value": "6b3f09cef3e04f54e2c438fe71e1c0cb9f3f5527bbb57c3299a7b5e1f756be13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650278, "uuid": "a1ec4d7d-960f-45db-ad17-bd9a4ac33664", "comment": "Malware payload (AgentTesla)", "value": "c3b3774413e9c5347d9eafb9716bfffc0cb3b4cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650278, "uuid": "dc607a42-8a95-4f94-bd18-62a5e2a0a4a9", "comment": "Malware payload (AgentTesla)", "value": "5c8a0ffd11d083ee07d19023788c345cd9424888bfbeff4279d04412f05f618f8d6ef446e8d8eceaea755712929937e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650278, "uuid": "40ebecd3-3524-43d2-8d53-f5b25d0133c0", "value": "99259C62F6FAB6D974A233FE487579F10903BEEA817A36DF4318111CA72418609D07BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650278, "uuid": "03294fd6-1df7-462e-8d6f-667539acda10", "value": "1536:bp9WIoj5x4ChS5hpCBxQxi5M2DVpR230gucxUr0ZPlMxs+B25qQPNoDHYDHIFcAB:lDoj5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650278, "uuid": "7ab88805-2e5b-4662-bde8-34b12ce67090", "value": 1018331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650278, "uuid": "0e544820-713e-4d9f-9273-e868d1f66069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650278, "uuid": "70825b7a-48cb-4b70-b2c0-a2f9a825d7e5", "value": "a712afb703e6be79cb8b016b22726dca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc20ec1-965f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617662135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662135, "uuid": "76b4b9a2-2924-4562-ae0e-3949c3124230", "comment": "Malware payload", "value": "0d8eec8ed67f89dd2e5e5cbde7b5eccc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662135, "uuid": "89f3ec37-0b91-4ba7-9236-ff76b4d068b5", "comment": "Malware payload", "value": "6be8740dc089a252b90d3f9c4b69f05ce8da2352c3500722147178e80d856be5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662135, "uuid": "73e506b0-b91e-4733-a449-37b74a747613", "comment": "Malware payload", "value": "49ed6f1e6281089232eaa0614dccaeb97e836792", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662135, "uuid": "f32f2de2-241a-42d3-bbca-b890ebc1e643", "comment": "Malware payload", "value": "bd9e36089949e2d38d92123cedc26d60d060ef7264a903bd1a7bfe71e9dbf67e7892c7711a6b330d3404f816db6721ab", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662135, "uuid": "4d35e1e8-7748-4f8e-9dd2-072c5f9b1dd2", "value": "0E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662135, "uuid": "9d3a1bfd-d14a-40f6-ad3c-c2aeefdfa3f0", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662135, "uuid": "a2789506-a05a-408f-be0b-3f5796013439", "value": "3072:VBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:VBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617662135, "uuid": "403fd249-be56-4925-bfd8-d2b2b86e45e6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617662135, "uuid": "9ca7b466-8cbb-48b2-ac2a-d188b55e8d10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662135, "uuid": "70753446-2740-4444-a57c-d6410a1ff737", "value": "6be8740dc089a252b90d3f9c4b69f05ce8da2352c3500722147178e80d856be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0f99cc-9647-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651748, "uuid": "4c7eab03-a5c8-40b7-bdb6-697cdb4e4664", "comment": "Malware payload (Dridex)", "value": "eff66567395b19a4f934831f5c225200", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651748, "uuid": "0743677a-db3f-43fb-b71d-1b750258ec45", "comment": "Malware payload (Dridex)", "value": "6c2ef2a873ed767ab4a49bbe58b25adccd378897f03cf7e0dc8e43d6385920ab", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651748, "uuid": "71ca4c9e-1556-478f-8ccb-3b8d0addc58b", "comment": "Malware payload (Dridex)", "value": "f156ab8b25022cdb3f1d63dfc979090cfc537d78", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651748, "uuid": "522b6617-4ad2-44ed-b95c-b9b148f983ce", "comment": "Malware payload (Dridex)", "value": "b3340da38a0ff7aa93cd3d859a61f59dfb3337c6c13f9ab6e5b513208c8da20fd1c48291ac791e363e661e6a3b37a359", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651748, "uuid": "a7fa9600-ba18-4c16-8f20-d150cd3d0d3f", "value": "A114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651748, "uuid": "b01e6a45-2117-4a69-bad4-74635da3126b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651748, "uuid": "d3778387-5b91-40b8-963f-7ecc877aca12", "value": "3072:kBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:kBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651748, "uuid": "474f73b4-eb8f-4ab9-889d-b1726edec9c8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651748, "uuid": "f38e13e7-6070-4ec2-831f-685720914eb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651748, "uuid": "b83633c4-49b1-44d1-8167-a53b213bdd2e", "value": "6c2ef2a873ed767ab4a49bbe58b25adccd378897f03cf7e0dc8e43d6385920ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a1f052-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650075, "uuid": "b8a09f01-15b8-4d12-b633-e1e8778967fe", "comment": "Malware payload (Dridex)", "value": "2431e8519e0d90197f60f0f811ce3c77", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650075, "uuid": "6d84c05d-df80-4bfe-bb2e-faa46dcfdaa0", "comment": "Malware payload (Dridex)", "value": "6c589e10f1c27bbf296c776bbe40ea8c687c093d2959210373c076adc490ed8b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650075, "uuid": "8e2a7ab8-b6fa-462c-9a0b-1f23b3feb950", "comment": "Malware payload (Dridex)", "value": "807754b02e73954a593666d682783b4a5a333a0a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650075, "uuid": "bafdb784-c432-4cd5-9025-4f29d5cf93ba", "comment": "Malware payload (Dridex)", "value": "ade91f0ef6b6dc2db2e7daaa603eb653cf01628ce798062e3cd28abe6c394d763c9149ed69f52909825b0639dbe23c38", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650075, "uuid": "70cddecf-07cd-4712-a7df-fbba73ebdff1", "value": "8914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650075, "uuid": "b1e4f3eb-cce6-4ed5-9735-057569d5de5f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650075, "uuid": "28fb2711-9eeb-45b8-bb6f-3a2e3311d49d", "value": "3072:qBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:qBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650075, "uuid": "03d69850-6e16-4c99-bb95-1de4d2445c3a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650075, "uuid": "b17ae763-5b5e-47df-bffc-b4ef4a3062bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650075, "uuid": "eed0d048-b26f-4652-a166-0c4f9cf2e46d", "value": "6c589e10f1c27bbf296c776bbe40ea8c687c093d2959210373c076adc490ed8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579d8787-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647577, "uuid": "4e355111-25cf-421f-bcce-4a3093d13236", "comment": "Malware payload (Dridex)", "value": "db8d3f60289f8684da97f2e504a1f9be", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647577, "uuid": "943aab1d-86a2-4d2c-b89c-1bf2f10895dc", "comment": "Malware payload (Dridex)", "value": "6cd1b26ffd02af7e9573fca2a27451199e0e1e5b25811f6119f7d4923db53ef2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647577, "uuid": "802853f6-eee2-42d8-b676-a2d21aa74f51", "comment": "Malware payload (Dridex)", "value": "3075a3374ce65dfdf3add3014dd9498528d61d6c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647577, "uuid": "e0d597ce-5a26-4b43-8190-4ec42c5b384e", "comment": "Malware payload (Dridex)", "value": "08f99e3357887b7d7632384ac74fbf55d7ac57618b3836a6d4f611beb5c8495126a482c791ece7f4cf578acb8f582e38", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647577, "uuid": "55e09400-dadd-4b73-a4fb-69ad26e171fe", "value": "7714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647577, "uuid": "e8636175-7f28-4609-a2a7-518bea4f6e70", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647577, "uuid": "68aa9bd2-770f-4df0-b8cd-96b36cba404c", "value": "3072:BBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:BBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647577, "uuid": "3916327f-520a-4e87-a6e0-428ced547180", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647577, "uuid": "69980a24-5836-47f4-b9a1-fdc15deaf590", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647577, "uuid": "ea2269d2-f1d6-4aad-81c7-90e0fc37bde2", "value": "6cd1b26ffd02af7e9573fca2a27451199e0e1e5b25811f6119f7d4923db53ef2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a4c77a-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614853, "uuid": "35996fb9-db5b-428b-b24e-96d6d7843087", "comment": "Malware payload", "value": "ff17d3662db145fe1aca70a3700aeda2", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614853, "uuid": "e25f44b0-c977-4884-889a-453754581ab3", "comment": "Malware payload", "value": "6dcbb7cce5ccc5cef33d439c9ec4c11186292d8ffa8c48e4614c7b43a2ff07e4", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614853, "uuid": "2bca7a00-8ab4-478c-8bb9-1e6e7c684037", "comment": "Malware payload", "value": "56fb5144137a945d9353f73684dc0d67f124132d", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614853, "uuid": "ef46082a-8d5a-4a9a-bfb1-0f0cff61835b", "comment": "Malware payload", "value": "90a685fb08c70d4f9db5cd980b249bf14e71e3002dc2e73a263299663e8ddb4b7701f0078be4bb7b74ef9566ff4f20f7", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614853, "uuid": "a8496db7-7156-4b05-97a0-0d041cbf4cda", "value": "4B863381F0A28CB7F8FA15322AB6D13A3AB6F5130B4545EF635C46937961381A77C72C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614853, "uuid": "751b80c3-7998-4087-96f4-fd57a371d80c", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614853, "uuid": "ad27b1a7-15fc-402c-9843-3d0dd27985db", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazTf5XrIQQtIkR:kfauN/HYOSIT/EVF9XNTQt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614853, "uuid": "10e2826f-89ec-4984-9ffc-34d82eb0b46d", "value": 8230476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614853, "uuid": "ab7baf12-dc9f-4945-84f1-044573011bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614853, "uuid": "6b0b2975-0ed0-462a-b5fc-f6495201817e", "value": "6dcbb7cce5ccc5cef33d439c9ec4c11186292d8ffa8c48e4614c7b43a2ff07e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0eeffa-964e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617655043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655043, "uuid": "cf24b6ad-b52c-45b4-b844-5560b82412d1", "comment": "Malware payload (Dridex)", "value": "5d582b6ee1aa053334556dc3395841a1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655043, "uuid": "9ebaa065-bb30-4c11-9d23-005ee387e0d6", "comment": "Malware payload (Dridex)", "value": "6ed7f0749086228082ae6ae7135e1a205c5d0f187820424acc4cff479714f6fe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655043, "uuid": "4c5a0d69-0edc-4c48-bfa1-c85f3d7386d7", "comment": "Malware payload (Dridex)", "value": "5d437fe2a990fbd84cc88b599ec3a1662c212bdf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655043, "uuid": "af5fc237-920f-43c8-83c7-420106d56a0d", "comment": "Malware payload (Dridex)", "value": "724c2db4111ac3b89cd3adb13898d9a57f311e068298fb215705c23d8e4873c8d5e80c6c2e03d82e5d97e840ba0ac152", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655043, "uuid": "06e97fe6-027a-4e57-9f30-f72f98525136", "value": "C614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655043, "uuid": "edb780ab-2543-4fc1-b63a-f5a1e98f7561", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655043, "uuid": "01622f50-a437-4fb2-9299-fc2fba4cca5d", "value": "3072:BBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:BBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617655043, "uuid": "e79edea8-f227-481b-87e6-e28864192c38", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617655043, "uuid": "d1b71995-5c6a-450b-9f8b-9acb29444c17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655043, "uuid": "defdc354-4330-48a8-958c-f7a68f1c6813", "value": "6ed7f0749086228082ae6ae7135e1a205c5d0f187820424acc4cff479714f6fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56407e9a-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617627388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627388, "uuid": "71ee3779-3508-4c81-897a-282326bf94aa", "comment": "Malware payload (RemcosRAT)", "value": "22aa113bd87bc6428b7b05955bb4f6aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627388, "uuid": "f40c5835-858b-4aad-ad5c-77a4ce25684f", "comment": "Malware payload (RemcosRAT)", "value": "6f3f6c0f427dd7a5584141e0bc5a1ce8eed39721b3621a86c11bdf571472a610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627388, "uuid": "b395b2ea-d64b-4882-8aa4-dd0cd86d1c41", "comment": "Malware payload (RemcosRAT)", "value": "0eb99a4d2efd18baa42d714e4048288ada872379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627388, "uuid": "0d4a5a95-816c-47a0-99f3-3d12eff3b8d2", "comment": "Malware payload (RemcosRAT)", "value": "a4ef7cca29f1732723232ef9859fc1225af045360eef92dc58b90c113c4db54a7f6d7ad62c88fd504f9e3a572d336344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627388, "uuid": "1e31c553-4c0a-44f9-96f3-91b295d808e2", "value": "29F49E1371C0C47BC91E25BA5E07B294A565FC694ED8A4593FE93F191FB82823C3628F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627388, "uuid": "e62b3b3f-3f0f-4cfa-92e6-cebbee4d5609", "value": "b4e23e70c7b7b0ca71e039cd4bcce49c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627388, "uuid": "f1582e4b-054a-41cc-9ba5-ae043db28247", "value": "12288:wpEkAPyDafJz/0jbepCiCXCGUwkPbBE5vm+ZUR3U/OyVGjjjjjjjjjjjjjjjjjjd:wp9APpzoefCSsl5vmCUR3UDV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627388, "uuid": "ea5758f0-1aa2-44f6-9159-bda510e9ac41", "value": 759810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627388, "uuid": "d0ec2ec0-3916-402c-9e9b-8bdd0af65bc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627388, "uuid": "0738ec4e-76d3-4b0b-b953-9069c3ef4d73", "value": "22aa113bd87bc6428b7b05955bb4f6aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aaca39-9667-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617665525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665525, "uuid": "7db79757-6c74-48a1-aea9-eef0c89212c3", "comment": "Malware payload", "value": "b273f7da52aefdbc077095ff29c8d2ec", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665525, "uuid": "61bee348-a31f-417f-a525-535ea648abf6", "comment": "Malware payload", "value": "70420488a16a79a5c0e9a5e958b3e3df29ae7cc3c128c0edb42c372435092ebf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665525, "uuid": "15243ea4-cdce-4f0d-85f2-fa5c70590c11", "comment": "Malware payload", "value": "9000d6fbfdbf6a45cf2e3d76d60430ba8ddd3c6f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665525, "uuid": "755413d8-a1ab-412f-833c-852c61d74d24", "comment": "Malware payload", "value": "b57d33ab754f2ed0a56b6e3b82fea48d47059f392cb5f9049452ff5054bb792918efd343bc8f2b9f6cbb9413cdf4a38d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665525, "uuid": "cc5db6a1-67c2-4ac4-8f47-8919437b8601", "value": "11149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D154616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665525, "uuid": "0615bf41-0cdb-41a2-9140-0b64314f2766", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665525, "uuid": "70a774a8-b45b-4d8e-b534-437a12e901dd", "value": "3072:G6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:GZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617665525, "uuid": "518fa419-2b6f-4793-a5a3-4015b15b310a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617665525, "uuid": "d9ed3175-de84-4f12-8a10-01db31a8c456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665525, "uuid": "86911102-d7da-434a-b934-62bfa89c3446", "value": "70420488a16a79a5c0e9a5e958b3e3df29ae7cc3c128c0edb42c372435092ebf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba1c201-965f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617662267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662267, "uuid": "8118869f-9cd8-46a9-8dbf-144756a81262", "comment": "Malware payload", "value": "acbd72c24f7e4b056c7c53dd0e15fac0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662267, "uuid": "5226f9a6-885e-4bbc-a50f-a898d28e3709", "comment": "Malware payload", "value": "70baf4baa0b55e7fd94638fefcbd35a7b70cd640c18ec60b8971f7613e385b36", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662267, "uuid": "0e47d8e1-2239-499e-88ac-62ed25aa37f2", "comment": "Malware payload", "value": "6a59f5b60573a5e97c61117a4003e392475b5b76", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662267, "uuid": "49941cc4-c35c-47b3-92c8-d4126b02cd56", "comment": "Malware payload", "value": "09cd9bfe3462e1d80908eff8e50b6609a39948109417738cd471a330bea8251bbfd6e8100919e63d76d3ab36d2fb0ef0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662267, "uuid": "44fba36d-ed54-4758-a2c3-375bf74fa25d", "value": "A4149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662267, "uuid": "57b8fb8b-1ab4-4483-883d-399d93a82e1e", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662267, "uuid": "30a016cd-6773-459b-95ce-62ede74087f5", "value": "3072:H6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:HZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617662267, "uuid": "f4bdef48-6e2c-4269-87f5-68217c212bc4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617662267, "uuid": "f64beaf2-e39f-451a-8d48-745923a3795c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662267, "uuid": "8af8233e-a789-4b68-bce6-f14dba4637d9", "value": "70baf4baa0b55e7fd94638fefcbd35a7b70cd640c18ec60b8971f7613e385b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2674bd6b-9612-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617629026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629026, "uuid": "3311124e-0ce4-4c5a-b4e2-a43d96a39a99", "comment": "Malware payload (AgentTesla)", "value": "2cf840b132bf497d66c0a69f91f7addd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629026, "uuid": "fecd08d7-9146-4200-8cd9-47ca19410da3", "comment": "Malware payload (AgentTesla)", "value": "7152c6554215cabb53c75d1cd7d988c10351958fb7d190625e6875e3ce57756e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629026, "uuid": "3f90dcc9-93ab-485a-927a-b15ed4616275", "comment": "Malware payload (AgentTesla)", "value": "ff37283df8a6cac55c0e9b8879b86bb5f275730f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617629026, "uuid": "80f87845-251e-4bfb-b0f5-0a654a448772", "comment": "Malware payload (AgentTesla)", "value": "1a2c6c8ab8eee84394f3aceb25b45a744f7637b2f6a292a34ba952fd2fd211ebb4658e019892dcdda42daaa8cfd48f90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617629026, "uuid": "08784f90-6b29-4be8-8389-fe6e0c6fbea6", "value": "71C2D829E680C20DCF4EFF3A45E935091BB0FB9BDC81664B13CD68C56523BBD51DA922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617629026, "uuid": "907b8d47-d40e-43a4-a605-381fcf5ad46a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617629026, "uuid": "6ffed22d-2bf6-4689-a245-85647e2e91d6", "value": "384:ysWp+7Hk+a3aHoNTrws37cTiGPC3/lzT80EQ2LY5HcevHE38:8+oaHF4cTi5vdr2LY5Hc0HEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617629026, "uuid": "2c7b0d1e-9e8a-472b-ad5a-e3b6e6de05ff", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617629026, "uuid": "792fabf9-0653-4bad-8aee-d916f8f0b72d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617629026, "uuid": "c3c8a43a-dc18-4b98-8c52-04889cfa82c7", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ddd4f4-9664-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617664484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664484, "uuid": "913bb3d6-48a8-42f7-80bf-500c4089c25f", "comment": "Malware payload", "value": "22d51cc53788260692a3066a1a473513", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664484, "uuid": "dbd6f6a5-ec23-49a2-b931-b767cb61798c", "comment": "Malware payload", "value": "71d92984c8cafae3eeec30ad3ef7946afa0747826fae30fedbe7bdefdcc43751", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664484, "uuid": "a687584f-8c4a-4847-af54-2cbfcc218fd3", "comment": "Malware payload", "value": "8b6ee91366a7d7cd175492524328638c41b6b2f5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664484, "uuid": "840b725a-6c62-40e4-a5b8-5340a10c8268", "comment": "Malware payload", "value": "70cceb114c4ad8680497d34f75386a7b7a7a42d797c894fd6122015be76b447e444cf93292dd94d1a7f17c423f53965e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664484, "uuid": "b974be0a-1a23-49d0-85dc-5b7a079ddbcd", "value": "6814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664484, "uuid": "32ae16b4-63eb-4ace-a265-77748ebbc4de", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664484, "uuid": "3f1304b4-08e7-4869-a330-d080e102e553", "value": "3072:2BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:2BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617664484, "uuid": "6d0b354a-36fd-46df-93fe-5a45211928fb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617664484, "uuid": "4a7ac589-9acc-4a47-91d9-b3457719fe8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664484, "uuid": "fed2c8e1-6186-46e1-af95-8f2dc7d752e0", "value": "71d92984c8cafae3eeec30ad3ef7946afa0747826fae30fedbe7bdefdcc43751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f7de26-964d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617654629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654629, "uuid": "3ab0de44-a2ab-42f9-9aa8-f3b5433c2fd0", "comment": "Malware payload", "value": "f126c14aa3de11c1286fa3bcb76554ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654629, "uuid": "e55f2f0c-3d1e-42c6-8687-4d1b63474bbf", "comment": "Malware payload", "value": "72a446a2759f169735d604ddfb82a30045d86a44987b3636fa2c97f56a06aceb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654629, "uuid": "71cbae0a-968f-4bed-8f2f-e194ccca11b4", "comment": "Malware payload", "value": "4c2fe08b68a1ea68c32c04da1c9248e27fb28a08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654629, "uuid": "fc077ec4-385f-4723-b609-c6fdbdef2361", "comment": "Malware payload", "value": "4a688caa2203852222796983528b6190926d04746fd4cea0b89c82a278e4194873a4781661d938f6481aecf84c13bda8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654629, "uuid": "834d5630-9347-4636-8da5-2042264c8255", "value": "7B94AE02A307A025E7A7503E316176FEE5142D3C2923D85AE6A73E546E343E1A9F4F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654629, "uuid": "3ad8d53e-f84a-4e4d-96fd-dcc2122d4944", "value": "0ce62e37d848dfd77add7c8cd736fe14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654629, "uuid": "eafae9cb-16e3-46a1-9d62-c7aa2c28cc44", "value": "12288:xtRzoCbKvLVRe7wbCr6tvMllzWgky6RjWwlX:xnkcKTVRiWCeGXzWgk9jrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654629, "uuid": "88a41b53-96a5-4057-b221-a64398ee0802", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654629, "uuid": "02187b89-b559-4735-9fb0-2a74f8ea7a88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654629, "uuid": "621c4440-a677-4036-87b6-9ec36735a8d2", "value": "SecuriteInfo.com.W32.AIDetect.malware1.1563.32319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dcdb04-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646497, "uuid": "0f6a7b5f-8d8f-45fd-b889-332c66bd893a", "comment": "Malware payload (Dridex)", "value": "b8bc293bbf0ce20537f3a62580a8fc8f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646497, "uuid": "c084f018-4882-4e5b-b825-aba84cbe477d", "comment": "Malware payload (Dridex)", "value": "75077b236ed1ab9fa65046e70d77bacbd66d96e9a0ee6ba31fbdfbf2e026a005", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646497, "uuid": "56aac6fe-9846-4bf7-a123-33d6be9a854f", "comment": "Malware payload (Dridex)", "value": "975a6d879b2dcd2240b9fc21c4932afcaa431637", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646497, "uuid": "c7152712-1cf9-4f24-bede-9c843610ca0a", "comment": "Malware payload (Dridex)", "value": "b6f22fbd7c3ceb6b4adb7b8d7824e16998e3acfeb32202e06ce452896cd7e9c82afe587a0d0ef9b61d81f6c3ddafe9d9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646497, "uuid": "f0e3127d-4d1e-45c9-bdea-54dbf4508d90", "value": "DD149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646497, "uuid": "8e0242d1-de0d-4ac8-a2e3-881b016a719e", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646497, "uuid": "582db5d5-967d-40e8-a22d-f1268ab66cc7", "value": "3072:h6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:hZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646497, "uuid": "a661273a-7500-4e70-9ecf-f546f23cc012", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646497, "uuid": "5534daa6-dae1-4e81-86f5-a9a6553e3476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646497, "uuid": "2bcc4aa3-e1de-470d-b11d-7fa0671805aa", "value": "75077b236ed1ab9fa65046e70d77bacbd66d96e9a0ee6ba31fbdfbf2e026a005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d290316-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644472, "uuid": "534f455c-2bf8-4d04-9622-7318612db8c1", "comment": "Malware payload (Dridex)", "value": "e0ea4a0eb51978ab44aa19e324214d2a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644472, "uuid": "f9c51eee-72a3-449a-a39f-4b32940bcf04", "comment": "Malware payload (Dridex)", "value": "75f189829d27606af5f98e7facdbf9f837d0d221870a6d3a58406caa36d9c30a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644472, "uuid": "551d23eb-2a63-4354-8e06-678c214ab06c", "comment": "Malware payload (Dridex)", "value": "de6188dfddaaabe610ec84358863fc99dbdd892f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644472, "uuid": "c3c78274-a5d1-426f-986c-5deb1d94ed40", "comment": "Malware payload (Dridex)", "value": "fe6e0674370f6ffe517492ad755ab8ee610f6160c388d939918ff086a128cd60727ed7db97c47ffd9fde80394300bab1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644472, "uuid": "416e4772-ab0f-44c1-811e-8b28a148407e", "value": "8E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644472, "uuid": "e08b362a-8abc-4cb2-9763-36a4fcc054b3", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644472, "uuid": "20f81767-7378-472a-a4ba-9f6f13e2f24a", "value": "3072:TBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:TBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644472, "uuid": "5d4855f1-ad19-49be-96a3-aa7d68c1d5f6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644472, "uuid": "b3ed2efb-00c5-48cf-9f17-7f4810e0df9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644472, "uuid": "4ebca729-8063-4d48-a4d4-257c2dea4180", "value": "75f189829d27606af5f98e7facdbf9f837d0d221870a6d3a58406caa36d9c30a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab83da5-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647716, "uuid": "f476e132-33a7-443e-b240-6ebd9c4dbf06", "comment": "Malware payload (Dridex)", "value": "600010846b5c50d79d89587b981d1a2d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647716, "uuid": "3b7ebc38-1346-4254-8a85-1cf831bef174", "comment": "Malware payload (Dridex)", "value": "7608e2914a26196baf58eb975dbfbe8b3de517db3bae5eb173ef4d5fd2431710", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647716, "uuid": "3f0054ea-f65f-468b-90e5-eddf6fa25264", "comment": "Malware payload (Dridex)", "value": "fbb2122853cda0f3fece3374f047e11f65ea4b70", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647716, "uuid": "ea6b1b80-8678-4627-9f68-b7c460026db3", "comment": "Malware payload (Dridex)", "value": "8e5b2a843f7073b23ea3071d4d58e4a9055490a3135f4c483d93ef45a84003cb56589f14114e393acb03bdc6622cddf7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647716, "uuid": "51f0680e-64ac-4860-91ee-536d355c1286", "value": "B514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647716, "uuid": "1bcf7f7b-e813-4745-a3fc-2d3252933096", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647716, "uuid": "258e1cc8-b9a1-4258-8bce-59370e4365b0", "value": "3072:oBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:oBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647716, "uuid": "eed9d002-dd5d-4659-bfa9-6392005cfb55", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647716, "uuid": "f41de7de-9f4c-4db0-b76a-fd82d36f27e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647716, "uuid": "fe1eab7b-cc21-487d-bbb6-fe03c2d6d994", "value": "7608e2914a26196baf58eb975dbfbe8b3de517db3bae5eb173ef4d5fd2431710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da57beeb-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647796, "uuid": "a5fa53cb-8a18-4062-9348-4b2b5291fa4f", "comment": "Malware payload (Dridex)", "value": "b2ba6ad3b04a40de236caffcb8c98c02", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647796, "uuid": "cbda6d39-be47-4692-a3a5-f54296a9d574", "comment": "Malware payload (Dridex)", "value": "77fe03b792833d1c204719618ed9d6d451ee7654eb4c927c0b3732f9bdc2145e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647796, "uuid": "8a87d98b-9b96-45fc-880b-4f7e21a7348c", "comment": "Malware payload (Dridex)", "value": "64405bf491123372fbbbed85a6a496374f197132", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647796, "uuid": "9ba0b13a-6e74-4392-a304-719c48109660", "comment": "Malware payload (Dridex)", "value": "d17ab9b53510ae05bdf7904271ec3b7c348f4c316c660d7cb7c35b9ca9d56040f3cfb2e04d74826bd4548e38092fb2dc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647796, "uuid": "376040c0-bd7f-40bb-a02c-9e1a0263d575", "value": "F514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647796, "uuid": "e18f688e-5456-4ae6-8e6a-0fd847539b3a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647796, "uuid": "3f321798-c18b-44cb-b14e-1c8d1658c905", "value": "3072:XBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:XBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647796, "uuid": "53638072-db16-420b-ad4c-d550b2664566", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647796, "uuid": "aff56eea-9a70-48db-aece-d5435334008b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647796, "uuid": "bb5dc35d-87d6-4ff6-b48a-38496619b660", "value": "77fe03b792833d1c204719618ed9d6d451ee7654eb4c927c0b3732f9bdc2145e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ceabc9-95b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617587598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617587598, "uuid": "fbfb11aa-5e33-453e-9d09-2126a687008d", "comment": "Malware payload (Dridex)", "value": "175f362652823314442df5d2e0bb4572", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617587598, "uuid": "e1e99265-8f82-4d0b-b6c1-8ab568d45290", "comment": "Malware payload (Dridex)", "value": "789e7756bbd12dd1b820bbe4c0fdbee43f08438fdeb7b7b5074ed2040f876165", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617587598, "uuid": "922f2d2f-eb5a-48db-a06f-b310a156e7f5", "comment": "Malware payload (Dridex)", "value": "13bd4e8cde8fa80814abdae4cf85114c04619a9f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617587598, "uuid": "828b64bd-8979-441e-a3ab-8c8d414eaabf", "comment": "Malware payload (Dridex)", "value": "c71a360c5d334ceaf5e6d5c36f9e99d5635305265501f7d0a7118bb860d19afd921a376765f9e38fb54ab78b81cc5923", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617587598, "uuid": "24216fb1-ed17-43eb-9730-4fda465e5c73", "value": "5614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617587598, "uuid": "c161f2c4-3c61-42e0-9358-f78507fc017c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617587598, "uuid": "86c09157-49e6-4c1f-bbd5-cd2573132903", "value": "3072:Aopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:npjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617587598, "uuid": "8b28f22f-6421-4851-94fa-fee61b28dc6c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617587598, "uuid": "e0287a76-be80-4416-896f-b58cdde7384b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617587598, "uuid": "f03d323b-110f-4a6d-8053-64fcda1b9531", "value": "789e7756bbd12dd1b820bbe4c0fdbee43f08438fdeb7b7b5074ed2040f876165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09d0948-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "37b8e1c4-17d2-4142-9d16-f5f21e732c15", "comment": "Malware payload (Dridex)", "value": "20b46f6dd64fe67d9ffb9b799c15a51b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "2efe84c6-297a-4e14-b4ef-7edcc6762198", "comment": "Malware payload (Dridex)", "value": "795dd9f541462c06ac3da738ab0c6dbdf524e0c0a013e7728927a346d85eaed2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "cb5b5a92-ad20-483d-ba22-0d296548e93a", "comment": "Malware payload (Dridex)", "value": "385a6c356a65b2d0f3dd709e2c468f919b3a5bcf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "a3a0a035-4513-4772-9bf8-38a0f833c05c", "comment": "Malware payload (Dridex)", "value": "c2fe6508b4120466063b719d85deb8457d2fccf456a167b30fafd5ee80c40a1d1b9ec18d123602d7cd524bb79dbf191a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "da00dda5-d936-443d-8f00-bd3f6ad175e6", "value": "0614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "d97c1673-f89c-4cbf-8683-8b06792caf4f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "bef6195a-994f-4f68-83dc-71d165a470ee", "value": "3072:oBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:oBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647833, "uuid": "f825c5b7-6c26-47c0-82e0-6e37485788e6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647833, "uuid": "1d6fa6d6-0784-407c-b060-d9e78ffa7e3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "b99fba34-24c7-4e57-a095-c0240063ece8", "value": "795dd9f541462c06ac3da738ab0c6dbdf524e0c0a013e7728927a346d85eaed2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9adde8-966a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617667152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667152, "uuid": "059c3440-244c-4b6b-9f7d-0a8281680197", "comment": "Malware payload", "value": "a152ce295846f1eed9dade433549b7aa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667152, "uuid": "2823ff36-da0a-441f-96cf-4392ca3b8968", "comment": "Malware payload", "value": "797c8c82e625b9c58515b1342d81902fb65f0744e4bc61c6aaf58af88608b902", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667152, "uuid": "39e000a7-8952-4384-b589-264c16023d7d", "comment": "Malware payload", "value": "4261ef66168a83ed896ee16f8b450be75e07b3dc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667152, "uuid": "58f5380d-1586-462c-84ad-cffa6205a8af", "comment": "Malware payload", "value": "1a2711458a59ba63fbe738615b9c57b21e2ffa034d55b5e30cc62bc02d5c83774a029c07010392f5bb09d0f63514091d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667152, "uuid": "389d386d-e852-49f5-84a0-0c19e47fcca6", "value": "1214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667152, "uuid": "63017a29-45b1-4596-96a1-2894d4b69447", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667152, "uuid": "f7adb191-7542-4929-9f74-b29238b038dc", "value": "3072:ABHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ABHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617667152, "uuid": "f619a9ef-831a-4099-acfd-a0f6634c8187", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617667152, "uuid": "c37290d7-39de-4c4b-8a2c-079e5db54668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667152, "uuid": "bc3f158f-db67-4b25-8640-f223466d880e", "value": "797c8c82e625b9c58515b1342d81902fb65f0744e4bc61c6aaf58af88608b902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e953b0c-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649763, "uuid": "e630abd7-75dd-4aca-afc4-e11adddddc86", "comment": "Malware payload (Dridex)", "value": "c6adb7e1bdf515123720bdfef8af5b61", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649763, "uuid": "0b4c759a-ea2b-468b-b994-fb56f190a1f5", "comment": "Malware payload (Dridex)", "value": "7bbd1cec48902576f3c52482457ae0181146f8abb12f5643e2e88c36cef67b57", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649763, "uuid": "41a4f503-922d-4678-be26-180f0e584ae2", "comment": "Malware payload (Dridex)", "value": "799aeaf7d55ead2799f8873e1ae77cdbabfc4a8b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649763, "uuid": "41a17d0b-d717-4531-8852-c7567a0435fc", "comment": "Malware payload (Dridex)", "value": "45baf9b04050d74c66fc426f83b96a5374ecdae4565d01815f9e67bd96ba0b7833d13ab990f404f84f9ed619fee82ca3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649763, "uuid": "8b71db0d-6f13-4b98-a14a-be3871294ea9", "value": "B714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649763, "uuid": "16375481-47d2-4b4d-9c71-122a22231c7e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649763, "uuid": "46af3944-4216-4013-b3f3-10b171f41048", "value": "3072:9BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:9BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649763, "uuid": "210fbcbc-f6e5-48cf-abc2-220edd80c560", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649763, "uuid": "2e1a3b88-dc50-4142-b1b8-88b8127a3b68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649763, "uuid": "f641677d-943b-46cd-b03a-6d72168f515d", "value": "7bbd1cec48902576f3c52482457ae0181146f8abb12f5643e2e88c36cef67b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d87dc3b-964e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617654754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654754, "uuid": "79ec6756-b2b6-4f14-b0ac-26fd385400b0", "comment": "Malware payload (Dridex)", "value": "5433ba82097379b0f9b8e75bb0d5ca9e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654754, "uuid": "8e2a9280-109b-4dcc-8260-fb3970e2fb3e", "comment": "Malware payload (Dridex)", "value": "7c4b6cda0b77eaa1020159371e56b1d52e5afacaa36ec1a369798901bf801f05", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654754, "uuid": "16da16eb-7172-419b-95e1-464986411608", "comment": "Malware payload (Dridex)", "value": "7d6799b1edb46967d77ffd6c8110955809cf588c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654754, "uuid": "daa7510d-9191-403a-885a-445e0fd778e6", "comment": "Malware payload (Dridex)", "value": "abf08ffc22d97c50b40fca31283e9b0b426c647638d2b6ebaad1a52accb97a2e2a2fbc6263ce973a6566bec92eadb66a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654754, "uuid": "06bf7441-8399-4510-b034-be30dc6319d9", "value": "3214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654754, "uuid": "1c45954d-5679-4114-910f-821e11f51d8d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654754, "uuid": "4967f791-5941-439e-ab3e-d0eb2baa1414", "value": "3072:+BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:+BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654754, "uuid": "1f1fdb43-d594-43ab-be2f-2fd7485451a1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654754, "uuid": "d67433c5-ff51-4afc-a3e1-a64efc1f9acf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654754, "uuid": "212fe921-53b2-42c1-afa5-a451271792a3", "value": "7c4b6cda0b77eaa1020159371e56b1d52e5afacaa36ec1a369798901bf801f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2aaeb8-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614865, "uuid": "c6ba0212-24b3-4d00-aff8-162cf15c0921", "comment": "Malware payload", "value": "324b709172e6c707724fe4f48bb9ad92", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614865, "uuid": "5747eb43-840e-46ec-a14d-ed44c6ce3f81", "comment": "Malware payload", "value": "7c7f98e132780d0ed823821a26697c8d2088fb8dd9bb04bfd7eede2be61c2edc", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614865, "uuid": "956d037c-8b53-4e49-a622-86d884f9cf09", "comment": "Malware payload", "value": "0f9cda372d9f1e58d4156f8df5dba556e156589c", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614865, "uuid": "8b0c299f-c382-4d46-b0db-142d25812432", "comment": "Malware payload", "value": "eadeaf5fccd5b6dd6846bf242bcabdc93264e563f6f27f66d4bc919e8a84cc4a0125597c35f77f4ef5980ffdd656258e", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614865, "uuid": "22a7c342-726f-4983-81fe-5068393560ca", "value": "10663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614865, "uuid": "a0d74cc6-0b7d-4592-a7fb-8febfaf6e9c5", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614865, "uuid": "71a7a541-f93d-420d-8eb5-8d6dcea8cf61", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazI:kfauN/HYOSIT/EVF90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614865, "uuid": "49a5b4a1-a1f0-4ca3-8b73-c4f73d893b0e", "value": 6967107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614865, "uuid": "26d68804-f20e-44ff-9591-ad40a1740e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614865, "uuid": "363b6040-9282-4a2d-9df0-32aa0d67f9f7", "value": "7c7f98e132780d0ed823821a26697c8d2088fb8dd9bb04bfd7eede2be61c2edc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f34224-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617604217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604217, "uuid": "847f02b7-1f10-4a51-b012-f1addc2b42a5", "comment": "Malware payload (NanoCore)", "value": "dd9452afb70e27fd151b363f70d3c7de", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604217, "uuid": "b9a4dab2-a537-4d09-be60-0cc7f1b053eb", "comment": "Malware payload (NanoCore)", "value": "7d043fd8d98f22a7f0e50476e92035feebb19d0618ccae4db5e01819382b9508", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604217, "uuid": "ec4801c0-3d36-42c8-86bc-15ca7fbd5144", "comment": "Malware payload (NanoCore)", "value": "1fadad896af9b720edcfb5359bb2e05a682f1741", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604217, "uuid": "37d56c05-8d41-4cb0-a0e4-1e9ab860bcc3", "comment": "Malware payload (NanoCore)", "value": "c86dd64a421d4edf4507d36c6a58c4ba2e37f7ff10355f7b25d06781648569a97725b74a347ba23187e305ba1d6e35cf", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604217, "uuid": "a324c74a-87cc-4641-885c-b045af821ece", "value": "6305339D42D8AFCF0A2E08B12E61A6F31F2115369E63B92B85D4974011F75BDD83DB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604217, "uuid": "f5adc6d6-7682-49e1-9590-06d251f52460", "value": "24576:LeGGSUBjjFkjR6UA9+X2qBvpaTEqU8vJCHXMUN:DGNBjZkjt28pMhAHXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604217, "uuid": "04bbd8c3-239b-4d88-a0b3-5568f87cf894", "value": 802045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604217, "uuid": "4e88aa66-af19-4950-9d06-2c5c707d25c2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604217, "uuid": "64aaf1eb-f58c-4a2f-8fab-21612a022bcd", "value": "DHL_Express_Shipment_ConfirmationBJC400618092909_88700456XXXX.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7791b0d-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617650315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650315, "uuid": "d98331ad-a7d1-4a02-a676-8239694f3eaf", "comment": "Malware payload (Gozi)", "value": "9064c426999ab9e059e1e533b34f97be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650315, "uuid": "3ec19c39-5897-45be-aab9-9324d2b683ce", "comment": "Malware payload (Gozi)", "value": "7d80947ba6784330e792fae5eded56f2e7f228740e19f9af19106886e567b268", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650315, "uuid": "39b65438-e133-476e-b5c4-f67e79c366a6", "comment": "Malware payload (Gozi)", "value": "cc20039678658d4e79aef801907f4a1bf06c418a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650315, "uuid": "95c989d9-1a3f-4c7c-8439-08aec2181576", "comment": "Malware payload (Gozi)", "value": "64688d6ad699e8cb4e40001a192af701c88a5fdef2da1adff1e1ac2639496df42a12fb2aaa3b07d7b516a4b4cc230f8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650315, "uuid": "3632f4db-25c0-46a1-8e1d-1d745251237d", "value": "FEB3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650315, "uuid": "10c39718-4c4f-4c5e-a1eb-4f5c79b9104a", "value": "811de8e945c2087a6e052096546cd842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650315, "uuid": "47f78f04-b600-48b3-8f6a-dfca32e5cb86", "value": "1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650315, "uuid": "b15d0ecb-5633-4fc0-97a6-a315fb614717", "value": 108638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650315, "uuid": "6019146c-096a-4599-bfc3-382ee7c9637b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650315, "uuid": "76266f83-2957-42d9-a5fe-0e865b95d479", "value": "9064c426999ab9e059e1e533b34f97be.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff17c7c7-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644422, "uuid": "ba8231bc-13fb-47ff-97b2-29b2de7c5578", "comment": "Malware payload (Dridex)", "value": "a3ab4bfc634f68fa5b30062ac8490cf8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644422, "uuid": "1d1a68f3-dcfc-46d1-bd58-bf2d06c6449a", "comment": "Malware payload (Dridex)", "value": "8082e662a8935fbb4fcc808d82d3d94a8e6cf7b7edbd2220c92b9dcb622619b7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644422, "uuid": "18995240-1776-4ecc-ab68-cd55ad78fcdc", "comment": "Malware payload (Dridex)", "value": "d21e531bf8377cefeb19e0dead244a1e05049164", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644422, "uuid": "cbf34a3a-f498-44b9-b488-84a1ec9fb85f", "comment": "Malware payload (Dridex)", "value": "cb073096d500975f15d48baae63a5b9a0f2ddc573da472781523d94718b7c49d8f54b015f977b4a735b2385b69565450", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644422, "uuid": "e22804aa-f706-478d-b991-82942d574075", "value": "E914AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5BABF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644422, "uuid": "cffc5200-6323-4229-951c-875a587e442f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644422, "uuid": "9631ad2f-9cec-4320-90b9-dce227d35d3e", "value": "3072:UBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:UBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644422, "uuid": "b711f348-fe87-4992-b0aa-5ccf3a34f93d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644422, "uuid": "981448c8-f122-447d-88ef-e26faa86d584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644422, "uuid": "d0197a1b-171e-4f29-ab5b-5976157efd93", "value": "8082e662a8935fbb4fcc808d82d3d94a8e6cf7b7edbd2220c92b9dcb622619b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6270e63c-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649742, "uuid": "211395f2-c457-46d0-95fa-d86e2868bad4", "comment": "Malware payload (Dridex)", "value": "343db605edad4366f6fc04e8822c06d8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649742, "uuid": "4fdf47de-9c91-4bd7-88b2-8fff4a4ea005", "comment": "Malware payload (Dridex)", "value": "80b8ef3e005954921c3b2ab6452dc8c9b5b8f96c9f0a08cf5ad5397fc4efc8d4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649742, "uuid": "779aeb56-5bfa-4ca1-b330-5a29010ca24f", "comment": "Malware payload (Dridex)", "value": "f5a3dd1dfac2af899d758112c981a9e7169df520", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649742, "uuid": "f26dc72e-042d-4723-badd-646afda4ce96", "comment": "Malware payload (Dridex)", "value": "bd25b41f86eaa39aa3dee9c1b980e33b874c84b28baf560894f0dd4a2acc9a68a035ef57c369e7df251db4fbb325d8bb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649742, "uuid": "4495feb7-44cd-4818-85fb-0a5b46f07cc3", "value": "2814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649742, "uuid": "c133cdd1-e9a0-4a21-84df-34272a413875", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649742, "uuid": "58ff1a42-1478-424c-9ab7-55e484a02ad2", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649742, "uuid": "4c16d5e5-6339-454a-8546-cf83faf1f6c0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649742, "uuid": "bf3e5cb3-addf-4fb6-a88f-d576ce0d1638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649742, "uuid": "57256f54-c599-4972-bf16-189c5152a4a2", "value": "80b8ef3e005954921c3b2ab6452dc8c9b5b8f96c9f0a08cf5ad5397fc4efc8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5bea73-9656-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658485, "uuid": "8e9979a6-c35a-4c5b-8d03-4e5c23d9497a", "comment": "Malware payload (Dridex)", "value": "66882536ec323805ebd58f24942c14bd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658485, "uuid": "0f4e4a52-9c82-4ce1-8636-0e2f2d61026e", "comment": "Malware payload (Dridex)", "value": "80fa19a76ffa4fc437f299996e04b4c586f4a13768d0d751efb5051a635e2b7b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658485, "uuid": "6e1ac7c3-8c76-4ca1-8544-16b8626c315c", "comment": "Malware payload (Dridex)", "value": "7c4312a556932791eff9100087d67df6128b1ae6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658485, "uuid": "5b822a05-28e7-49b2-8998-7027cc2a50b4", "comment": "Malware payload (Dridex)", "value": "fd1e42a7e08a424f732e5080b535052e0b31104b36035009d9d21995790872493f4e6f420d0d461dc94db9dda0839edc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658485, "uuid": "000611a0-152e-4233-848f-34418e1935d1", "value": "A0149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658485, "uuid": "d5a6ef52-9eff-4665-8dd5-7f26dd6bfae4", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658485, "uuid": "5cd49099-d4d2-4bc3-966c-bd1d3995ee19", "value": "3072:L6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:LZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658485, "uuid": "6b05d35a-6a7d-4b1e-b5ca-242bb916c735", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658485, "uuid": "ec6df2b4-5d0d-4495-9b27-ff6e8714f1c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658485, "uuid": "a4a49757-0533-4208-b58e-f14be7287c89", "value": "80fa19a76ffa4fc437f299996e04b4c586f4a13768d0d751efb5051a635e2b7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218606c9-9630-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617641902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641902, "uuid": "ca8b00bc-e170-4251-a902-a5575d9d0a54", "comment": "Malware payload (Dridex)", "value": "d3c39d263bba1a5e671c5ab15a098b53", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641902, "uuid": "ff8bb654-05f0-465a-a059-10e17ac0d2c0", "comment": "Malware payload (Dridex)", "value": "81ac984f776651f3bac5b88efca80f574518f554059eb8167dd76e6b43ae0224", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641902, "uuid": "48b37666-458f-4cf1-a6fd-fac1bf8b95d7", "comment": "Malware payload (Dridex)", "value": "4045c265b91667bc0c865471cb0ac0deddd2fe2c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641902, "uuid": "9964230c-06a6-46d2-beea-bf3db47da0ec", "comment": "Malware payload (Dridex)", "value": "7f10e057310cb506e6a262d8c0920c1d3012a0a65b6aab1ee15dd2dcc6432512a3998768871596eb6fb1b39d7dcc50fe", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641902, "uuid": "991ab5ff-9185-4a15-bb89-826c1e8b4921", "value": "4C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641902, "uuid": "4bb54d10-407d-40f6-9917-230f993dc175", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641902, "uuid": "4633bdd6-07e8-4d4d-b33e-ee5bbe2eb238", "value": "3072:7opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:MpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617641902, "uuid": "9e133607-f0b2-47f6-9f97-8f88b319c7af", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617641902, "uuid": "1add0e7f-ed2e-4607-8877-f5c3660bfa86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641902, "uuid": "387cba13-d1d8-4749-848f-6ff0fa52785a", "value": "81ac984f776651f3bac5b88efca80f574518f554059eb8167dd76e6b43ae0224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134c0b4c-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647462, "uuid": "cd354083-8355-40be-b0f3-65f099e1ba9a", "comment": "Malware payload (Dridex)", "value": "3a895a314c90b09ba8cbd3046883c5d5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647462, "uuid": "4e35c5bf-6cc3-4a49-881f-b567edc70eac", "comment": "Malware payload (Dridex)", "value": "820428ac365a4d830340add60a135d553f9039ced5d27c891f3c247df68b92f4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647462, "uuid": "2b4c19cb-2899-44e9-8705-9a7a5d651d90", "comment": "Malware payload (Dridex)", "value": "5f39bb0884af58f069990acae90ddf460659bcaa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647462, "uuid": "8909f208-8a1b-49ee-98c9-1ee7254e39ae", "comment": "Malware payload (Dridex)", "value": "c5f095cc8acc463d65523ab65abf26369c1ab91107d548888b55f291faae1fd7c0def94ce920ff3ddc36014fdca7e9f0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647462, "uuid": "9958688a-c0ce-4be4-9237-23b532592faf", "value": "AD14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647462, "uuid": "ef0608a5-855a-47c0-a153-b8b85d224b1e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647462, "uuid": "f5929da2-35a1-44db-adfc-e24cdca164d6", "value": "3072:5BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:5BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647462, "uuid": "d534b6e9-f796-41b1-9665-1eeeb6f7fa39", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647462, "uuid": "49b89139-4c0c-41d9-9449-6bc909218da3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647462, "uuid": "511ac09a-f310-4223-854c-76bd4b8d7334", "value": "820428ac365a4d830340add60a135d553f9039ced5d27c891f3c247df68b92f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dc5f5c-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604359, "uuid": "586bca8b-8482-4b72-9fe7-82c47a769b3a", "comment": "Malware payload (AgentTesla)", "value": "c1c37af6169ccf5c80216194d4ace5d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604359, "uuid": "bbe210ef-06eb-479e-bed0-c0ec48b7dffd", "comment": "Malware payload (AgentTesla)", "value": "826298b4d035818be292a13b27215db4d94733f28df50f94e9a93a5d3fea2190", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604359, "uuid": "1ca11dbb-2d4e-430c-bf98-e4060df3aa53", "comment": "Malware payload (AgentTesla)", "value": "296d539706a9e9444417ac1dff4603a2cd9c9174", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604359, "uuid": "f6e37200-74ca-4977-8c8c-f20e0bb503f0", "comment": "Malware payload (AgentTesla)", "value": "3d46826233b6ad67d723321a8c80ec235e822b64f4663e60f48145cefe01a3e13bbe8c7a1be3a41c15f4476cd189eaf1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604359, "uuid": "88277213-0a5c-43fb-a9a6-8b691789740f", "value": "F105CFEEB3728958C51C4E379437C2AC66F098277A52F71FF0EC3E9A5E305158A27849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604359, "uuid": "0e9a547b-c7b2-4654-9d04-519e42aa43d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604359, "uuid": "7b373c8a-6381-4118-a6b8-549e6aab4cc2", "value": "12288:7SaYUSmJt3o518at0uG9kFU+bmlJCpTUc8o518atXQ8DnadGLGW8b/A9uof2E:2USY3o5h0d9Z+biJm8o5hg8GdGK/zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604359, "uuid": "88c90a79-1c99-4b4d-a974-8a47b73033e9", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604359, "uuid": "b4df249a-5c1e-4072-b936-f94be29aab35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604359, "uuid": "31c0b2e5-6c40-4b0c-938b-6a28cf575f0b", "value": "Payment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e7c28f-964b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617653664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653664, "uuid": "dcc51566-b59e-46d8-8f02-65d8f0b53a26", "comment": "Malware payload (Dridex)", "value": "f5ab7214998835d1a9f5279356a73fc4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653664, "uuid": "22fba37a-9afb-4856-9c39-9ae9fcf470f7", "comment": "Malware payload (Dridex)", "value": "830ece0553b320ed0533be3b34bb8f440aa405dd95e93efdccf145b167ae087c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653664, "uuid": "31f55568-0c65-4ae6-ae95-036c319fd77d", "comment": "Malware payload (Dridex)", "value": "05e4ebd1bc964fb8716120060978d62f0b47eccd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653664, "uuid": "4040268d-7020-4b02-be38-4c52cc16d5f9", "comment": "Malware payload (Dridex)", "value": "042e6210b9f890f2a37930ff349206b987d0a2394398c7faf5390b019c69fa69258348d0ae3d62f871d28833ad542c53", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653664, "uuid": "15e7b26c-a86a-4cd1-8751-0022245c42df", "value": "0D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653664, "uuid": "7735a7dd-fd3f-4e10-90d8-7fdc9f773bbb", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653664, "uuid": "acb0d89e-0f84-4c1c-a1c4-64e5b25dda12", "value": "3072:OBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:OBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617653664, "uuid": "123f24b9-f03f-468d-ba74-b14dad1ed8c0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617653664, "uuid": "801b2859-7a82-4501-8349-b4bb5c9a96d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653664, "uuid": "fabd4099-7e88-47ac-b18e-f240bd479934", "value": "830ece0553b320ed0533be3b34bb8f440aa405dd95e93efdccf145b167ae087c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec5b034-95d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617603968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603968, "uuid": "3ce26b2d-4a0e-4218-85b5-eb4649c5af9d", "comment": "Malware payload (AgentTesla)", "value": "7b6676ee602429afb304dda190c092c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603968, "uuid": "dd1a62a7-15f1-4c09-9c28-f472789d83f8", "comment": "Malware payload (AgentTesla)", "value": "83900f04e48fd6442609f50462b4ffb6505c0d5db3e3742767ff9d1a1f069766", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603968, "uuid": "7693f5bb-bc4b-4206-bd64-cb1f2a8f22d8", "comment": "Malware payload (AgentTesla)", "value": "b1d399766e729c1f97552bb61bfa24853d1a4aee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617603968, "uuid": "81b8c5d6-0404-4934-b0eb-f9bafe6c2c23", "comment": "Malware payload (AgentTesla)", "value": "6594cc63ac68f72b03d066f6745d0736cbe1a66beaba207a6411850323fc8df2c1d23e2d71f72d8b3724a307d58547de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603968, "uuid": "e97cf90d-cf6a-441d-aba8-23bb295a154b", "value": "A6E423F131AE82209C417B6BF575E212B9438FB13F863B79FDEF101E26178A5429046E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603968, "uuid": "5d49f7da-830f-445c-9d43-2d6657a00475", "value": "12288:hloTJDfo0yZ4kz9ksvuuG5zI8rBdOqsceaHItrDq2g:7CQ0u449FvuR5zI8YTrDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617603968, "uuid": "9865630d-a79a-4dd1-ae92-9d7a6de86b16", "value": 709861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617603968, "uuid": "5ebd7686-9e87-4b72-817d-cbc9a2119e62", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617603968, "uuid": "ed51aba4-c6f8-4824-b2dd-bee214527736", "value": "Payment Advice.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7988034d-9611-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617628736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628736, "uuid": "7e985f54-47cd-4107-8596-12e62302fd19", "comment": "Malware payload (SnakeKeylogger)", "value": "8624f0a13a6b97f3bdbd2b65f14f55a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628736, "uuid": "981fb3fd-d9cf-4379-be45-103c2e4d1857", "comment": "Malware payload (SnakeKeylogger)", "value": "8399e7874f24aa2e673fa90fab21eea148e2c4baae513fccd18ee3879991157e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628736, "uuid": "c2f7a85f-53cd-4367-a617-4052e12c5d64", "comment": "Malware payload (SnakeKeylogger)", "value": "5e7f0fad0c4db5d02af4512c892b155a22ec586f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617628736, "uuid": "7b406423-2b30-4aa9-b5bf-cbb80379618a", "comment": "Malware payload (SnakeKeylogger)", "value": "90603a3c37d45e54862b9fb666200f486d1b28df0bd20dd8f688b3504760e2381cb8cce2b955bc381f3278e7b98e3ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628736, "uuid": "5dba0228-5ca3-45c7-a1e3-9c9961a3982d", "value": "35E4CFAC3240B5EEC817C6B6C9652C65E661F4FA67078717821741E85A1CA8FCFE48F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628736, "uuid": "cdb545ef-369b-4f74-b00c-c05489034c7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628736, "uuid": "b8a085c5-4512-45da-a547-c008b594a042", "value": "12288:Qh129t2p/GoYUCpmgiQQ7ye00xmTz+k8JaMhqDcI0t2QhTSyUjLbzbGUWEqHH4n8:Qk2woYUCpmgiZZmTax0Mh4cIwKbbGZL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617628736, "uuid": "a5a31117-cc28-49e6-b820-2428dab41657", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617628736, "uuid": "78cd0265-bc71-47c5-9fd1-8185b26636fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617628736, "uuid": "212d8a55-6737-43b4-8e24-41122db43a46", "value": "AD1-2001028L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25654151-9645-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650928, "uuid": "9a78833e-77e9-456f-a8ff-35269f3ca303", "comment": "Malware payload (Dridex)", "value": "f173fa0a23c19eb5777fe33993ee6e2d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650928, "uuid": "be82b234-74fa-45a8-a325-ce1b441bb634", "comment": "Malware payload (Dridex)", "value": "859918c2ec3e680d75eb3b0c0c055842f973599ac08a8eda221d4a7d6eaed4a8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650928, "uuid": "84a05163-55a5-4ca4-b7c9-0954665a0e00", "comment": "Malware payload (Dridex)", "value": "f6b52131fca573de478ed0e040e042a269812cfb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650928, "uuid": "99e03f28-e72d-49d8-8bd0-07d2a7de2995", "comment": "Malware payload (Dridex)", "value": "39e1e901cf97fd99cfd9bc9d4dfcc9fa9539e1875e2b9ab1a9a5abed65a0c210f9a914f6c43f0a594ce944fd0dd80438", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650928, "uuid": "94808b01-48c3-4d4d-b4e1-403be2f8fce6", "value": "4E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650928, "uuid": "ba695d7a-e0e3-413d-950c-4b3431ca6b04", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650928, "uuid": "bbf63fd6-4229-475e-866e-04a9ad2cc4d9", "value": "3072:UBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:UBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650928, "uuid": "cb57c125-9eeb-438b-beb1-215811b415b6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650928, "uuid": "aeef771e-9038-426a-b331-41a7b29a581e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650928, "uuid": "b19951ff-00d3-4147-9f3e-eb2cb48712ba", "value": "859918c2ec3e680d75eb3b0c0c055842f973599ac08a8eda221d4a7d6eaed4a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382caac2-95fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617620036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617620036, "uuid": "46232ab4-f584-40c1-8374-a0b832710bde", "comment": "Malware payload (Dridex)", "value": "79d02602cca8309f42274cb71d60b2d9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617620036, "uuid": "96fe9606-0910-4c50-a555-cc8e4a8440bf", "comment": "Malware payload (Dridex)", "value": "8658ac6521fb762f6f3724f1a1cb685df136da949d28020f47e82fcf39388671", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617620036, "uuid": "12ad4142-7e9b-4001-b7f7-a941e142d4b7", "comment": "Malware payload (Dridex)", "value": "19eccfd124cae62dcc0b7beca9b77480ac5d70ca", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617620036, "uuid": "501517ac-683b-491c-83bc-f1dd903a23fc", "comment": "Malware payload (Dridex)", "value": "5e5186c122b81cce2fbf7aa642750575b923f1d02290f210a3f9a9b68e59701cbc8d5d71e403f309cbc85d3eca3f44d1", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617620036, "uuid": "0254b48e-ecb0-4090-b39d-81cd41098162", "value": "0A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617620036, "uuid": "3efc453c-4aa6-43a1-81a9-e97d0c67be55", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617620036, "uuid": "b082288e-9b7d-4e8d-93e4-f706e27106ef", "value": "3072:Vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:6pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617620036, "uuid": "9bb49782-d5c9-4c2a-97a6-cdcbe6d59615", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617620036, "uuid": "9d6fe560-3569-4e04-8590-89a725feeb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617620036, "uuid": "d093161e-95a2-41e9-80cc-5f3523ad5012", "value": "8658ac6521fb762f6f3724f1a1cb685df136da949d28020f47e82fcf39388671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cddb7c-9614-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617630010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630010, "uuid": "d901ca5f-218d-42b2-b526-40d3a2c41d3b", "comment": "Malware payload (IcedID)", "value": "ad42cc9cdd13281f508e7feebb3833d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630010, "uuid": "1c158dc9-c3d5-429e-940f-e928c9bdad98", "comment": "Malware payload (IcedID)", "value": "873244ee3a15cb26440a5d9cf7f4177f62784a458400422c238fbbc2335de8c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630010, "uuid": "19f0511f-0d7f-498d-8952-20c602e71d80", "comment": "Malware payload (IcedID)", "value": "186e32fab61e760abe5ef791e60ca2f57e66ca43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617630010, "uuid": "73359e54-5559-4587-9769-82286b9cbd5e", "comment": "Malware payload (IcedID)", "value": "410bf0063c73970b0788cd9e421daf35b3eee834a84369aef768f2fff556f43203046be57a4c15829483946b39eb7f65", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630010, "uuid": "9dedaa8e-c88a-48ef-825e-a1f8e2b49956", "value": "D224B6CB06CE59F3D9BE61B4B146416E252138D109E88FEFE8C807578697B87C67B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630010, "uuid": "7eb3a9d6-8d19-473e-820b-2456cf1dcf26", "value": "28b031d0558b8e7db218ee60c7804970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630010, "uuid": "2e21f8aa-10b3-4913-b88e-657f961a0b75", "value": "1536:F7uX91CN/EtZIe2Vrw7JxDHiYbVb7b7b7b7bxbWe/b25JJst1ADGnXHOtwNlnd2h:F7uXHhHIZy/b25sd2mBN+coNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617630010, "uuid": "4dcdebf3-6ee7-4f9a-b6a0-c7ed68829463", "value": 224910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617630010, "uuid": "d647b840-18a4-4670-84de-3dbc762b666c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617630010, "uuid": "b65e57c6-fb17-4b5e-8ab8-b7cb4c57768a", "value": "ad42cc9cdd13281f508e7feebb3833d1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa754fa0-9667-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617665755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665755, "uuid": "6ebfab71-71c3-4631-899d-b5592c4beb3f", "comment": "Malware payload", "value": "0abc85bcfe58e1e465b8a64e6e293e22", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665755, "uuid": "c3d2696a-dd6b-4459-85d5-c43e24f63ea3", "comment": "Malware payload", "value": "879103051d813c6863efbb5ae5048b07fbf60f4d2ec3d2b392cb44ce39996f64", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665755, "uuid": "38e335aa-3fc2-4f45-ab0c-20c8077ddc4f", "comment": "Malware payload", "value": "b82aab05871c4a48d08b2fbf6d89d55372302015", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665755, "uuid": "fd8c6986-d361-4216-8718-7e480ec87b9b", "comment": "Malware payload", "value": "781a5692000ac8302c51da25c3125a099b2849081424cff3771983f795f5784748b8a8d8ae65d3bdeea14930f33abcc8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665755, "uuid": "e1ac4c3b-5c8e-4534-8e92-db82d71a62ff", "value": "F5149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665755, "uuid": "9db6307d-9feb-468d-a43e-b3083fbed222", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665755, "uuid": "2a27403a-28d2-4f8f-bf51-470e97971971", "value": "3072:S6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:SZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617665755, "uuid": "939912d8-343c-494e-b9bb-8591e2fadde4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617665755, "uuid": "dedd7cc3-6dd7-4f07-b49f-5e48a504ddce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665755, "uuid": "615e656a-094a-409a-8936-a1a87affddf9", "value": "879103051d813c6863efbb5ae5048b07fbf60f4d2ec3d2b392cb44ce39996f64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027e6afc-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "bf5f4f4b-de2e-4cbe-af6f-b087e0cfbe8b", "comment": "Malware payload (Dridex)", "value": "b529eeb2d5e6822b4e02289bbee1763b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "9e4dd422-05f7-485a-9eee-78ccb10e850b", "comment": "Malware payload (Dridex)", "value": "87acf1ca59fb704c80171703d08b64e02968433e78035a4161669921735e2b7e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "757987b0-e71b-4489-8a80-1225822f6113", "comment": "Malware payload (Dridex)", "value": "806e4af29f32e3a4f8c2459082a1547211d5f2d3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649581, "uuid": "8de775b3-a4b7-4b96-85df-2162feeba5b7", "comment": "Malware payload (Dridex)", "value": "dc76ce99d2d0bfe88c685a1a184ce6b2e5169d166577f3abe3e01954efb2fde9f3c1a244e3d768de1a347ec6b009335c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "867ea950-14f0-4b91-88f2-14d539e8fd3b", "value": "3F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "e08e5c4e-c6a6-47e7-94bc-e6b1b17b92c0", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "d5d51f7e-0043-42ed-930b-b32f24608e44", "value": "3072:yBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:yBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649581, "uuid": "118d918d-1487-413f-b19c-6bed2c63b32b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649581, "uuid": "4db575a2-be61-4f37-a8f8-f9c891b43d1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649581, "uuid": "59aa580e-32bd-437a-acfb-c92c37eb2508", "value": "87acf1ca59fb704c80171703d08b64e02968433e78035a4161669921735e2b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebd6c93-95c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617593767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617593767, "uuid": "91995b36-fe53-40b1-80d8-adafdd63030f", "comment": "Malware payload (Dridex)", "value": "af155eff808cf127c62b64c8a13ecbae", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617593767, "uuid": "d545bc06-19f1-4385-9e16-55cfedc39c7b", "comment": "Malware payload (Dridex)", "value": "87c1719d6d9f83dd79db3bc7e2f5dd067c3c14c0162b361a1d3477b76ba82c9a", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617593767, "uuid": "df5a4226-543b-4fd9-a91a-5c6cd5b64865", "comment": "Malware payload (Dridex)", "value": "4abb74bd87916368161b9b223d26efad080a7c72", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617593767, "uuid": "c701c6ba-50c3-4c23-a43a-f7bf6914acf4", "comment": "Malware payload (Dridex)", "value": "2cef6dc9697a9d0342800314a95a51e3d259d0b00e428adb8c573255b403ad30ed9f404260f931743ad8f25262498a9b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617593767, "uuid": "24131421-46b5-4a67-81be-31559ab48f6d", "value": "5C058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617593767, "uuid": "b54f61bd-7379-4e27-87d8-390747bd1f3b", "value": "523b18dc1c7a7f2ecc8f20b6295beddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617593767, "uuid": "38f7ca59-3a49-4693-8314-3acce5393797", "value": "12288:HbqkjZV1Vu8MpJYosZUmc16RWdrpo8+FFcLxT8HoxmRsDJteMKT281MOU7qOkQR1:HbqkjZVqxYjxoArwQobmMKNiOUFkK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617593767, "uuid": "bc911cb9-6d7f-4a87-9730-1f867668d03d", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617593767, "uuid": "f9a58fb3-1651-4670-94a8-fcf0123f3916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617593767, "uuid": "05ef6e52-fbc2-495b-b208-5021b23809f3", "value": "87c1719d6d9f83dd79db3bc7e2f5dd067c3c14c0162b361a1d3477b76ba82c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee91d50-9647-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651857, "uuid": "94a667cd-7c10-4ae7-b1f3-2e8d0e5a7158", "comment": "Malware payload (Dridex)", "value": "173b7e34bca64d62a3acd166e2c68e2a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651857, "uuid": "00bca96c-3f21-46e7-8471-ed562a0c275b", "comment": "Malware payload (Dridex)", "value": "8827b272dc985bdce6582d4f02300c5ea3ff8a3292942933434ded510512b0df", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651857, "uuid": "1f54c5cc-bffa-4731-9c29-583e04e107ae", "comment": "Malware payload (Dridex)", "value": "9cccf70e2253596e7e6ea88db584bed58a8b221e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651857, "uuid": "ca4dd05b-06e5-4335-8228-7f0e42e26607", "comment": "Malware payload (Dridex)", "value": "a79d89246e7298163379ed70b975368569b731f09e05fdc5ab817b8e1d6b0343ea2a07b8f4c8d9434fffbd3598c5be49", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651857, "uuid": "e0ae9880-e9ed-4999-a694-c48403243218", "value": "9714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651857, "uuid": "b3b77aac-5f2c-4208-902b-a6e26afeabed", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651857, "uuid": "a48ecd34-2535-4d7e-95fc-fe688bafcb35", "value": "3072:9BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:9BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651857, "uuid": "4f831058-558e-477c-8bea-b87cbba7ae0a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651857, "uuid": "b8c32b44-cd49-4b75-8de1-aacbda2bcf1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651857, "uuid": "67a8c9c4-d58e-4c9b-aebe-db96aa893bd2", "value": "8827b272dc985bdce6582d4f02300c5ea3ff8a3292942933434ded510512b0df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6010a425-9646-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617651456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651456, "uuid": "5c4c323e-1a05-4e09-9a4d-436df10da5f3", "comment": "Malware payload (Dridex)", "value": "ad8344a4aa266d116206683c3d7bd6ca", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651456, "uuid": "943b0c79-bd15-40be-9f46-00246f1ec1cc", "comment": "Malware payload (Dridex)", "value": "8849a1e1f2975b69e1cdfa4ebf28a643ac850d857858d286a54db806c1dcc3ee", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651456, "uuid": "e86781a4-79db-4895-a477-3829773bb9d5", "comment": "Malware payload (Dridex)", "value": "a51c48d7ca494cddb37f0b89658d1df4b6e6b1b7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617651456, "uuid": "93418ea0-e595-4851-8b62-3f6929047cdf", "comment": "Malware payload (Dridex)", "value": "28f44e8431d991d1727769a343d7f6566e0987730f9f22e0572aaec029a5f495a7fe32238427afda1efcbc8db014ddc1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651456, "uuid": "7e13c499-656d-4563-a272-6f696973d286", "value": "2D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651456, "uuid": "ca943225-06b1-4666-b5b0-bbed6fc28ac9", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651456, "uuid": "4f654f05-860b-4b17-be0d-1915a9fc9a89", "value": "3072:XBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:XBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617651456, "uuid": "7fbf1731-e8c7-49ab-8921-9ab52299ec84", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617651456, "uuid": "8aec998c-92e6-4775-963e-47ffb5f3d36c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617651456, "uuid": "886d1dde-911f-4d3c-a014-0769bd8ef6f1", "value": "8849a1e1f2975b69e1cdfa4ebf28a643ac850d857858d286a54db806c1dcc3ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f996556c-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647848, "uuid": "8a836a47-df1e-485c-a849-33a77f183197", "comment": "Malware payload (Dridex)", "value": "eb8359f8bea9c34e35225d6806061b87", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647848, "uuid": "a7451505-9281-4c7c-bbc2-64b4e87305a0", "comment": "Malware payload (Dridex)", "value": "88d46009e8ef372c4631e0e8e33eed42097b5e1f95016dcf4ba02118e53a99e7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647848, "uuid": "60cf136c-a2c8-40a0-938b-e28586c6e1e7", "comment": "Malware payload (Dridex)", "value": "9bc3d9807ac2c240165fc79f845fbf92ac7f73cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647848, "uuid": "4f488ed6-e3b0-40dc-93c8-70a2cb7dc03a", "comment": "Malware payload (Dridex)", "value": "cc6d4d89fa48ea22f2de30dad8102274bce0195162ce7b3cd60d60ccbd6caeb40ddc4b84c3c3ccdf95d161ceb85c727c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647848, "uuid": "b07beb72-5fed-4011-9666-420d8a17ada7", "value": "9C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647848, "uuid": "f9abe7b1-8676-4cc8-8c71-f0960ba8e08c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647848, "uuid": "431ccbfe-ff4e-45aa-bd17-918dbdd3e668", "value": "3072:RBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:RBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647848, "uuid": "697c1dbe-234e-40fd-9fd7-ec1c4bee62af", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647848, "uuid": "1f29b351-4670-4ad0-900a-c9b68a0cfff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647848, "uuid": "6fc28d3d-11a1-46d0-9bc3-f28d603f75a2", "value": "88d46009e8ef372c4631e0e8e33eed42097b5e1f95016dcf4ba02118e53a99e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f11e533-964e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617654944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654944, "uuid": "0f1d3304-5548-4cb2-bf27-ce5f1c35f18c", "comment": "Malware payload (Dridex)", "value": "998872344e0a51a7aaf8db29ad0236c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654944, "uuid": "b6aa7efc-396c-46d9-b388-8e9fffcd7557", "comment": "Malware payload (Dridex)", "value": "89bd068009791f56fe4d11736f9bb3336b18f95fd7683a5f3a94885ce31c81fe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654944, "uuid": "0bfbbb76-39d8-4c02-97d3-b194050ae07d", "comment": "Malware payload (Dridex)", "value": "8128119b06760e8ec0fc9b25917d7e24b759c97f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654944, "uuid": "e5de6d85-4019-43f8-b657-095d89dedeac", "comment": "Malware payload (Dridex)", "value": "fce7bb801fe35e6d79d8e414cf53857532a2576b017104325ea0ddeb76bd44090033a8a11c5948d8ee65277f83f91dea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654944, "uuid": "4a65338d-8ca9-4a58-88f5-e91059f9736a", "value": "C514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654944, "uuid": "0da0b5f4-df47-47ba-9dce-5262889e4620", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654944, "uuid": "a75d64b9-964a-4811-8b4b-2c83f54c19e8", "value": "3072:+BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:+BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654944, "uuid": "236e0b75-9b94-4107-90e5-7a2038c4e6af", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654944, "uuid": "823b638a-6ac2-466a-b768-3be222734a04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654944, "uuid": "d451b69c-908e-4d9a-b50b-b2533e6c1af7", "value": "89bd068009791f56fe4d11736f9bb3336b18f95fd7683a5f3a94885ce31c81fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6943c21-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647790, "uuid": "52e652e2-b85f-4c49-9cbc-73e57587e791", "comment": "Malware payload (Dridex)", "value": "58734c162df22218b6586b2d828e95b7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647790, "uuid": "550ad1ef-176f-4986-a739-1256c88bee2c", "comment": "Malware payload (Dridex)", "value": "8b339bff503550fa867bab2d0d1faa1667c62bdcb6374d425fd715d8158755d4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647790, "uuid": "ac07f059-9d46-4a94-bd78-b8e3ad33a956", "comment": "Malware payload (Dridex)", "value": "5de550a5f8293c6ed209307e2cb5a34acec54af9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647790, "uuid": "8d4bfec4-ed46-4fec-bbf1-b8f51700d193", "comment": "Malware payload (Dridex)", "value": "a5dab4085bc6b15ace3d87e038f10078afe45232e05585dbad8a540d081d12d3faf613497962e4e73b9ef6ddd8c0253c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647790, "uuid": "61067921-23ca-4dfc-85d1-d552cc92a83c", "value": "E014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647790, "uuid": "6aa86ed5-44df-4846-b5a3-518306c5bddf", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647790, "uuid": "2beb2212-470b-4314-b668-3288cd642f6e", "value": "3072:eBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:eBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647790, "uuid": "89d604a1-a09c-4468-84c7-0b8048337fa2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647790, "uuid": "d81e6260-abc4-49eb-968c-f31bb8b6a4a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647790, "uuid": "01eca7d3-1870-47d0-82b2-73ed35e25296", "value": "8b339bff503550fa867bab2d0d1faa1667c62bdcb6374d425fd715d8158755d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8a688e-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604238, "uuid": "fbc0debf-e586-48f5-b55b-c06932bcaede", "comment": "Malware payload (AgentTesla)", "value": "828ed0370ad4158e51ea4baec684dda9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604238, "uuid": "6833f27d-2a1a-4f2b-a0bd-b0579e53ce59", "comment": "Malware payload (AgentTesla)", "value": "8b9b14dcc5922662ded18967ad9ab1aaf1a4fcf6f3d418905f9c3d161e913e83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604238, "uuid": "152975b0-6c64-4c4d-b8e6-466ee015326c", "comment": "Malware payload (AgentTesla)", "value": "98d4d69b97f2b13859757728980aa174525aa5a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604238, "uuid": "1be0e02c-a279-4f06-ac56-e2193143b756", "comment": "Malware payload (AgentTesla)", "value": "8f2c537c8ff3469c29005b9dde7e167e75c9fad65f2513d60007461a2b52262c23c7fa8447141f0139ea4d497d29ea54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604238, "uuid": "66ff9821-18ec-41db-ad62-85fce423166b", "value": "6C15CF413285DC86E0172AF248AFD4105274F9DE5563CB0D2B42BA67A1E734E2CDBB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604238, "uuid": "495a2f0b-4478-439c-84a7-91c66d375ad1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604238, "uuid": "3eb06fff-37b3-4c80-9c94-8db0a683ba40", "value": "24576:S3tcdqAM3YOiAkhdsw6Dxu2PFzJ1K/goQd8:S36qAMo7Akhdsw8vZJ1FJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604238, "uuid": "71273dbf-c2bc-4222-a437-dc817dcb440d", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604238, "uuid": "1226c810-b06b-4b39-93f4-64af32fc2ab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604238, "uuid": "5da89d07-2ba2-4a0a-8dfb-6dc1166a2675", "value": "Quotion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55e34a7-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647841, "uuid": "962a0204-6791-4abe-846a-f041aae7b361", "comment": "Malware payload (Dridex)", "value": "6b69caee5d788519ca42eaaf33e4f5e2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647841, "uuid": "4e5c127e-1120-411c-af4c-2499d4cdb43e", "comment": "Malware payload (Dridex)", "value": "8ba2ac9fd827c88d7fc27f2073c4aa4dfacee1f417c86b87a9916474c9227f36", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647841, "uuid": "6e5c78a9-1adf-42fb-9ca7-1b22abb0b94b", "comment": "Malware payload (Dridex)", "value": "130b05e45e3b5bb490622223a168f4a310fef06f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647841, "uuid": "bea80840-efb5-4cea-9a77-2fa70b6d0e97", "comment": "Malware payload (Dridex)", "value": "19ae7995e60a10016dc95a5068e8dcef5039036e56cdbb1e82472594ba720cd41888ad234c1d909cc0aaee50f2f95ac1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647841, "uuid": "41e976e1-a906-4357-95e6-053dc83e6122", "value": "3A14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647841, "uuid": "17e6a178-05a7-40bb-ad16-fc8df5eaf07d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647841, "uuid": "6d5e42f3-26ab-43fa-99fc-05225de26256", "value": "3072:FBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:FBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647841, "uuid": "3a830a3a-a0dd-4a0b-8d0d-a620cbca1da5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647841, "uuid": "1776888e-7176-49de-8242-25220b575d19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647841, "uuid": "00bbb7e8-12a9-425c-a5f1-d000f164171c", "value": "8ba2ac9fd827c88d7fc27f2073c4aa4dfacee1f417c86b87a9916474c9227f36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1573110e-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649184, "uuid": "91d0861c-c140-403a-a863-ed7d03921d7c", "comment": "Malware payload (Dridex)", "value": "234ac60cf82225e46283915da711c814", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649184, "uuid": "cc072f28-bafa-45fb-b926-28c620277cad", "comment": "Malware payload (Dridex)", "value": "8c041301df73c2f003ba72f45146158b3bd5ff2830e24c614b0ff3c2382ce37d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649184, "uuid": "82a80558-7a0b-42cd-979b-4dabb90d1968", "comment": "Malware payload (Dridex)", "value": "2940405798e42c3b4278ec78784f1551f980f735", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649184, "uuid": "1b461af8-d099-41f6-bb21-c3542df71e55", "comment": "Malware payload (Dridex)", "value": "f643d70000aa69ff033691183ac041daf59b3b9a5002f77a0048740f5d940c91818b0f2411f330ffdb71fbb8bad52a11", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649184, "uuid": "9eeba506-3987-4ee1-8834-25390b8cb50c", "value": "AD14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649184, "uuid": "8c96d932-e24c-4aec-8d7d-5470cfd90fd0", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649184, "uuid": "9b0d49c2-350d-4330-af6b-e202829c3536", "value": "3072:5BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:5BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649184, "uuid": "1d83e7c3-513d-4238-a08c-e7a661e63005", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649184, "uuid": "4d164f8c-aa1c-4fe7-9600-66b321a4811f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649184, "uuid": "228d957a-2c2e-4592-9b99-c45c19a42022", "value": "8c041301df73c2f003ba72f45146158b3bd5ff2830e24c614b0ff3c2382ce37d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea5dff6-9656-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658380, "uuid": "f31c3426-bf2d-457c-8b35-2b1f2adfc906", "comment": "Malware payload (Dridex)", "value": "0c7989989e46771a472c3ed3cc2d17f0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658380, "uuid": "6f4df2ab-0b01-4eb5-bef5-11df5dba535b", "comment": "Malware payload (Dridex)", "value": "8c36e3a18ff8dfa5164567be44625d9864ae547e880efa3231c91af610952017", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658380, "uuid": "05c322f0-1146-4b48-9df1-e160d57dbbbe", "comment": "Malware payload (Dridex)", "value": "ad3ba14e0cd0efccaa706d72b73a253c9a128367", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658380, "uuid": "d154d624-2eb7-4526-b7d9-3dd9576e41cf", "comment": "Malware payload (Dridex)", "value": "43746f21def165de6f1f82f96f0bf9a554c12a1c6dc607912b3e1a1b93f041191e65ded0dd527e951c39881ed26d62da", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658380, "uuid": "762a4f07-885e-441b-aab8-6758916579e0", "value": "95149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658380, "uuid": "a758685a-35a2-4e2d-9d4a-3d322538e4dc", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658380, "uuid": "a9158d72-bbd9-4889-a768-fe0849bf8128", "value": "3072:q6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:qZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658380, "uuid": "5b87c404-f482-40b9-9d36-733480921b3c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658380, "uuid": "963b6a5c-d812-4bac-84ed-e93f35dbc4d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658380, "uuid": "2123a7b6-c349-4c03-b431-d5dc23f1e58c", "value": "8c36e3a18ff8dfa5164567be44625d9864ae547e880efa3231c91af610952017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9042f3-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614888, "uuid": "0ceca572-03f9-42f8-a2cf-8b956ba9fac2", "comment": "Malware payload", "value": "4683e8bd8fe2c6647ef8016dd8704c58", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614888, "uuid": "fe004f24-f7ac-4f83-a8a6-cc5dca39d5e4", "comment": "Malware payload", "value": "8c4b14d6bcc379a8eadff4e90476ff33b6ae0f3da22cb95c47fe1f3203382f7c", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614888, "uuid": "32c02b39-6b44-4ae1-9c0a-d499351cc4a1", "comment": "Malware payload", "value": "323be5d52ed3bec22a9c69da83cecf16749573fd", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614888, "uuid": "b069fa02-4b01-4ffb-a51e-de6611303245", "comment": "Malware payload", "value": "2be3dbc5df39e9f328ec5ddd3fd7f92353bb96e65996f6fc49b02e3327a3e4b7acd7f9921c7b90bd5d0987118fd2b5e3", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614888, "uuid": "c1ba4382-829c-4d6d-afaf-1174cb7d8a93", "value": "C1663381F0928CBAE8F611371AB6D1353A7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614888, "uuid": "77e8c1ca-31a5-4069-bcf8-46266c7f3ac1", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614888, "uuid": "1d17d8cf-36c5-4635-8d1a-d449b0007594", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazV:kfauN/HYOSIT/EVF9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614888, "uuid": "437b51e1-1724-4506-8891-6d0f827c0b7f", "value": 6967139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614888, "uuid": "b18dae0c-2808-40ff-bfb9-4a7bbcfcacd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614888, "uuid": "1b6b0017-d1bf-48a5-b68f-55ec26fec9f1", "value": "8c4b14d6bcc379a8eadff4e90476ff33b6ae0f3da22cb95c47fe1f3203382f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1aad842-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647835, "uuid": "6ce83355-f450-494e-a96b-c34817a668c8", "comment": "Malware payload (Dridex)", "value": "4eecb1dade130bb8e7dc20bb84912747", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647835, "uuid": "1f625daa-c037-4e4b-b9dd-0181ff8f8c50", "comment": "Malware payload (Dridex)", "value": "8d021adf4019e8416971443a0263e07cd0b642307227945bcc1655d32ef9941f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647835, "uuid": "524ecf42-3ff6-4165-a39a-3addc4dbad6d", "comment": "Malware payload (Dridex)", "value": "99c8d9ff689fe4d10d089d477e11c4b43028955d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647835, "uuid": "eb93bc91-cd9a-47b3-b3d9-a13abac32aac", "comment": "Malware payload (Dridex)", "value": "f4793a005a68a5d0dc53af09b978806ee8818340fdafac0cb1249e58ab6c64fd41705bf1195fa41914ff2666a9e48c92", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647835, "uuid": "997014ab-ef30-4c77-820f-359082c52972", "value": "F414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647835, "uuid": "5b82cccf-fefa-41b1-97a1-59befade0712", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647835, "uuid": "ba7865f6-b229-47b0-b0dc-c2f9d6db6c0d", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647835, "uuid": "83df3cbd-fbb9-4a13-b559-7fd8204c1853", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647835, "uuid": "333d68d0-949d-4ef3-9a11-1b31d2322eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647835, "uuid": "848a1005-9918-437a-a337-5712e57293f8", "value": "8d021adf4019e8416971443a0263e07cd0b642307227945bcc1655d32ef9941f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2174ea25-95d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604536, "uuid": "4172c00a-8f69-481c-82dd-d08c0503de5b", "comment": "Malware payload (AgentTesla)", "value": "29bc0daba728fd09457a8447bfcbb210", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604536, "uuid": "dd4e329b-8ee2-48bc-a2e7-f5c446129a24", "comment": "Malware payload (AgentTesla)", "value": "8dd5ff17f444a8642bcd3601849987c6c202eaf344ba4dc606a216adffbdae4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604536, "uuid": "c86420ec-d7c2-4ee9-9dd6-9b5e275a9d53", "comment": "Malware payload (AgentTesla)", "value": "17ef4ea230e302d1de9a320d3a04a915a53087a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604536, "uuid": "a53c6a18-d547-4f72-b980-c41f756b859c", "comment": "Malware payload (AgentTesla)", "value": "cfdade73cc5d576bf35dec2e2fd688356612d89fdcc4e17e5d67676a6a4d74b29b9a8332c2edff97ad9b022042c01655", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604536, "uuid": "8b5f61d0-1fc3-43c5-94c9-3c8154b423cb", "value": "EB25CE0D62885274E8EA1F74182385500737AE0F7D2DE20E6DBDFE5D7F37686821E692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604536, "uuid": "4142d341-5092-4cbf-bbd8-8c0b0e773f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604536, "uuid": "8715ef90-6447-42d2-b500-fda571ee3c95", "value": "24576:OIUcBBOEyYnwUfyLsxDGUC8aOs46FAtwfkjwh5bb:tUcnOEyYnwUfyQxDGUCRh4SrfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604536, "uuid": "5fd853f1-72e2-4f8d-b7aa-b7318efbad8f", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604536, "uuid": "e5eb0fad-0264-4bbe-8113-18ac350bf649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604536, "uuid": "9b4aa1ea-c03e-41ab-83c9-4f9fec028086", "value": "Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f65c68d-95d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617602546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602546, "uuid": "157009d8-e599-46e1-a28e-155c609879b1", "comment": "Malware payload (AsyncRAT)", "value": "57e8b5e2bd6c61904f31d8a99561b715", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602546, "uuid": "9b01f30e-e036-4ef5-8420-f9ded26ed43c", "comment": "Malware payload (AsyncRAT)", "value": "8ddf42fde462ccf9713254a303fe9bfd9b7d912406b8b8ae1b5d603a214f41c0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602546, "uuid": "1d4cab7a-3c17-47f7-a310-cc16a64a55c6", "comment": "Malware payload (AsyncRAT)", "value": "018ae64806a5506bc99850afc64f0783f5a72916", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602546, "uuid": "2d862d84-acdd-44c6-9610-13c0b51cc9cf", "comment": "Malware payload (AsyncRAT)", "value": "bd4e94df81dabe6a5cefb2376789324c417dfb0c02012825d390b537da9e254be7cd9adb2c7df91dde5fd0a0d98b86f8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602546, "uuid": "0807fc0c-b15b-47e3-968c-7b5d847f807e", "value": "A033B3516A018052C4580D318CFD7BB5A36BBC4032F60356B02F6B752BCBE522ECEF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602546, "uuid": "c7d9f4e2-0033-472c-a870-d8fa93b726ad", "value": "24:5Zu8uqu+rqe1u8uqu+++ufyf5Nu10tyQeJeizle:5Zu8uqu+rqmu8uqu++TfyfoQGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617602546, "uuid": "a4417817-4c67-4120-8e16-928c1f8073dd", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617602546, "uuid": "9fae984a-9b02-432a-9a66-ea13e91910f2", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602546, "uuid": "7487a892-7ad9-4798-8ff1-6c3cd769572b", "value": "FK58.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f947ff3-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617604211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604211, "uuid": "afed9fed-5f73-451a-aa24-4f85c0a63dc7", "comment": "Malware payload (Formbook)", "value": "d2897cd33365974e7d482127d3b5278e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604211, "uuid": "f39f03be-6ca2-476d-b058-98cee7c9b113", "comment": "Malware payload (Formbook)", "value": "8edf38667dc2d02d9db491b4fed70fc50fb4e6e1b571bb99dc77b21bc81d1d6a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604211, "uuid": "f0279e77-c5fe-46d1-9600-b6e5f67e0009", "comment": "Malware payload (Formbook)", "value": "d026a9d8b393549565dd0fae6d4b82b8a5a37a9d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604211, "uuid": "0f7e5ab3-9209-42cd-aba1-5df27a2e5a89", "comment": "Malware payload (Formbook)", "value": "ba20b7147746543c3c75739959d6e497fcd2e68378d6c362b1104544f0745300509a5a8a0585bdae9dfcc4dea4518210", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604211, "uuid": "95168333-8a26-41a7-9788-c7116a39fdaf", "value": "76442355D4BDB1A8A5FC124B646CB3E4E806B52FC100672DFD2BDEC82A87949CFE6D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604211, "uuid": "6592afd7-8195-4ec3-a8b5-3e992accf593", "value": "6144:YkadddSXgW8YbbTKnCQ/lD5gsnKOnbLKN0p2ymSIHUS+wg5:YkaddagW8Sb23DnKubOqwymS++5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604211, "uuid": "58cf05e0-d681-4635-8a71-b17d2e9d17d9", "value": 274553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604211, "uuid": "da86c23a-9922-4763-9acc-cca7fa21bc2a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604211, "uuid": "12e3625d-27bf-4614-b8a3-735760dbf59c", "value": "TRANSFER CONFIRMATION_PDF.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436572eb-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617614901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614901, "uuid": "24a00f01-bd81-4232-b44c-adb95f825b2a", "comment": "Malware payload", "value": "16bd24766816c7bbe023ca973451086a", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614901, "uuid": "7c47d167-7f73-4bdf-ae03-a86a3c5a4f39", "comment": "Malware payload", "value": "8f076568aa927a5bad127c8b19c1c703b98bd380fd4120f7b3df69fb8635ea35", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614901, "uuid": "78934c17-2174-4e4c-8767-2840654dd77d", "comment": "Malware payload", "value": "868f6bac846477b0826a13fd7b0f2b5c727943c4", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617614901, "uuid": "5f3a9358-b4bb-42a6-b895-adbd74e5f1cc", "comment": "Malware payload", "value": "952e06b8f1f8eb253809b46a065c8bfaf797177ace4950155560badba7507cbffb2c37ef9dee4db50bd73fef439a5b9d", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614901, "uuid": "9153653b-fc94-4eea-a9ad-4de294bbb486", "value": "5B663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614901, "uuid": "2427c6cb-b112-4d05-8684-34609434264a", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614901, "uuid": "4acdb486-b883-4153-9761-c17b7e51efa8", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazc:kfauN/HYOSIT/EVF9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617614901, "uuid": "4a282b2b-2fb1-476e-a74d-aa6c1f815913", "value": 6967254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617614901, "uuid": "917ce365-640c-4582-8be4-e40fa2879467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617614901, "uuid": "bca672c0-0e6e-473c-861d-d92d451e32d6", "value": "8f076568aa927a5bad127c8b19c1c703b98bd380fd4120f7b3df69fb8635ea35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7d5775-9626-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617637681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637681, "uuid": "f4d06a54-3c87-45b3-a544-0e6698c54777", "comment": "Malware payload (IcedID)", "value": "4a97692d74dd808278654e136c552bcf", "object_relation": "md5", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637681, "uuid": "41a7d8df-31d8-42ac-b6da-86bf8a449d2c", "comment": "Malware payload (IcedID)", "value": "8f170caa9af89412838feb0bf5db5b13e108fe8317c9cde284788552003161a5", "object_relation": "sha256", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637681, "uuid": "3e017d2c-6173-497a-b774-b3143e9dc52f", "comment": "Malware payload (IcedID)", "value": "4c215ceff1090f5407184d8a590f5b51f2e44e77", "object_relation": "sha1", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637681, "uuid": "cc1271cf-d4cc-4ef9-aa8e-bb2804cd3d51", "comment": "Malware payload (IcedID)", "value": "2bb12acb8faece68acf63d0a950d856f9a81f53d894f8b9916bf55aa63745fca7de2ba42e48fef6171943f05c5e1fba1", "object_relation": "sha3-384", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637681, "uuid": "468e6f5d-845e-4fac-b646-eec5500d335b", "value": "C604127CE4AA0D9150D81077AD78D109EC722126BEFC9ABEB6583958F9622F31D73F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637681, "uuid": "a854b751-e90c-4fe8-bbb6-a3816af6bd77", "value": "3072:EHP59bYDEdZY4yvqCilynhVx12A7bJ8mBc/wKw5ZkiEZTcDqU2nE:g5GD9blqybbjD1ZaZQDfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617637681, "uuid": "d4466e71-aacb-4f9a-a378-53fbacb95c16", "value": 174604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617637681, "uuid": "f251c8d5-097f-4bcd-8f2a-ee97ceec1d35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637681, "uuid": "b5b1e191-6d7d-4580-8916-c95905decd42", "value": "Contract_1836733707.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d84d69-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617643812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643812, "uuid": "92f5119a-aece-42e4-bd98-18f5e2bc3e07", "comment": "Malware payload (Dridex)", "value": "105f6f60bff03c3705c287e98f6a490c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643812, "uuid": "15e3d3aa-3aa5-4dc6-84a8-2491b68efa3d", "comment": "Malware payload (Dridex)", "value": "8f29eb1623e9805210db58460e05962d70de5b4fe754804ad95cf935331461cc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643812, "uuid": "5ea2687f-2d24-4132-a884-f70d5b61d89c", "comment": "Malware payload (Dridex)", "value": "bf2bb7a9dc9e972017f316db8f856867b7bcf330", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643812, "uuid": "0a08fe12-31a0-4561-b844-721e82c80d6c", "comment": "Malware payload (Dridex)", "value": "088b4ee3bd3619005eef894810652dd2853a22b7ad3823e3fac6bcf599b3647af302e7b6606eef775019518e1f237829", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643812, "uuid": "55f8b5eb-673f-4f13-974d-bd22e20fb874", "value": "405412D8D3F19AC8D772217F638E50E138A8B497539415DE0682BB956B0283707EF62F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643812, "uuid": "7f292f19-f0ce-4dc8-bb05-077b180d8e48", "value": "6144:6njAdUfjr/LzIXdSC5w+6cydsT0qBLLgUXFWINXCkv68nrVI:cGUff//Ittt6cysLZwQdr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643812, "uuid": "e1a63dcb-a47d-45ea-a715-6ec07208ca07", "value": 287334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643812, "uuid": "b15a7546-845f-4976-b793-149be1ae79cf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643812, "uuid": "588a6abb-146b-4239-8430-a160c0e76f61", "value": "Reports-018315.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16776521-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649615, "uuid": "2f6bb56c-f795-41e5-95be-39dbcadf3309", "comment": "Malware payload (Dridex)", "value": "86705631950d872dd86cf2a12527735e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649615, "uuid": "0e1ec487-e50a-4601-8eb6-a5dfb260b939", "comment": "Malware payload (Dridex)", "value": "901f5f28f0bf1a68252641f30aa8ea2be992c0bf09c5ead90b77884c3130d7a6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649615, "uuid": "e37a1f06-3017-4b51-8212-061b09427a5a", "comment": "Malware payload (Dridex)", "value": "32154b4f390847410cd2d4e551a37ab08b75abc0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649615, "uuid": "7c5346de-6381-4342-bddd-0fae38dee28c", "comment": "Malware payload (Dridex)", "value": "7a59824d0b0c03bd780a0aa654db756a9f6324901ba0076fe426ffd7c4a04fad9705d3faa321ed6979ee67063b7be43a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649615, "uuid": "54ab2aa0-08b3-4ef5-9a1e-9ab7a8bfe456", "value": "D014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649615, "uuid": "8842c7f8-08c6-4fc1-8957-021cb9814885", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649615, "uuid": "269161e9-ef97-4dce-b6c2-f5909d5aba3d", "value": "3072:hBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:hBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649615, "uuid": "aeeac447-16bd-4287-b80a-254e27953417", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649615, "uuid": "a1aacf0d-fc28-47a7-b7c6-0a3ee8092e39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649615, "uuid": "0c4df26b-8607-47ad-a5db-ea8b8f2b4884", "value": "901f5f28f0bf1a68252641f30aa8ea2be992c0bf09c5ead90b77884c3130d7a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ef120a-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649745, "uuid": "8234850a-b0a4-4be1-96d4-5ebbcb1bec37", "comment": "Malware payload (Dridex)", "value": "35bb9d419422bc2d614e223e1ec0539c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649745, "uuid": "b06173e1-c922-415a-b307-130cf3c03e8d", "comment": "Malware payload (Dridex)", "value": "902b7f6991fac84f2fbe2156c98d347d3cbe0d804302863a2de503be52789145", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649745, "uuid": "d1ab439a-674d-4935-b910-11527fea7052", "comment": "Malware payload (Dridex)", "value": "e7705fe1566d9636f5c38e8f157879d84ab000c8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649745, "uuid": "53d9d6b2-bd8c-40db-a2d6-100aaeea704b", "comment": "Malware payload (Dridex)", "value": "6d8d27fd4c6a64f283a7ec9cb600b4a3b3d7d81614856243e329b78447ec4bef73d5a575a2eb5419d6142579f5353309", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649745, "uuid": "7ee9317c-0144-4eaa-bfa7-0f55cc00146e", "value": "3814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649745, "uuid": "e809cf17-8ad1-44fa-a7db-d3f875d370ff", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649745, "uuid": "6d13732c-662b-4a48-bd8e-78a8031b6604", "value": "3072:qBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:qBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649745, "uuid": "4d0355a1-9eac-42bb-bd51-8fa266050aa0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649745, "uuid": "2d456d96-ed18-443d-ac8b-ded73a55f2ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649745, "uuid": "ef75231b-168f-43af-a628-f4265ca9583c", "value": "902b7f6991fac84f2fbe2156c98d347d3cbe0d804302863a2de503be52789145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8096e37-9640-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649134, "uuid": "9c2e7f4c-217d-4a23-a4a2-500c7e9e522d", "comment": "Malware payload (Dridex)", "value": "c0a81ec2db1480a8dd4ee810d0cba22b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649134, "uuid": "e30a2149-916f-41c6-8e3c-221a7b641e0b", "comment": "Malware payload (Dridex)", "value": "9085c308e994e9c5d01817c59aede0c218e20750ef072f804ec5c449eec1c3ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649134, "uuid": "613ceafe-36ac-4eb5-ad74-a76971531943", "comment": "Malware payload (Dridex)", "value": "31cf65d3d903d1d0d0a8ad75375285e857f529d2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649134, "uuid": "4d1f0343-eb59-4bf7-b603-f0176d813266", "comment": "Malware payload (Dridex)", "value": "e3ffd998c22541ad95566371a681c7db207a8faa1fa1a7172a51526dd914630797fcb11e7db0800a8237107b3175cb61", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649134, "uuid": "8912b6ec-be6c-4335-b832-b0feffe434c8", "value": "3C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649134, "uuid": "4d1bfbfe-c5f9-4f47-9a6b-a2eca157ae82", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649134, "uuid": "02e5f2e8-c0cb-4744-94cc-ac57c01aaabc", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649134, "uuid": "971250ef-5cd7-442c-97fa-4bce0e331701", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649134, "uuid": "1769139d-20a4-4652-a0a1-9335edef2a7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649134, "uuid": "d62289b1-1146-4407-af0f-ed1a9ee28503", "value": "9085c308e994e9c5d01817c59aede0c218e20750ef072f804ec5c449eec1c3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cd71ad-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644493, "uuid": "83dc715d-8e6a-438e-be6f-b4662d119d8a", "comment": "Malware payload (Dridex)", "value": "5ab32bbee0ce9e4e06e85b798f1728d4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644493, "uuid": "c84d0a70-712d-4c0a-b852-a42bc27770f9", "comment": "Malware payload (Dridex)", "value": "90a54efe0215a02023c1ff5d2cf83c4bc9d54e138dde86c29e45c9a4209e0f02", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644493, "uuid": "e843770e-bf7e-42fb-8be0-4d8049c9ee1a", "comment": "Malware payload (Dridex)", "value": "9008f73c93c1deabfbfc7dc5b27ab0dc5acd2ceb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644493, "uuid": "569edaf6-1607-4b00-83e8-a1787c44ba24", "comment": "Malware payload (Dridex)", "value": "a50e197179dd3c935ee09d12df5a48953cf7c4e412485ffe756472ce43c007c8cf1c0e390c224b0b03ba193d59468329", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644493, "uuid": "160b568b-96a0-4a31-8aff-035618918711", "value": "0A14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644493, "uuid": "3d7dc3fc-22a3-491d-9d42-094c3c159e7a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644493, "uuid": "d51f90e7-ba0f-496e-8514-48e595a1d45b", "value": "3072:SBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:SBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644493, "uuid": "e268c8a4-65a1-4bb9-9817-e2903062e1e1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644493, "uuid": "30f17d9b-79f9-449f-998d-439d8b6130be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644493, "uuid": "2a6d7c26-ab4b-4727-85b8-9fb2248e6d42", "value": "90a54efe0215a02023c1ff5d2cf83c4bc9d54e138dde86c29e45c9a4209e0f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbde435-9628-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617638618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638618, "uuid": "72336541-feb9-4cf9-b236-9e9a3c169695", "comment": "Malware payload", "value": "ee724c5b1fa0442a5864d8723e0c2cc7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638618, "uuid": "69f503dc-6c1c-461d-b82b-066a915e1d34", "comment": "Malware payload", "value": "9129ca48bfad8caaa1bd714b0b882d1e938fd69e50efbb1cff9a533617b6d7f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638618, "uuid": "8fb34de1-9e2b-4dfd-826a-c1e3c9182428", "comment": "Malware payload", "value": "8250586072cda2356ee9d2b2c1dda52e1394b18c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617638618, "uuid": "fbe240b9-46ad-48b2-b47b-b3657f98b45f", "comment": "Malware payload", "value": "e07a981347ffb671635c846076ab4bced273b6bcc9428a62155cd4104dd71d34f3bd4f9662cf8d1bdff37a854286d421", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617638618, "uuid": "ba637fa8-6ff2-47b4-9a81-354aeb34092f", "value": "D63633663F87048AF1500F7499A8D13616358DDEEC09D63A88DA1C9732EFDD8BC436B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617638618, "uuid": "40f60102-6b27-4bed-9c53-c236a6c5a21f", "value": "09b35babd8dc8ad597fb9662f7f7b8be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617638618, "uuid": "6cabdfa4-c939-4a25-a787-639c8a3b3d43", "value": "98304:ALXbkkxpU+Azq+HIB5qRaEAiRhLiiIivkLS9wqzIdzjwxN6I:YX4kxpzLqwiXLiiRvkm9pI55I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617638618, "uuid": "5366d7a7-c1e8-4852-a712-468bf121e786", "value": 4925208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617638618, "uuid": "2d996fcd-d8e6-410b-8db3-e9cae7d6370a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617638618, "uuid": "2d00d914-c4e7-4ce5-b97a-2fd01658f7a3", "value": "WarMine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb45219-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617627426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627426, "uuid": "bb02500b-fc98-4c00-8fa3-6451fba0bc25", "comment": "Malware payload (RaccoonStealer)", "value": "1a62c01ff46ede5db0314deaeb974b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627426, "uuid": "dd7ad991-23f6-486b-a6f2-e24c1edb1050", "comment": "Malware payload (RaccoonStealer)", "value": "9285a4e08b654a24a9e3f7f6d46b27203a48ae623ebfd1a4b1fc1e18ad9a1503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627426, "uuid": "aeaa908c-1212-49ed-b673-f57b3fae3e64", "comment": "Malware payload (RaccoonStealer)", "value": "639abe3b6d78cfd13d00a5e915ac07909d677711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627426, "uuid": "dfe85c6d-8b0b-4d49-8b9d-20ac3e1dd3bd", "comment": "Malware payload (RaccoonStealer)", "value": "c5e476391aa86ae2e6c780565568d87fc05ba5cef03bde7240b4924fb7fd50207cf96c7f61e294fae93a7b64859906c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627426, "uuid": "58173e95-b739-4994-9c7b-0ce45aaeec13", "value": "6CC4F01132E0C072D1E625B55624C7F04E7B79721B659ACFBBD81ABA1F207D1EB3930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627426, "uuid": "78008e9c-59a4-4dbd-914d-6dc1201188e7", "value": "757fe3cc049352cdae367297a43bdc84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627426, "uuid": "336a8fc0-b1b0-4e93-b001-aa4c53563771", "value": "12288:nVp6pckUvlv85nfK1Li7JlwrNcLiMek+g7gQq7m26he9ZHa:fYckOMnfK1Li7JoyP+g3q7m2ye9ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627426, "uuid": "01aea7ac-1737-47e8-a8d3-514cc4b18299", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627426, "uuid": "bf92429e-9c0f-46df-81cf-c9fda5660e8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627426, "uuid": "cfe96f58-0c60-4653-a6aa-2c3995ba0df7", "value": "1a62c01ff46ede5db0314deaeb974b17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c256a7-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647943, "uuid": "57a536bd-6c95-454c-ace7-a83b601aa66b", "comment": "Malware payload (Dridex)", "value": "d3460787b503c79066311d31b992bb13", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647943, "uuid": "02e315cf-9181-458f-b5b6-d66fdda3e7cc", "comment": "Malware payload (Dridex)", "value": "929bfdc02cdeb8fe232cf3ab908baee59b9ec84c899668d90fd9b6dca48822bf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647943, "uuid": "33bdb80c-c6d4-427b-966e-d58138dd9c26", "comment": "Malware payload (Dridex)", "value": "b0f30e4284b4b2497f31eafd8ade1a92dda1e12f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647943, "uuid": "7d129f78-9918-48af-a73b-f0b22d859d83", "comment": "Malware payload (Dridex)", "value": "0024cbaa1f5bb43f53fce7067024835e7369c558c561476f8b3f68da450322d1b24831a84e5ff70a11a6de73de0d4145", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647943, "uuid": "ab9b26c4-1360-48de-973f-0d8aa9e4a01f", "value": "7814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647943, "uuid": "81a79df8-eb3a-42ba-a895-e6861e91938f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647943, "uuid": "2df9fc03-2af7-463a-bd56-17308054b581", "value": "3072:eBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:eBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647943, "uuid": "beaae6a9-1353-4170-8514-cb560b865f60", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647943, "uuid": "cb4b9c80-2bde-4490-b9a4-57a9ed1d782f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647943, "uuid": "a533cf8b-53cc-45dd-9d9d-a463ee8d9cbf", "value": "929bfdc02cdeb8fe232cf3ab908baee59b9ec84c899668d90fd9b6dca48822bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00db2837-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617647861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647861, "uuid": "c8c687df-644f-4c7d-88bd-b1606b49a5f0", "comment": "Malware payload", "value": "c07cf81c972811cd7f110aaec87d3475", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647861, "uuid": "7a86c1c0-75d2-4ab7-8c22-a8b1f6ce6644", "comment": "Malware payload", "value": "92b337d7f5572a1444d747650b856a632060206135b5a1f0b2ca7b49c34cc475", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647861, "uuid": "9046b174-f147-45d5-bde3-55fb62a3fd03", "comment": "Malware payload", "value": "44de1dc7ab588b36867ca42f152bd951a3946288", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647861, "uuid": "75ce7e3f-8024-44cd-9770-e466e3675fc0", "comment": "Malware payload", "value": "4671d53796f0bae3402da19977a6b55fd1e334deed939a25660b566dde70f1faea7ff972d2e12bd33c88aab065fe1c70", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647861, "uuid": "ca5a8a1b-489e-4034-85ba-0ecf6546ae93", "value": "CD14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647861, "uuid": "98181cd0-a22c-4f28-8714-741ace695001", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647861, "uuid": "823bf7df-29ab-435c-96fb-883b82644e79", "value": "3072:nBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:nBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647861, "uuid": "25caabc7-0d59-464b-808a-54f22a28091a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647861, "uuid": "96b621fc-0982-4e96-a17b-4f3c429a466e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647861, "uuid": "03ed06db-1279-4237-bc35-d99fe802eb19", "value": "92b337d7f5572a1444d747650b856a632060206135b5a1f0b2ca7b49c34cc475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4e8b96-964d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617654614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654614, "uuid": "0f006575-d8d0-46b3-a243-41ce25e999b9", "comment": "Malware payload", "value": "03341f15fc24e54b9537df6d174fa7d1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654614, "uuid": "cbc1f9a9-9e45-4caa-9ce8-fcdd651d6e29", "comment": "Malware payload", "value": "933b569e966981a454291f99ae3d3939d5696b083cdee3b050494087809af06c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654614, "uuid": "d1014016-5b4e-4897-8b72-621256bb4eab", "comment": "Malware payload", "value": "c523d594c5913b7cfe247c598f0c822aa594704f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654614, "uuid": "5d0b550f-3b69-409b-b424-7344d14f6bca", "comment": "Malware payload", "value": "27e5dff1ebd8af821cf4d3b443f1f46c7a8e92192fb908033a309d15dc88b59a2d7d2fe3ea6683c2914f57cb97d6f82c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654614, "uuid": "54cfc733-0459-4e7a-94b8-93dfabb73e31", "value": "A214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654614, "uuid": "2348d2d9-131d-4de8-891d-0f567245d5c8", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654614, "uuid": "89622342-c9c5-4a2b-9300-14ddf50d9009", "value": "3072:xBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:xBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654614, "uuid": "4c160cb9-bc20-456b-a746-1f5f9641009b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654614, "uuid": "3ac513f1-24c8-4403-816d-60befad30f62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654614, "uuid": "fa50452f-e403-48fd-84b9-56104a4d8635", "value": "933b569e966981a454291f99ae3d3939d5696b083cdee3b050494087809af06c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e45911-9664-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617664331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664331, "uuid": "e365b59f-fa8f-4bf5-9230-7d7ba89227b1", "comment": "Malware payload", "value": "6c41f95bfd8e02547a1ffb03cd1c9b8f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664331, "uuid": "6d89ef41-03bd-445e-bfb9-3f7aabb3f396", "comment": "Malware payload", "value": "93886a367d20c491cb8c93e6a2a7127ce825320998ce72d2372d042790478f79", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664331, "uuid": "0b19fcbd-ef60-416e-99db-7ce9880faaf1", "comment": "Malware payload", "value": "d19cbd895bdd03a85fc5f76b3c82db07ce972f44", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664331, "uuid": "2edd894b-5bf9-4ff2-ac97-91f0f914872b", "comment": "Malware payload", "value": "3c5be4ca4b1d3d63ac21956979a802f7b1f2c0507a4185a1d70842031f147f78f11b215c1cbb460ad1c4f2ad4abda2ea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664331, "uuid": "413327f2-93a7-43f9-a5ec-3890b748b0be", "value": "3A14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664331, "uuid": "94a185e6-dce1-4576-b400-bb47a0a95931", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664331, "uuid": "8d30de3b-c187-473e-9cae-ee55c7a2520f", "value": "3072:MBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:MBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617664331, "uuid": "e50d5529-1dea-49c5-8a22-d601b2fe6876", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617664331, "uuid": "bd711e5c-acc4-42f8-9613-eefb088dd41a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664331, "uuid": "ef2a2573-36ba-4c11-ab6e-d89f04c0a41b", "value": "93886a367d20c491cb8c93e6a2a7127ce825320998ce72d2372d042790478f79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c719075-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649705, "uuid": "e136c679-ee07-4fc1-9161-47f4d3ecb2f5", "comment": "Malware payload (Dridex)", "value": "9e4fc5bab2ca9141df84b7d350265771", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649705, "uuid": "45f7d295-7dd4-4d28-b654-7dd4eff5a6c4", "comment": "Malware payload (Dridex)", "value": "952a69b42e2da6d9b12fd948440506fa89a9417cde82505dc5a2b300bafd0b9c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649705, "uuid": "66bd0dfa-094c-49db-af0d-c76e98968dee", "comment": "Malware payload (Dridex)", "value": "f589b0a01ec49cb242236665b368d5335f576fb9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649705, "uuid": "5f6b24a6-cf78-463d-beba-77e2c5ac5b23", "comment": "Malware payload (Dridex)", "value": "ed390c5af91ede021121858acf70346b081a5d7f2b2af97f47289857148fdd2e1246c0af5358755c324ce362b0e1aabe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649705, "uuid": "4b2fb0f8-de05-48bb-a126-71603e1b3dca", "value": "0F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649705, "uuid": "4518facf-963f-4310-8d28-c34ad2d63827", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649705, "uuid": "be5e4b37-abb0-40bd-9188-466c088a2412", "value": "3072:RBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:RBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649705, "uuid": "aae96608-8be4-4e0a-b688-d2f07341403b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649705, "uuid": "b4bdeddc-bda8-4e18-ba60-0732e38ded9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649705, "uuid": "54d1fd41-fc74-477c-85b2-a2610043cdad", "value": "952a69b42e2da6d9b12fd948440506fa89a9417cde82505dc5a2b300bafd0b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290fba63-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650076, "uuid": "0efc1c25-7e6b-4849-9dc9-f2cad95c7677", "comment": "Malware payload (Dridex)", "value": "7d8014ade5f111bb11280515adbb984d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650076, "uuid": "2bfd86da-9da2-42de-9c11-1184bda06d90", "comment": "Malware payload (Dridex)", "value": "95a07aeecf955667b0fb345edc208a527e3def3fab4448e641fb0a1878bef07f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650076, "uuid": "882ed117-dbd7-4577-a2c9-573942b59258", "comment": "Malware payload (Dridex)", "value": "65326e99e2fdfb3859d47bd7e5812baf479e54d4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650076, "uuid": "e84b2f44-90ee-4a00-bf59-34b2bf09cc21", "comment": "Malware payload (Dridex)", "value": "11a33855fc997f3ccf8f6f2a1cdd4479f26b219abe867c761d146c629683a68948afeeea86bceff87aad1acdd4c2b30a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650076, "uuid": "cf408cce-6d24-48f6-ba32-8b40af7d2644", "value": "F014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650076, "uuid": "b360e7a6-a2b4-4f41-8505-3369d7f7d713", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650076, "uuid": "c781a75c-68e0-425d-8f60-c90be13577fb", "value": "3072:GBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:GBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650076, "uuid": "60dfc22e-e566-46d3-abcf-dea937e93f0f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650076, "uuid": "fb90ba1c-7bcf-4bb7-af96-b6ba994cc615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650076, "uuid": "f25d3b52-b9d8-4eeb-91ab-7117c43f8c66", "value": "95a07aeecf955667b0fb345edc208a527e3def3fab4448e641fb0a1878bef07f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda2c979-961a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617632769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632769, "uuid": "e105b61d-90ea-4322-9a7b-587261f47850", "comment": "Malware payload (Vjw0rm)", "value": "2f61bc230d26d4d859eba0dbce48017a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632769, "uuid": "8f27cfa8-15c8-432f-8053-81fffa842217", "comment": "Malware payload (Vjw0rm)", "value": "95a9a156f90360d08a2dab95b21a77bdc614ae73035026aac8993b9b46ae521a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632769, "uuid": "f9a8685d-d507-47a9-8a21-2a9296cb765b", "comment": "Malware payload (Vjw0rm)", "value": "a36db7281117c9e25ccdef23274ab2a27eb561b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632769, "uuid": "36d30f48-faa4-4514-b30c-d19c89bf9cb9", "comment": "Malware payload (Vjw0rm)", "value": "c5d8c704734e7795a72118bb1308e86937ede43fc24bc03418599b9d847ded53930b62c3782c40085243d2c134cc48f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632769, "uuid": "5523bfcc-49bc-42d7-abf7-c2b4f2a8cc12", "value": "14A3B6FCF1050F26D392615C89DE0A1873B3E362F5E9DF05666C2609C1DE92B538AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632769, "uuid": "3435a2ca-3be9-43db-ae23-5fe7bcdd5374", "value": "192:k6kn9EtHXq4kG1luzi75WbAZviG1hdh12cB5kw94tMa3dZYkVdPrv1kcpuIVLk5Q:Cn9Lz5K64y24jHudqWWXKSqm2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632769, "uuid": "d3091cc3-3789-42b7-bc5f-fda5e84715ff", "value": 105338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632769, "uuid": "69da8d12-9c4a-42d7-a747-69cff117ea24", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632769, "uuid": "e8bea9d9-175b-4aed-9077-a0224793fcd7", "value": "odk_Order_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f79fd4-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650357, "uuid": "51eb1b29-1e31-4345-af52-b8663af1fe74", "comment": "Malware payload (Dridex)", "value": "26a9de12d2a97263fc77161363042947", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650357, "uuid": "3738eb66-64a5-4092-907a-59cbe267dd84", "comment": "Malware payload (Dridex)", "value": "9682450b1f678196bdedeb0178e59101276146500b96bcf848ab71f9033786d8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650357, "uuid": "01bd76a5-8438-42a5-aa76-85bdb26213dd", "comment": "Malware payload (Dridex)", "value": "7772d7dbba9801c26dc86077d162bd4332af9f0e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650357, "uuid": "17233ac3-7a3f-463d-98bb-974a2a814ac1", "comment": "Malware payload (Dridex)", "value": "005fde004624271cbad1acfd557c9cf2f8ff7ef673305ecf5dc17c460f3f01b6b624b07801de03c24ee75cff64e35476", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650357, "uuid": "7308c76d-c932-4cc4-856f-666e7462c1c8", "value": "7F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650357, "uuid": "d2996a3c-1c21-4274-969b-b95b5326e1a2", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650357, "uuid": "e1c1f452-9f86-45d3-b658-e346f0664e86", "value": "3072:lBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:lBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650357, "uuid": "00ab3059-0db8-470b-ac41-abc42fb7d4b2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650357, "uuid": "3afa0a63-e27f-4daa-bb3f-75b7e2f0a389", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650357, "uuid": "c861c12f-ed3d-4519-95e0-8f3125fae1a7", "value": "9682450b1f678196bdedeb0178e59101276146500b96bcf848ab71f9033786d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b856a1eb-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649886, "uuid": "dbb3d387-d351-4e49-ab6a-9cd3e38d79ac", "comment": "Malware payload (Dridex)", "value": "038c6f8d29ca93af773890b4e54d63b6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649886, "uuid": "80c76a88-e82c-42ea-b174-3ddfdfe69eeb", "comment": "Malware payload (Dridex)", "value": "96a1cd40bec1ecb2ac2da993c50df02b6b7c57960b15be18f6f7ea1de38396d4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649886, "uuid": "db5fe9c8-c9b3-4ee0-904a-e4c5f8f922f4", "comment": "Malware payload (Dridex)", "value": "3ef98f6d82833c636b2f1f07d78282abbd7c2579", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649886, "uuid": "793abd19-eff0-429e-ab08-4498edae840e", "comment": "Malware payload (Dridex)", "value": "3b8186837c5e2f715f680104f99c64c0189c78d599d461be123eee34439d444b2c315718f1eb0dae5f7e389439364d31", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649886, "uuid": "e9082398-86cb-4611-a106-d3f60eda1521", "value": "C214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649886, "uuid": "7188d34e-da58-434a-ad0e-0df5c822f919", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649886, "uuid": "f3a7a610-231a-4571-955d-1b2dc0288208", "value": "3072:9BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:9BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649886, "uuid": "2b372df7-53b0-4044-b90c-5d8bde8834de", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649886, "uuid": "dac7bf92-2897-4492-aec2-7605b3abf2b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649886, "uuid": "26f302cc-7e44-4e80-a92a-d949fb20b176", "value": "96a1cd40bec1ecb2ac2da993c50df02b6b7c57960b15be18f6f7ea1de38396d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0dfca1-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "faeb85aa-abb2-4f30-bac6-04d6dbfe6ee7", "comment": "Malware payload (Dridex)", "value": "c9fbb95f953529e3c664fe3a4224285d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "3a4f52e7-15a8-4a70-97c9-01b4885d71d7", "comment": "Malware payload (Dridex)", "value": "96aecd691bbf5a6f3511c9390a64a100290d660850efc294b80dae4eab469215", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "711704f2-b2bc-464d-9de8-f21ecc48a510", "comment": "Malware payload (Dridex)", "value": "a14cd47f0347c6a35d7eee0ba500c7d730237ccc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647883, "uuid": "e0023e77-f5c3-4ee6-bcd1-d891b243f54e", "comment": "Malware payload (Dridex)", "value": "74673e4103f985e64d26e35baca720b6a9521ba02e0a73a5796bf137be35ca258691d9d5b150f6f7cc6150544521f029", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "c13b66e5-16b0-4c9b-8757-6b4e2e0dbf91", "value": "EB14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "436bb17f-4117-42b6-9b3f-2d9284e17c4b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "e58c026c-e6b8-4a56-82fc-b17d142eef13", "value": "3072:2BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:2BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647883, "uuid": "fb9701b8-f429-4627-a620-aae3de5267a8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647883, "uuid": "953c6dcb-c5a5-4297-9516-e54a531a39be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647883, "uuid": "81ffeb37-6ff2-4840-afa1-0293c8f7531a", "value": "96aecd691bbf5a6f3511c9390a64a100290d660850efc294b80dae4eab469215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d27f58-95a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZeuS)", "timestamp": 1617583960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617583960, "uuid": "ac9bc704-853b-42c8-b1d4-41e21aa7887d", "comment": "Malware payload (ZeuS)", "value": "ba28a06e2aae1052319541d4124122c5", "object_relation": "md5", "Tag": [ { "name": "uncategorized", "colour": "#6D83D2", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617583960, "uuid": "e68aadf2-86f1-4643-b8db-8b941e642a9d", "comment": "Malware payload (ZeuS)", "value": "9738c7021fdded8bb03e1588d17386dc175328630ecb0f1a3d671dfc4fb18d46", "object_relation": "sha256", "Tag": [ { "name": "uncategorized", "colour": "#6D83D2", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617583960, "uuid": "30e7a308-a317-4b51-bc05-f84dbf35fde3", "comment": "Malware payload (ZeuS)", "value": "20613e49ee5b14dc04c7b045900f1d0e1b4173be", "object_relation": "sha1", "Tag": [ { "name": "uncategorized", "colour": "#6D83D2", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617583960, "uuid": "7748e79e-b2a5-445f-9633-4341a192d7f9", "comment": "Malware payload (ZeuS)", "value": "2083d8697ca6211bebeec5f53cacfa0690df2986de8a4c45f0e22da17cb30972b1c8ae7cc89ed42ae166ce65a490b2b2", "object_relation": "sha3-384", "Tag": [ { "name": "uncategorized", "colour": "#6D83D2", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617583960, "uuid": "83c93861-5ea0-4383-abb7-eebfd961d15e", "value": "2444127278C4AAC3C1D0DAB85A788F72BB49C70ED92E09CB3615590216F062C5FD5F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617583960, "uuid": "cf849bbe-4764-45a0-ba06-7dfa4f777e4b", "value": "92644df84cdbba7637462c128671f148", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617583960, "uuid": "2e7aa725-6ec9-40a4-b929-7c0580b25c57", "value": "3072:q4ep6/R4I4NdnFubGtt89Z0pVaCv86giQvBjR4DtHuLUGbcQTaQQ0tQPUy8xVFQR:qmGfubsi0pVaDL4B0bcQTXJxVsGhxMI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617583960, "uuid": "9ecf8934-b262-4437-9ce2-a4b75e60993e", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617583960, "uuid": "cefcd821-e2b3-4ecf-89fc-94aa769bbc0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617583960, "uuid": "827eb401-76c8-4621-a5b0-5d6b3ae31681", "value": "9738c7021fdded8bb03e1588d17386dc175328630ecb0f1a3d671dfc4fb18d46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65245476-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644593, "uuid": "028f4e06-d498-4578-a1b7-60c2f5fc9728", "comment": "Malware payload (Dridex)", "value": "3886fb99653030984b1298c3038316f2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644593, "uuid": "35977931-bbb5-4a2e-aa38-e3d886b056ff", "comment": "Malware payload (Dridex)", "value": "9752a86ad748de535a982731edc839360d9d82bbfe58c103d6c82935d88b3448", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644593, "uuid": "543a32cc-7aab-4956-b7c8-2a08ade8217c", "comment": "Malware payload (Dridex)", "value": "1890a5e741c9361961ce9b0211fc701720dd0d5b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644593, "uuid": "f731c481-d1b8-4251-b035-e663de255dfe", "comment": "Malware payload (Dridex)", "value": "a6c775a54079efd1102759464e45886c0d4eb226ecb3489e058c29a85de2f451d606e3b0594315c50b99f0ac710069da", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644593, "uuid": "5d1dd274-9487-4a7f-99b4-437873b51d76", "value": "6214AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644593, "uuid": "7ffbbae8-775c-4576-82dc-b9521e9ae77b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644593, "uuid": "33b9a1da-9ac1-4a2b-8ea2-9dd111335c7b", "value": "3072:uBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:uBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644593, "uuid": "09c623f6-828a-4994-bda8-c2d53972108a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644593, "uuid": "80d4df87-44ce-4623-9568-be8beb1b181b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644593, "uuid": "b261ec96-3f4d-46b1-8e4a-5b888400964d", "value": "9752a86ad748de535a982731edc839360d9d82bbfe58c103d6c82935d88b3448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd29f8f3-95ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617598355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598355, "uuid": "f705c513-1cf0-4104-b4c7-201c9df42bd1", "comment": "Malware payload (Dridex)", "value": "9f45ca6529426b0e47232816139c5403", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598355, "uuid": "fce3be77-f753-4d23-bf43-f426dc4aac7c", "comment": "Malware payload (Dridex)", "value": "985f7910c537fe9ef8070fcc56ed4205b53b2a10dfeddea8eb53c2d82c487cc0", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598355, "uuid": "a114aa85-36bc-4bb0-aa0e-e30144138887", "comment": "Malware payload (Dridex)", "value": "06293b04d39d4e68b334819a81900bc13d8935e2", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598355, "uuid": "6a26c9e5-9872-4e75-a75b-266378d64c6f", "comment": "Malware payload (Dridex)", "value": "30ac38a82a459902c64b597e95cac3322847535b87df4d9b80ac0d77b8ba0bd5b9d634cb45c985779597ec9d2e93e71b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598355, "uuid": "c2d24102-6fb0-4075-a3ef-cff0c578b8fa", "value": "14058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598355, "uuid": "33ea05e2-896e-40f0-a755-711804818061", "value": "523b18dc1c7a7f2ecc8f20b6295beddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598355, "uuid": "36fd7136-4119-4463-a5a3-d9476b1f09b4", "value": "12288:HbqkjZV1Vu8MpJYosZUmc16RWdrJo8+FFcLxT8HoxmRsDJteMKT281MOU7qOkQR1:HbqkjZVqxYjxogrwQobmMKNiOUFkK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617598355, "uuid": "604679a3-2cfb-451b-bc84-b51d896ced53", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617598355, "uuid": "a43802f2-eda5-4aee-a80f-5951aff1231e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598355, "uuid": "45f4b697-e7e8-402e-b4b2-eec00e368693", "value": "985f7910c537fe9ef8070fcc56ed4205b53b2a10dfeddea8eb53c2d82c487cc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1218d7f8-960d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617626844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617626844, "uuid": "eb2f2c34-57da-4eb2-8088-a8b6255ea257", "comment": "Malware payload (AgentTesla)", "value": "ed676169811c08e60a154da40fd915db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617626844, "uuid": "a63ddf34-eff5-4295-a979-36cef66da2e3", "comment": "Malware payload (AgentTesla)", "value": "9863d85fe69d5b6a6dc3773b94f9f56cd836f78b9cee4e1d28d8fdb2a5a42f2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617626844, "uuid": "0488fade-169d-4c32-9e8c-352ce2e6faf5", "comment": "Malware payload (AgentTesla)", "value": "018fb0a97399904d7161cd774888e786a25d1087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617626844, "uuid": "623081f5-b889-427e-9588-3aa330364744", "comment": "Malware payload (AgentTesla)", "value": "bcfcfefdfac942421068c32fd21e5ad82f95fd13e216e78ca8cd97e3853f77b9bb425fe49759b48d46c97b791c74b093", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617626844, "uuid": "976334d5-fab5-4c87-b21e-bd3d0d5dfd37", "value": "E425AC006E8472DCF85A1A371C234450027EAE316DFDE61F69B9737B3E726968E316D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617626844, "uuid": "42710c74-0778-4e47-bb4a-0517e678580e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617626844, "uuid": "f6af42fc-3588-435e-9d21-3ed7089f873e", "value": "24576:6MglDcXMyxjEvKM5RPSH4eG2NntLZGQm:4lYX9EK4SH4/2NtLgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617626844, "uuid": "496a5605-f328-46d1-8568-278d165e45ca", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617626844, "uuid": "b2c36050-3ab3-4fa0-a6dc-08587f552fab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617626844, "uuid": "37359165-1f2b-46f2-975c-65c8e3186ef2", "value": "Order 01042021-V728394-H16.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49f90f9-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646498, "uuid": "97ae35ea-471e-4f05-b8d4-c7f317a6cc05", "comment": "Malware payload (Dridex)", "value": "bdad8470dc56aee0432d51fa4ca5913f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646498, "uuid": "54dbbd2c-8d7f-4252-8663-a1d3e3712773", "comment": "Malware payload (Dridex)", "value": "9897b1b872aa6031a27330a8bf0f35fbd3a88b029e238ef2d05da6c9393251b7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646498, "uuid": "c76800db-d9e3-4d4d-b996-beb94dd00f55", "comment": "Malware payload (Dridex)", "value": "dc86aaec89828188dc48ab8e2ed4d0dc6ad3fe48", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646498, "uuid": "80390b84-05df-4d58-9bf2-544ceb53cb63", "comment": "Malware payload (Dridex)", "value": "0808cbfcdcf7cb2a85e55c5312495034519c2a8716905a0c7063587c937aa4087a700a819068429f7c5fe892657831d6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646498, "uuid": "1be997d5-d153-4ce9-9084-cbdfad0157b3", "value": "F0149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646498, "uuid": "458c3398-94c5-4d65-8cd1-33a6c7c9ffad", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646498, "uuid": "9f1faffc-3fc6-424b-8d69-c723e91d2ced", "value": "3072:p6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:pZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646498, "uuid": "8c4686c6-b99c-4988-813c-9707f630e4ca", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646498, "uuid": "b972d590-f400-40d5-adf9-e07b8c41ad45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646498, "uuid": "2a4493c5-0a40-4c93-b247-456cd014d60c", "value": "9897b1b872aa6031a27330a8bf0f35fbd3a88b029e238ef2d05da6c9393251b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef20100f-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649549, "uuid": "c6f7cb43-1ab5-403b-b46b-d2c725e5c329", "comment": "Malware payload (Dridex)", "value": "b311ec75a1afc1180ebe38684a2f3800", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649549, "uuid": "82b8509b-eb42-4625-97db-7b56b27363fa", "comment": "Malware payload (Dridex)", "value": "98bf12690bd36f2c4d105969f7561751471ac9c5aa3e07d105721436622725d0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649549, "uuid": "6f46c75f-3e13-487c-abe6-e88b36c6bd41", "comment": "Malware payload (Dridex)", "value": "34a525b61b29bde59e9b35fca360fbc12798e4a5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649549, "uuid": "a89c3666-6631-4fa6-bb24-a99de869253d", "comment": "Malware payload (Dridex)", "value": "8692ba7fb02840b95a470e8d406fefd7698c6ea73029685a3cb8a4824d0b6964e0b9489ee7287c487cecf77607e87ac7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649549, "uuid": "aa0dec4b-242c-4468-829c-f29ebb29cfed", "value": "1D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649549, "uuid": "ffe9e6f4-dbdc-48f6-8ff5-8181dcdfe1ff", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649549, "uuid": "2787d61d-ae3a-4655-83ca-d1ec3fd7b840", "value": "3072:bBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:bBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649549, "uuid": "ac70176c-e6c5-40af-9061-50a1665f16dc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649549, "uuid": "913ebab2-4606-42d1-94c2-547b3a5fe350", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649549, "uuid": "2de03356-5199-4146-827a-5fda3def5fee", "value": "98bf12690bd36f2c4d105969f7561751471ac9c5aa3e07d105721436622725d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9f25f3-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644471, "uuid": "eba18874-65a5-4bf7-9fdc-7d6512a33b8a", "comment": "Malware payload (Dridex)", "value": "23a58df3f8af4eb2ca836e7453e8e235", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644471, "uuid": "561e7b1c-cb9b-4252-b895-8603055cf844", "comment": "Malware payload (Dridex)", "value": "996368b9bf348de07fc9f3bfaedc0744ea741f516c22358029de9307a7fdd0d6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644471, "uuid": "29fb8d44-975b-4879-b082-d01ec883e46c", "comment": "Malware payload (Dridex)", "value": "385eae96ebd1d219312298c1775c05e3cc923812", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644471, "uuid": "e48eb504-1b22-478b-b648-eb924af5ab4f", "comment": "Malware payload (Dridex)", "value": "3a3ec2df3dd7e7bb8ec037765c8e761f08eac6be379a90c3258f399d58f2ccfaea41532cb71315f33b2432615306b295", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644471, "uuid": "e6cdbb77-cd98-455a-a93a-fb22f69ae0d4", "value": "E114AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5BABF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644471, "uuid": "86b9a7fb-2dc6-4fb9-bc5e-fcdf4374ebb9", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644471, "uuid": "ab7e44c8-d945-4c6f-8520-262228ed71ed", "value": "3072:ZBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ZBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644471, "uuid": "fa505856-4155-4338-b900-d919ca25efed", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644471, "uuid": "95e00c1e-484a-4e12-85c7-dafe62014cca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644471, "uuid": "5c1af8cd-6148-4732-9aff-0bf9e4de3891", "value": "996368b9bf348de07fc9f3bfaedc0744ea741f516c22358029de9307a7fdd0d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eef067a-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617643777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643777, "uuid": "243f283e-83f8-45fa-8807-39cd024e6984", "comment": "Malware payload (Vjw0rm)", "value": "bd2ef974ff2ac7645c9c1249c6f09c67", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643777, "uuid": "1999b53a-2fb5-46fb-9ccd-e654dde93498", "comment": "Malware payload (Vjw0rm)", "value": "999b0576efee65a6c79f2fdc6e6f0d3aca3965d9e3f6193d88d452a5f507fc4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643777, "uuid": "6a29e96a-f39a-4a23-8d72-53c7ed179dc6", "comment": "Malware payload (Vjw0rm)", "value": "2f91d738794f8dc4e18e61d2ebd138e9cee26118", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643777, "uuid": "eb985d86-b684-4b2e-9b6e-3e90aa11db9b", "comment": "Malware payload (Vjw0rm)", "value": "8ca1a192d7e07343f43fa96b583a5afb53d6887907e83c59d38c4427169d6db3ff49fd74466275a8669a840a2df21b17", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643777, "uuid": "0779879a-6fac-4c25-9963-1505efe87ff7", "value": "EF81209D284B873C53D27B8A802DD54CCDF548B47E28D2B1548CDAC5360ED7987B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643777, "uuid": "c3af929f-8603-4792-9c59-6f181844f028", "value": "96:SABNo5Dnk2c24ZRMHXE6/BIx+Ys+fJLDdQqR7bJyKhvOS4UK:zS42c24ZRMlBI0Ys+fJ3fRf4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643777, "uuid": "a19595b2-ac09-4533-8c86-ae99a8c1078f", "value": 3880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643777, "uuid": "f6e6db81-a7cb-4d63-a8a0-ea9cba7e47ac", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643777, "uuid": "05463cb8-6b0b-41ac-a3e1-73f8acae45ed", "value": "Inv_#9045.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1c7ea0-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647932, "uuid": "fdd8efd5-29c8-45c1-8834-2a12e23c8543", "comment": "Malware payload (Dridex)", "value": "ee7390cf1e3cd385115530246e4f51b4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647932, "uuid": "8fabcf29-5fc6-4127-b83f-0c713bcf597b", "comment": "Malware payload (Dridex)", "value": "9b933722d2915ee125b42d104fcd524fede9008eb88443ccdab98cbaebba054a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647932, "uuid": "1a0ae998-9393-4db5-9f7f-279d39934cb0", "comment": "Malware payload (Dridex)", "value": "5c00f7d7fc297aa994503c3f6604001202472c33", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647932, "uuid": "6f1f1504-4cc1-40a1-a222-541ca3dbb19d", "comment": "Malware payload (Dridex)", "value": "f003680fc3c27273860f0962f5ab9f72773e4d3325613571fb3324338b1b7df0ac86760c25930ca42d6bbc9e864c903e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647932, "uuid": "677e6651-17aa-4dd3-8757-79e9ca7919ea", "value": "F014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647932, "uuid": "aef8a34c-140b-4f0a-8007-9b2c3f34990a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647932, "uuid": "41c975bc-a73c-48e0-9df8-320408d2cdde", "value": "3072:rBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:rBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647932, "uuid": "9003ce52-917c-4d5d-a9ee-201608375a8a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647932, "uuid": "2cb1921c-00e9-4209-9f30-4e06d971fe6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647932, "uuid": "a7b8096f-11bd-4f00-89cf-07d515fa0215", "value": "9b933722d2915ee125b42d104fcd524fede9008eb88443ccdab98cbaebba054a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3ce071-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647831, "uuid": "672af1f0-bd63-4a2a-92f7-e38fed9e9f44", "comment": "Malware payload (Dridex)", "value": "129445dedcd0c5083cd56960ec68a2a4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647831, "uuid": "2b308575-7bf0-41f9-a6c3-e6a184411bbe", "comment": "Malware payload (Dridex)", "value": "9bc55a62f7c3c5f695e48997f2bc8b6ffa1b395e8036b3ccaffdf689f2955174", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647831, "uuid": "28a240c7-cec1-47ef-a233-aababbed1ba7", "comment": "Malware payload (Dridex)", "value": "c2ba1163aee74892b20d3eb1b60366af27c70a8d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647831, "uuid": "f36f02b4-9141-46f6-a239-fb6ffb1e86d7", "comment": "Malware payload (Dridex)", "value": "8fbc3d538ab4748e78535b164bb73f420cf96919d652a0df17cc42b91373b173a31d3056a3cc840a60fc442d640b8c16", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647831, "uuid": "7d2c6371-4b57-4bd7-a524-09e63ae855a8", "value": "FB14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647831, "uuid": "ccfc47bf-6d1e-44e4-9af9-4afe483e0eb8", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647831, "uuid": "fe662064-1548-46f8-819e-523fc5fa8c7c", "value": "3072:SBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:SBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647831, "uuid": "56ffadaa-59fb-40a9-afbf-66d6753eca2b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647831, "uuid": "a778f867-0197-44e4-9920-f65020c204da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647831, "uuid": "30b904ec-1870-4042-8580-27e1dd6dc937", "value": "9bc55a62f7c3c5f695e48997f2bc8b6ffa1b395e8036b3ccaffdf689f2955174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562237a1-95f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617615791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615791, "uuid": "bdcf053e-055b-4ce4-8ea3-a8bb4dec435b", "comment": "Malware payload (SnakeKeylogger)", "value": "627e5996cef4a16becb03a53997d7bb5", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615791, "uuid": "bb00900e-ebcc-4a62-ba84-c89e981c5617", "comment": "Malware payload (SnakeKeylogger)", "value": "9bfb51765366fced816f107879617ad94d5b7501ab98ac4a3e6bdc699f51f55d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615791, "uuid": "59e02650-18de-43fd-96e4-e6bfffc60005", "comment": "Malware payload (SnakeKeylogger)", "value": "8d49dac8a55ccb57234eff41bd2c5a772c21ae9e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615791, "uuid": "dd96a589-45a1-4cc7-b885-4087e5a0c849", "comment": "Malware payload (SnakeKeylogger)", "value": "5cae8e098c8bd48704937402b4a08cc8c1db75407d5f6facfde68196faa763c182da14d6b6fc7abd415f4f658fc7e628", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615791, "uuid": "b486501d-ec71-4411-a5f1-c4ce82640d85", "value": "59F40110B3DAE716E57933F54A96800347B2F1DD2823DB690D89A2C63169B4C8ED5EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615791, "uuid": "8d822bb9-d5e4-4564-a8d7-b0d3ec28a740", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615791, "uuid": "4f0ed237-a78c-4e84-87ce-adf92e76291c", "value": "12288:/ggZAUCJjQ8VablSQsiCw882C53dKvBqvxwl/GT7uGtzWdaRz7312MdECPuIstlI:/ggSUCm8sblkiUP8eqxT7uGtzWO33/aS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615791, "uuid": "436c58c7-6bba-4f16-a2bd-df143ffaa599", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615791, "uuid": "d30deaf0-d816-4bf7-a65a-0e2e0ce819cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615791, "uuid": "1c57e85a-e1d0-4acb-b806-9104292edb58", "value": "AD1-2001028L (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09f7446-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "185da197-e7ec-4d67-b934-04b97d42a14c", "comment": "Malware payload (Dridex)", "value": "810b1b4c097c41e7fe6a041ba64e8f87", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "c8be6041-ec84-4a08-b701-878c9d8e735f", "comment": "Malware payload (Dridex)", "value": "9c8f546c7dae1cd1ea0b812c8878524febae2f1e83763e843cf05c6accdb3575", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "cf6afeca-8f7d-4454-bcae-54684cd6041d", "comment": "Malware payload (Dridex)", "value": "cc7d55bb7d17577a712efb175f504e56c5723d6f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "6eebdcd6-6e40-4700-88ac-3268241d02a2", "comment": "Malware payload (Dridex)", "value": "f6db2540921bddc18350682635430bc6b0ac2728360ed98a5b896c9f3bbbc5e7a97cfed199de758e2b5cc75012073fc9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "6f7771b5-c35f-40be-a71c-b6e1807a718c", "value": "FE14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "55907d96-fa9e-4923-8ab0-071e76df1147", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "f7588d8e-90ab-4225-bd72-821a22d019af", "value": "3072:tBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:tBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647833, "uuid": "262cf566-3efe-4455-a900-e264eb42fe8a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647833, "uuid": "27da027e-6baf-40d1-9cfb-dbe0d424ef0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "91ee93e5-e08c-4eb1-afcf-ac88ba19ef90", "value": "9c8f546c7dae1cd1ea0b812c8878524febae2f1e83763e843cf05c6accdb3575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faec3e8-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649684, "uuid": "d07f52da-1081-4dbc-93e2-8e2152b5acc8", "comment": "Malware payload (Dridex)", "value": "8d0c23932d6ab0bb9b3e965a770b1d83", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649684, "uuid": "661c131e-19d4-43f5-9562-e32ddee2c02c", "comment": "Malware payload (Dridex)", "value": "9d6c310741ccc213719207a314e33408d7a0970b2df5e6f272a4a0ea34fd1e73", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649684, "uuid": "c7ce9957-40ee-4f12-a7f5-17c121ffbca9", "comment": "Malware payload (Dridex)", "value": "085267ccf09004db8b02a97c327726b5e7910e8b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649684, "uuid": "b282e80c-5cb3-4173-a7d0-5e50fb0749f6", "comment": "Malware payload (Dridex)", "value": "138050b124706d873d803c7e8f8ef706064ea25c660d615c967df0ecf61f830885fb856f8688f37245ccfb528767cd56", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649684, "uuid": "62f6c166-a399-4fd4-b137-b31c6b2a45cb", "value": "2214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649684, "uuid": "a4b952fa-8fa8-4d2a-81f0-3f3402081ab2", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649684, "uuid": "f1c0506b-3fc0-4789-be73-2e073f9d3fcb", "value": "3072:uBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:uBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649684, "uuid": "4a6c2a9b-c13a-4fc0-a63a-aebdaeefb65d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649684, "uuid": "b45dc018-b685-451b-a7e1-423343dbd2e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649684, "uuid": "95f9f6b3-e2f4-4203-94ca-3decb8d37ea1", "value": "9d6c310741ccc213719207a314e33408d7a0970b2df5e6f272a4a0ea34fd1e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0691a062-9657-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658608, "uuid": "2ed86228-6eea-4ba7-92e5-d1a76f94d62b", "comment": "Malware payload (Dridex)", "value": "7ad20635121dcbaceb8bb7d81cd913db", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658608, "uuid": "9e0b75d6-2fa8-4f66-b92f-2a37096dc207", "comment": "Malware payload (Dridex)", "value": "9d6e62ed91d46bdf7c51030609692c5f0220c5748810b9d1425d31370c482e17", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658608, "uuid": "b180f00d-77ef-4746-9096-ac12a3d8ccb3", "comment": "Malware payload (Dridex)", "value": "b866208b3bb55b037122560ea6657245358d3d6d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658608, "uuid": "f8353dab-bb9a-4d29-829d-8a9f8919bf2e", "comment": "Malware payload (Dridex)", "value": "dd56c7c4539c65b5729ef1c9a8285cb8821edf4203e5036df6bbe0cd5ecbd8bcfeac1e066697a2fc172af183d3389621", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658608, "uuid": "71f7d4ab-509b-44be-bd96-1be32082c17a", "value": "A9149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D154616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658608, "uuid": "53327974-c4b9-4518-89bd-318e207e6b33", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658608, "uuid": "e477e9b4-b838-4c36-861e-aba9989b0c9d", "value": "3072:E6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:EZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658608, "uuid": "38957f02-6630-42c7-9ff5-2688e64c3655", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658608, "uuid": "d700f5a9-27fd-43a1-a8bf-b88ebf05d9cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658608, "uuid": "8ac5868a-5f44-4c67-a039-2709a4b665fe", "value": "9d6e62ed91d46bdf7c51030609692c5f0220c5748810b9d1425d31370c482e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89fc8e8-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647847, "uuid": "347fb1c7-6167-4a62-b149-23f173dd1a57", "comment": "Malware payload (Dridex)", "value": "970934ce3c1cb471f652067bcf32b344", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647847, "uuid": "2df98e66-2202-4e4d-9391-5ab35dbd3020", "comment": "Malware payload (Dridex)", "value": "9e1c960f08d37476ea7bca32f1dd127c4fd1a6b1d40ecc35d5bf6d863f34b490", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647847, "uuid": "0c5b013a-7d63-4be0-8706-2321523ea204", "comment": "Malware payload (Dridex)", "value": "9afd4f6999a59c4f4e7e63eb664fcb752dc29c68", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647847, "uuid": "a2728484-c2dc-4ec9-aa33-0665e992b2cd", "comment": "Malware payload (Dridex)", "value": "3d707f698552aaf8e100c0d7ec1276b02b7c41ff673980e953e034dccc235d34cdca48641684bb987f6bb52a291c6bb3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647847, "uuid": "9502e26f-5d36-40c8-8b79-bbce29702a22", "value": "3714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647847, "uuid": "83acf569-3913-4ca0-8d9e-28e11329a9c1", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647847, "uuid": "152097a8-0ec9-4594-8da1-4a2f847ce069", "value": "3072:0BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:0BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647847, "uuid": "d42b5cb1-ff65-4cd3-90ef-180dc02d616b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647847, "uuid": "f4121ab8-39cc-4e3a-bab3-7c2a6636b891", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647847, "uuid": "fe6929a9-d582-41d4-8e37-3ebbaef0c852", "value": "9e1c960f08d37476ea7bca32f1dd127c4fd1a6b1d40ecc35d5bf6d863f34b490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd839d8-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617648262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648262, "uuid": "b9d87f25-865a-4837-8ea5-8c7f70c833ca", "comment": "Malware payload (Dridex)", "value": "ae1431ddad9362f53d075aa9a0f41f12", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648262, "uuid": "0d4a17ff-16ff-4202-937d-e7506d02564f", "comment": "Malware payload (Dridex)", "value": "9f9470fed497cd9ba7c54e03bfb610457e3c335e8556a1349524d7d5a2f287e7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648262, "uuid": "bd7fb0b8-c792-46c0-b222-057eba63793f", "comment": "Malware payload (Dridex)", "value": "e1602325e81f71368d147b659d0aa5f8df2f1d73", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648262, "uuid": "b4553a38-b4ab-41dc-9afb-db5c45dad508", "comment": "Malware payload (Dridex)", "value": "82fedf0014ae5ecb117738afbbd30d17289a4bd3e8420d800212166aac498adca657b3ae0df6a8e222e742be0b637f57", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648262, "uuid": "6297a2b8-1724-40fe-a280-e9b9f0a53521", "value": "4414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648262, "uuid": "0e0753ea-70a2-45d2-8101-07d7d46e410d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648262, "uuid": "187b34b5-70e7-47ed-ae83-50c7f494d7a6", "value": "3072:lBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:lBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617648262, "uuid": "acd27ad0-6ba3-4825-ac0b-6797f0e5ce83", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617648262, "uuid": "4d9ce3f0-c53e-4712-85fe-683cb69dfc98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648262, "uuid": "76a635bf-c184-4bcd-a957-efe60f1023b0", "value": "9f9470fed497cd9ba7c54e03bfb610457e3c335e8556a1349524d7d5a2f287e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a34cf07-95f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617615798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615798, "uuid": "6c78372e-926b-43ab-a39b-2348f68770f3", "comment": "Malware payload (SnakeKeylogger)", "value": "4ef2a1380fc98b2fb8c70e5b1e44a1b1", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615798, "uuid": "306391c8-207e-469f-9157-b378c24fbe28", "comment": "Malware payload (SnakeKeylogger)", "value": "a1a46305d5693a4a662ea995e7771e6c0b66aa6c366ca4bce119f86063dc09f9", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615798, "uuid": "3211581b-f816-43a0-9686-56b15c6b60e0", "comment": "Malware payload (SnakeKeylogger)", "value": "1047a1f712cda32c661b396ad2802affc383284a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615798, "uuid": "b06cb459-5448-4828-a8ad-e9f4ef99ef7f", "comment": "Malware payload (SnakeKeylogger)", "value": "070dd5d3c126c73123dd07e01e600b54e6c1a551c957ee8b66f245c41fd483012c43aa5f9f5af545afe3ceb409283c8d", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615798, "uuid": "e9ecdf55-8da1-4e17-930d-f98f601759d7", "value": "D0E4AE823145DCDAE04329F258AFD57061B97D9E8164C60E3743BF2BA5E734324AB78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615798, "uuid": "c9c0e921-aa65-45d3-bab0-cf54ec9e8797", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615798, "uuid": "e692927b-437d-404b-a367-3198511e90d8", "value": "12288:XyCSiDKFvqnvoGXFTwo7kTeHKYKD+xQcuXF4qDU0nGBZg1O1q7:dduFvPST79HQhF4CGcO1q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615798, "uuid": "a9286633-e15e-45c8-ab33-4697f7700526", "value": 718424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615798, "uuid": "246d0479-d278-40d2-8934-7decd3e4596f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615798, "uuid": "cb76367b-11ff-4c30-a0c4-87298b4e3cc7", "value": "PO XIFFA55,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7a1c6c-960d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617627107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627107, "uuid": "92382632-28e4-4815-b405-56d86fd233ab", "comment": "Malware payload", "value": "2ceb330b45abe4c81a77f02bfb4ced7b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627107, "uuid": "2ba1556d-5f81-41ad-8110-2707254c74e4", "comment": "Malware payload", "value": "a29a5d3ec5e4408360f441aad6036ed7f97b4f81f0e3958613d8cbbd38fe9601", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627107, "uuid": "d816130e-31ac-4e03-beaf-f950c110b079", "comment": "Malware payload", "value": "9cbd55c105ce3601a5c935f4efbd7e83bfb22404", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627107, "uuid": "768e985d-314f-4bcd-b304-a206b696e122", "comment": "Malware payload", "value": "be5295006fbe4bcf72eddb2b48b6c6ecbb9ae85253d25917e4b25d79243cb57850e31a3b8f216c1153cdad54e38f9d5a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Yahoo", "colour": "#6E435A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627107, "uuid": "32d25382-325a-4e49-bd75-a4b074ed839f", "value": "012633754B20DF457849F0FC2817CEB8D360E98F078DD896A5A6F920399C06BCB6DB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627107, "uuid": "336307fb-bb65-4ec5-bfdd-6fd152010d8b", "value": "98304:SUej3637DTRGafnpWQSLuMTm6UnBd1iILoXL7fvkxTMCwjttE:SUeTQBGafn4QqTmNnBriXfCTM/3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627107, "uuid": "ca1f4c96-931d-4cf4-80a2-336a1974ef75", "value": 4638909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627107, "uuid": "0646e02b-df6d-46c9-aa41-f641f529bcda", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627107, "uuid": "f00380c6-73ea-44e9-a11a-728608ab1e27", "value": "Acc_AccessTCart14000116_12.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcbfdfd-95da-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617604960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604960, "uuid": "7fe5f4ac-139b-4c93-9708-9718f70712d8", "comment": "Malware payload (SnakeKeylogger)", "value": "c7db23b3221bf8893e0b8af85f558920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604960, "uuid": "eb26dff7-b1aa-4dfb-bacd-3b7868337688", "comment": "Malware payload (SnakeKeylogger)", "value": "a2bc45e3bae17697b458fccfb9599ec2d2ce9544fc79a227d98d1df594121142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604960, "uuid": "efe4a035-7dd0-4cfc-b94e-444d7e5c7ca7", "comment": "Malware payload (SnakeKeylogger)", "value": "576b4f0f75d5c4c3516c27886fe91bf9d1ab2a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604960, "uuid": "3f3036b4-a3db-4c2d-963b-ad28bdd2fdb4", "comment": "Malware payload (SnakeKeylogger)", "value": "1092edf5f186c8292f5d0a6cdb80224155720934c4ee4d40887b4bcf2a23ce54fc3ebb1813a9ddf303c87483f801fc85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604960, "uuid": "a4cf7abf-0e33-40cf-ab66-989ed0542bf0", "value": "D535C013A66E8FB2D86D7D3F054F009D4389A6DB68E0D38B644D4BA23615CC9778CCE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604960, "uuid": "b4b627eb-27c9-48a3-b9e9-6fa2f1242e97", "value": "12288:Zy50jwcEc6tgGujMLFubuS0Bis9JC2cxgEIRMz:808cEc6tE4I2CvaMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604960, "uuid": "30dc8996-551d-4b70-9f31-e3f144ab59c8", "value": 1078769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604960, "uuid": "8f15df23-7848-4f17-89ca-98827e5b0353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604960, "uuid": "a6eb5559-362b-40bb-8a96-3d361ec8cfc5", "value": "c7db23b3221bf8893e0b8af85f558920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cd3535-964f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617655415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655415, "uuid": "663ce975-64d9-47b4-a806-857716443520", "comment": "Malware payload (Dridex)", "value": "dffa5f2780a2381a35c44810d3e8c37c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655415, "uuid": "ab3aff5c-173b-4a34-8ef8-52b79119e353", "comment": "Malware payload (Dridex)", "value": "a2ebba1efe5cd2d44650acb42f94e76a543701b6c516a2c598936fd40b92305a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655415, "uuid": "c6373819-c7a7-4f0e-95ad-3a42664474ca", "comment": "Malware payload (Dridex)", "value": "bd3a9ed5ad042053b41921fb8f5e23853743ad8f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655415, "uuid": "0af230c7-4201-4f5a-b34d-0c0984410ab2", "comment": "Malware payload (Dridex)", "value": "0b7de0558ea637d1dc31d32fddc57fb471008bd233b5cda8f2bba163a94f5870c07e036e50b0d066a39a859b4ee66bfd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655415, "uuid": "025e57f4-1c6c-4c6a-973b-85fd52c26780", "value": "4D14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655415, "uuid": "2e6052f4-213d-479b-8983-4dca17c49d10", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655415, "uuid": "3d2c95f1-d848-49dd-9522-2c29252f4756", "value": "3072:NBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:NBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617655415, "uuid": "489ba573-1558-4cde-ad94-658b82f665fe", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617655415, "uuid": "9c0c2a41-42b5-4c08-9045-22211623287e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655415, "uuid": "3998028d-8fdc-409a-8935-613ed89e38c6", "value": "a2ebba1efe5cd2d44650acb42f94e76a543701b6c516a2c598936fd40b92305a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc16422-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615053, "uuid": "66ea0b2f-8d03-48f9-9727-1c38af2dc73b", "comment": "Malware payload", "value": "367c01e4c4ce695d828ce1e385421a58", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615053, "uuid": "bd83150c-aa8e-4881-b7a0-7e30159b1823", "comment": "Malware payload", "value": "a3e4d0c2ad630f81735088907447dbd4d053b0afa1cd6eb134e1c9ae8452da92", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615053, "uuid": "76919220-311c-4ffd-8f51-7f3b0157f1d5", "comment": "Malware payload", "value": "58ff91f61f4524e1d343f98434fe0109465c9e05", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615053, "uuid": "8faa89d8-c0f3-47a4-bcf6-2d8b4ddcab2f", "comment": "Malware payload", "value": "1f2054921d41001cce975e60a6423de9c8df7bd6879efe829bee81a06da8b018830cc9330bf1492cf96648e43c21ea35", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615053, "uuid": "04343dd8-db54-47dd-a5dd-0b177fdc41c6", "value": "34663341B092CC7AE8F3253606B7D1346D7EFD130B1049BB62AC4A637E61B92B77921D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615053, "uuid": "11c1a9af-d10f-4f7a-b466-f1712102f695", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615053, "uuid": "473c0530-dbec-44af-b15c-c2d5a0351dfd", "value": "196608:qbuCCCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazj:huN/HYOSIT/EVF9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615053, "uuid": "263fd4bf-34f9-490c-ae3b-a068807a988a", "value": 6966592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615053, "uuid": "1950569e-7341-46ba-aa38-b6376f56556d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615053, "uuid": "69abc1cc-ad82-49c5-9b41-d892e91e800d", "value": "a3e4d0c2ad630f81735088907447dbd4d053b0afa1cd6eb134e1c9ae8452da92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598d8a5c-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649727, "uuid": "dc51d51d-ea20-4a1a-b99a-e67c05a4c2a5", "comment": "Malware payload (Dridex)", "value": "969ee006fc1050b15719fa4eacfb60d8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649727, "uuid": "02e19dc5-76e0-4bff-9cb4-00844d3c5186", "comment": "Malware payload (Dridex)", "value": "a6d5cfb91d1e5cb666779d5f4ea88c5727bad045ddcd20bef6f1beb2ed3bfa91", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649727, "uuid": "314f1b3e-4251-4139-96fa-99187a504888", "comment": "Malware payload (Dridex)", "value": "e59a5a529d615f8c0128be2a8c8f4079d81bc160", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649727, "uuid": "d15b696c-1427-4ad0-8f2c-1dd7acef30f0", "comment": "Malware payload (Dridex)", "value": "ef10ecea176d9029c4085989dee26f9901e240e5bf4b96e9f52704a5ffcb3a4c103c45fc4f6bfb8747e71cfe3a972622", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649727, "uuid": "31798d0e-23ca-4b60-bcd6-7705b229e8c1", "value": "1B14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649727, "uuid": "cefd5cd8-4489-42d5-be36-759f6cbab72c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649727, "uuid": "9cfa8a6e-de2d-4dce-ad90-2755d04abb95", "value": "3072:LBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:LBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649727, "uuid": "7fa89b88-08ae-479c-a7f6-326e2351149f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649727, "uuid": "fca135be-c4de-4678-be70-9fe256ce4303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649727, "uuid": "bf9bbfea-4c65-45e7-a774-556a12b4d872", "value": "a6d5cfb91d1e5cb666779d5f4ea88c5727bad045ddcd20bef6f1beb2ed3bfa91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09e4467-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "14742626-c20d-4a3c-b89e-73a657267609", "comment": "Malware payload (Dridex)", "value": "cf626a6c3207961d8c691f8281863372", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "0e2ba413-7694-4ea2-b1a6-b8c793075414", "comment": "Malware payload (Dridex)", "value": "a736437d7b5b285fb841afa6fd1e50336389478983f0ac0c25b6d81d43808bef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "897e6d2d-d8c4-45aa-9723-65baf5e58da5", "comment": "Malware payload (Dridex)", "value": "ecf6e0a427414bd2105bb158c29fdf4cb2fe81c8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647833, "uuid": "ac07e4de-f6ed-4a14-b87a-2872ec535dc9", "comment": "Malware payload (Dridex)", "value": "7347acec6bb2bcb26fa2585293a2528fb5226407d0cb46d2085fe40ac9ba2287c84feceb69a49b705cdee05c58173f64", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "c384d724-0380-4ec6-a2b4-939f326319e3", "value": "1714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "9b64db87-9639-42ee-8d20-9b376643deab", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "474fa775-f272-4b6c-96bd-9e14157692c7", "value": "3072:ZBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ZBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647833, "uuid": "7232e0d5-277d-4b5b-98a9-a4dc1092107d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647833, "uuid": "fbb86ef8-cc89-467e-9f04-ff72ab7ea099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647833, "uuid": "1a74dc61-dcfc-4ecf-b521-4fef58b48dfc", "value": "a736437d7b5b285fb841afa6fd1e50336389478983f0ac0c25b6d81d43808bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c738307c-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644328, "uuid": "3bc78047-9e25-493c-b215-935d0b955c5a", "comment": "Malware payload (Dridex)", "value": "b47c511f7350f0a9106f4eaa2c1fbf59", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644328, "uuid": "a787f03c-bc06-4522-9d5c-8c8cbcca235d", "comment": "Malware payload (Dridex)", "value": "a7437c4127f6c1c514d2f25e7a27dcfcb174e1cd19ba2bd549c03cb7b9493323", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644328, "uuid": "b1a5e928-6982-4c89-a524-79f14ad8df76", "comment": "Malware payload (Dridex)", "value": "4a4926590e05b608bd1feb3d080794ff1cb14689", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644328, "uuid": "5008559b-99d9-484a-bd55-b8248038b87f", "comment": "Malware payload (Dridex)", "value": "518b0bd9123b8a57910fca6103a8578538b4c517ead1c273b7a065260101badf1a9dc5dcfb908a69c810fab21744b596", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644328, "uuid": "81ac438f-f84f-4312-918b-5843f13940ea", "value": "BD14AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644328, "uuid": "d8c71004-6380-4db0-a010-38b67b49d4fc", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644328, "uuid": "c9275890-6129-4a2f-aed0-2616cbec0d6c", "value": "3072:eBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:eBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644328, "uuid": "14b3e482-1d8c-48de-8298-cf3838598919", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644328, "uuid": "83aed680-5a92-4331-94cc-b2e6f0949fc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644328, "uuid": "e576c8e9-b328-4037-91b7-f4720e67e623", "value": "a7437c4127f6c1c514d2f25e7a27dcfcb174e1cd19ba2bd549c03cb7b9493323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12925cbd-961c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617633287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617633287, "uuid": "9476b6eb-627f-43b5-9d44-95b7319e4f23", "comment": "Malware payload (RaccoonStealer)", "value": "bd5e0b1828a04b49a3d29b2c74102bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617633287, "uuid": "949cb372-1104-412e-aafc-9042d8615468", "comment": "Malware payload (RaccoonStealer)", "value": "a7bc9073cc389bccaa5d3f35cfd21554e7c9ccb52b1f10da67bcacb2177dccfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617633287, "uuid": "1a2b1731-74fa-4978-859e-a91e4fdfe347", "comment": "Malware payload (RaccoonStealer)", "value": "866f693caaf730505a0145c5c55c90805bddda41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617633287, "uuid": "9ae8976d-712b-4e80-81f8-9fbd438f090e", "comment": "Malware payload (RaccoonStealer)", "value": "6978f4bd6a4608b7ad7f99e39730fc3a6f3cf6dce920d884ad6fa8ddf8dac0925e73de5850b078da8587cacb5d227c83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617633287, "uuid": "f9eabc7e-c2c2-46e3-93df-01bf6d7bc233", "value": "1DD4E01272D0C072D1A261B15628C7F14EBBB8726B2559CFBBD41ABD4F247D1EB3930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617633287, "uuid": "01cac9c2-23f6-470c-9a9d-9d35d8e880a8", "value": "2f6204fbe7d12f9994fbdbc383c525c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617633287, "uuid": "45b5a0b6-ac18-4f30-8daf-f964e43a708e", "value": "12288:aGG45Xvu0tQwZ7XhPG2osvRfkaQ7vloHLpoF0Nd:aleXvF5phe2oGRfkaQ7toHCF0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617633287, "uuid": "61e6701a-fd5b-49b7-bb9c-87165a5c32a9", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617633287, "uuid": "06447998-2dc8-49ac-aa4e-450c75ede877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617633287, "uuid": "62d247df-87da-425b-9e34-f60dbd6be65b", "value": "bd5e0b1828a04b49a3d29b2c74102bd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d3eff3-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615095, "uuid": "886a499b-5fa1-4941-95ab-d2da10099174", "comment": "Malware payload", "value": "0358fb6dead4b5e6aa77b547ef4d3aa3", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615095, "uuid": "45768108-623e-4c3a-9bde-89982c5a06aa", "comment": "Malware payload", "value": "a907d33c6b53bb2da7803828fd2070b739ae402babe50099adbb072b0cedd1c3", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615095, "uuid": "66b4c72b-2b90-436e-8171-7d73a89e0212", "comment": "Malware payload", "value": "96e2221acac73eb3b1d79a4cff5eb1c988f6303e", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615095, "uuid": "7684fa06-b497-442b-873e-40297c9e38e4", "comment": "Malware payload", "value": "b5ae333e40932646219e9236415c9b41de6bf9d7a137f41e13af2151586d923382608768a16c2503e71b3f0f05c897db", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615095, "uuid": "d19391d0-4a66-4d51-94f7-e6669924f845", "value": "61663381F0938CBAE8F611371AB6D1353A7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615095, "uuid": "5dcdf8cf-284a-4d95-9d6f-b361e9ea5aaa", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615095, "uuid": "f5ffafe3-c4af-4bf1-a5f1-7f60ab83a435", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazt:kfauN/HYOSIT/EVF95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615095, "uuid": "934cc784-5e6f-4e32-94ce-0cbcb8b9f46b", "value": 6967160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615095, "uuid": "2f459398-11cb-4c3a-b3b8-177fd40aaeb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615095, "uuid": "84178317-fd55-4dc5-afe9-8f745cb30107", "value": "a907d33c6b53bb2da7803828fd2070b739ae402babe50099adbb072b0cedd1c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0970c3d-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646518, "uuid": "6d2611a1-da43-47eb-bd81-10e079d2662e", "comment": "Malware payload (Dridex)", "value": "d5b361dbe9cb853b078861ca40b6ee44", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646518, "uuid": "37bcb4c8-4736-4cb4-a9aa-54b0f25f3193", "comment": "Malware payload (Dridex)", "value": "a96a349e796821d97588baff0788aa73e96a30e85a8c0a2303b787161bc5cbeb", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646518, "uuid": "bff853fb-d12c-4f82-9ca2-7b9d3f9a403e", "comment": "Malware payload (Dridex)", "value": "ceb36257aed6531b200b3f6af1a6bc4527d4f2a4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646518, "uuid": "47f00693-af41-40c1-bf38-8716e91c406b", "comment": "Malware payload (Dridex)", "value": "4f69ceaf3d2a061e52cdb9848a87ce41b4f2cc592467fbf31a602afde21940020dda93558dd6f9a56d49fa5565173480", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646518, "uuid": "53b20b9d-d837-4ef7-8ed3-e1361d92fce0", "value": "52149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646518, "uuid": "10e1e8b6-b53c-4705-8193-7ccdbb39e3c2", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646518, "uuid": "dc9a0289-4556-452c-a07d-83e388ba71bc", "value": "3072:t6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:tZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646518, "uuid": "dc2f735c-7793-4a26-816c-fab11894471d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646518, "uuid": "70b843e1-cd99-4454-ab8d-0d907ba83ee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646518, "uuid": "a3473bde-716c-42ab-8a84-d0d99bd3513b", "value": "a96a349e796821d97588baff0788aa73e96a30e85a8c0a2303b787161bc5cbeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fc40ea-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "17ca13ec-9db6-4b1b-8c62-9a41edd4c5f6", "comment": "Malware payload (Dridex)", "value": "49a4c7a0f1689bdd0e65086bbbf294cf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "74aa046f-8eb8-438d-8433-4d926440ebef", "comment": "Malware payload (Dridex)", "value": "a9f2c81e688f0361711c0821259cc674dad557a576a1fc612626a0fd0b26eab3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "2e5b1a55-c3b9-4680-8083-3971603cc991", "comment": "Malware payload (Dridex)", "value": "50e0ec6b5f87dc0e8f485a93a0466f764b34a82e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649594, "uuid": "72c40986-7ccd-41eb-bd07-34555bdba617", "comment": "Malware payload (Dridex)", "value": "c93b6551056a2af49bbe3d9e989cefaf17aba81cf588ae72843a484133804633687dede4420370bdff3ad6dea475014a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "9b3837f5-4759-43f2-bd7e-ef0c32a3a5c1", "value": "D814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "cabcab2e-030f-4869-9c26-71730d96c46a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "3e5532ab-e53b-4ff2-8c13-89d0fe863482", "value": "3072:TBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:TBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649594, "uuid": "d780bcf9-a61e-48e6-a2a5-160f4027ab9a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649594, "uuid": "bddd2d9e-f414-4796-bbf4-06b2eab6a861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649594, "uuid": "445a26f5-d227-4356-9720-2b8fa3b7b09c", "value": "a9f2c81e688f0361711c0821259cc674dad557a576a1fc612626a0fd0b26eab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01ab097-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615110, "uuid": "e9f3ac1e-fcf1-44a6-bf2d-aa7156622537", "comment": "Malware payload", "value": "8c85e807e7ad59dae276edfc67a40a5c", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615110, "uuid": "a7bcb72b-3739-4f10-9576-770cf1c0cd7e", "comment": "Malware payload", "value": "aa82cacf6972afc76c40a7b518abbfe13bf03bf235e7f463f73028ccdb9ca833", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615110, "uuid": "252f9c76-7c65-43c4-ba56-23fff78f50d4", "comment": "Malware payload", "value": "a1e36437f5567be24fd6e2d04853c86af5e4388e", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615110, "uuid": "9a9dc99f-d0c9-4b5a-a5dd-566495932ea1", "comment": "Malware payload", "value": "5bcbc338549738fba25b5f229ab76910c0f51039dee3271cb741e4b8674ed2d714e03dde116db3145513d38e80ecfa36", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615110, "uuid": "8d977622-68d1-43e5-9c50-f32148bfb09a", "value": "94663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615110, "uuid": "d12d0708-90de-4a84-afe1-34f117b0a660", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615110, "uuid": "27a8b689-36ba-4b2a-b015-75ffe01e1f12", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKaz+:kfauN/HYOSIT/EVF9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615110, "uuid": "ba743073-337d-45cb-9701-e8e9cc460038", "value": 6967106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615110, "uuid": "9fce273d-8668-434e-8b5c-67de429e5a93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615110, "uuid": "c1b66f77-a88e-4bb6-82bb-eeb99b727067", "value": "aa82cacf6972afc76c40a7b518abbfe13bf03bf235e7f463f73028ccdb9ca833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e770f3b-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649601, "uuid": "7825cca0-bdde-4393-a199-66adbf30fa05", "comment": "Malware payload (Dridex)", "value": "eede8a955d11f9b1fd3088a1be46985d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649601, "uuid": "6b755954-90ca-482e-b3e6-c4f8509557fe", "comment": "Malware payload (Dridex)", "value": "aaf4823e0c1b64b552b6223bef6937451c7d10315ce16d0cc4bcd3263a992985", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649601, "uuid": "919fb99c-6514-4dbe-87f8-0eea3de4e2d6", "comment": "Malware payload (Dridex)", "value": "547703c660eaea680541fb348ce5c1cdc3276742", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649601, "uuid": "18fb117e-f138-4d6b-aef5-b3a76513b823", "comment": "Malware payload (Dridex)", "value": "b8eb032849488e42889fcd9fed6653c03f695456c7d290f46cb6e93b84b5c1657eccfad30d833f7988616c5491bdfd0f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649601, "uuid": "c3ce4293-eb81-44bb-8eea-e856e4033a35", "value": "1614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649601, "uuid": "968546f9-1975-4e06-a4f2-80abaa77495c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649601, "uuid": "cb94b69f-d01b-4d0c-8397-a7301a1b30af", "value": "3072:nBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:nBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649601, "uuid": "d5b92c6d-8ccd-40c8-865e-732a3b3e5800", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649601, "uuid": "420d942e-fa88-4fe3-ab6b-d632090f88ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649601, "uuid": "4473e536-aa57-4c10-a257-8291a61ced50", "value": "aaf4823e0c1b64b552b6223bef6937451c7d10315ce16d0cc4bcd3263a992985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedbcb22-964e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617655051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655051, "uuid": "9354eadf-aad4-4521-83ba-0091bd6bfe35", "comment": "Malware payload (Dridex)", "value": "cd4e5fd7c5404e9a6f189512909fc5c1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655051, "uuid": "362c4819-3730-48b7-9adc-3aa8ebb6bfed", "comment": "Malware payload (Dridex)", "value": "ab2e91eb554b0a560f558960ae90ac5b4ff89542ad254dc935b6c5442fdf6d53", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655051, "uuid": "8a39da0e-ef10-438e-af33-693fc5ec8ef5", "comment": "Malware payload (Dridex)", "value": "c6a0a4360575bf95045bf9692ebcd972b9c6f499", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617655051, "uuid": "c5ba07d9-9be0-402e-901d-b88ebe305083", "comment": "Malware payload (Dridex)", "value": "cded45a9da7ccd9bc72abb318fa4707f7582e72e6399a292cb32ce5463c382f023fee8c619c97908bbbd49e5e8a2439b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655051, "uuid": "e25a4f79-b416-46b0-b367-39a8038f0ce2", "value": "0914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655051, "uuid": "d37649e1-0dd9-4e8d-9eae-5be8bfd1631d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655051, "uuid": "7c336f1c-8fe5-4728-9f67-2d2a1f73b56b", "value": "3072:6BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:6BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617655051, "uuid": "2de10cce-d13f-4a9c-a0a9-c95e68c3825b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617655051, "uuid": "737bfaa8-b5ae-4872-be66-8c0694ed8f8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617655051, "uuid": "0a007924-8f3b-4a7f-9845-6bb24bae6c44", "value": "ab2e91eb554b0a560f558960ae90ac5b4ff89542ad254dc935b6c5442fdf6d53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea861a6c-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647823, "uuid": "97d866ae-3027-42cf-bf39-acb9ea5c8512", "comment": "Malware payload (Dridex)", "value": "ac286c3e619841f5b0ecd5fbb6cb6e16", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647823, "uuid": "ef8d3b5b-d2b7-4fb9-ad17-48e8b751afd1", "comment": "Malware payload (Dridex)", "value": "aba6883fb8890f9b9eb53333694b862aecadcd6199489d23b2b03f23ea4fc582", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647823, "uuid": "8858a61b-bab9-420a-bf4d-842d359b9698", "comment": "Malware payload (Dridex)", "value": "5fcb098c5ec3c754b6dfabaf6964b0a84cb10bc4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647823, "uuid": "ad75cb9e-bb54-43fa-a756-ec44c063800d", "comment": "Malware payload (Dridex)", "value": "fd99df93027ee4b379c64f121fe545895e094a39db1be9e29c235b77a2642e41be2922ae7f8a1714f430d386ae5a82bd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647823, "uuid": "2c76351a-7ba0-43df-8071-61d45afb2345", "value": "C714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647823, "uuid": "fcbcf817-f66d-446f-9334-91625b79bf38", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647823, "uuid": "2b89505a-27c4-4a28-9294-893cf4d0f876", "value": "3072:BBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:BBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647823, "uuid": "897e9530-39ba-49c0-97a0-281064abc820", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647823, "uuid": "f2ccca59-f8de-439b-8cc2-4c98856634eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647823, "uuid": "92a867a8-5794-424c-b2db-ef7407104f05", "value": "aba6883fb8890f9b9eb53333694b862aecadcd6199489d23b2b03f23ea4fc582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779010a7-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647630, "uuid": "3a37cc15-cea0-404b-881e-d9656d2693e5", "comment": "Malware payload (Dridex)", "value": "8d704f718ace7bb31e88f7aacd5b69d3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647630, "uuid": "dc9edeaf-f762-425d-9564-0003d21ecaa9", "comment": "Malware payload (Dridex)", "value": "abcaab6e855586e8faa794370cccfe67f63feb66f59bf1fd6bb2735523234dec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647630, "uuid": "5cc6285b-0811-4cb1-a2ba-37825a784a32", "comment": "Malware payload (Dridex)", "value": "95d27ae1d205806c820669643ce093425365fc05", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647630, "uuid": "f36a9cc0-5585-4315-9fd5-407f8640c27a", "comment": "Malware payload (Dridex)", "value": "ad7e189085540092bc00950bd2e18757404df71d05150693dab770b0a70edd0d9900317341d06d80b66cdc7b6cee7144", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647630, "uuid": "7afb919f-6f91-4ec4-9a34-9f08e86ea072", "value": "2814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647630, "uuid": "17c24f6e-fef5-4285-9a2e-ef7787a47c52", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647630, "uuid": "d77ce6ad-6b38-4208-b3d5-7de52bcb380b", "value": "3072:FBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:FBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647630, "uuid": "d674fa96-85de-4528-9c1b-a60281204819", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647630, "uuid": "144eb1e6-f7c5-4509-8d11-5cd3fe2f8a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647630, "uuid": "bebb2653-b1d9-4739-a935-0c1004f815d9", "value": "abcaab6e855586e8faa794370cccfe67f63feb66f59bf1fd6bb2735523234dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9207b4-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615133, "uuid": "b5420c7b-0bc3-4db6-9196-02754d69b043", "comment": "Malware payload", "value": "931f1d8c0babea2c975f75b234ffff07", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615133, "uuid": "b0641344-b501-4aee-8cbb-ab254450fbd6", "comment": "Malware payload", "value": "ada19e0ef0026a965b61440c7bf2b7a14616bb10c3afd04e53e6b94e7788a9c4", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615133, "uuid": "27420bc0-5a70-4ec1-a4e9-a6954bb6571a", "comment": "Malware payload", "value": "2c7feeda12ed3a210f7006b4ed9c5f535dc9a111", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615133, "uuid": "00ba71b8-318f-4c59-ba0c-22e17f84d131", "comment": "Malware payload", "value": "99902bafadabd0ba5eb260ab32e54834a4632fdb36a1cee384daf69d168fa7792a45cb168a4dc6dda68df2df7f7061b6", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615133, "uuid": "fd18d423-c88b-4fcb-a3b1-762d7e512f1e", "value": "A2663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615133, "uuid": "4995c70a-3215-4dd6-8614-0890a5772bec", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615133, "uuid": "6eeff2fe-8ede-4c15-8fa6-14e76498007b", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazz:kfauN/HYOSIT/EVF9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615133, "uuid": "dc83d462-e93b-4ca8-b059-f368682e417b", "value": 6967051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615133, "uuid": "8948bf80-bd11-4f5e-9c8b-607161aa2903", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615133, "uuid": "f28b8a03-a34a-4d50-a256-f549067020d5", "value": "ada19e0ef0026a965b61440c7bf2b7a14616bb10c3afd04e53e6b94e7788a9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d771d09-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617648070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648070, "uuid": "d10e9194-11a3-4800-a09a-77b9aad35dbb", "comment": "Malware payload (Dridex)", "value": "6492a0b6c013ccd5726c0b2679c796b6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648070, "uuid": "255558a9-0b89-48fa-b24d-18a8e62d09fb", "comment": "Malware payload (Dridex)", "value": "adb3fb7734c28828d738a6a428c86ac0c2b1fbf27f607dff1f3c2373c588e115", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648070, "uuid": "6ea5bc01-a50f-46cd-88c7-515a034597ad", "comment": "Malware payload (Dridex)", "value": "9f2da40bfa9cbdf2ba74b90d22775b9d978f6a48", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617648070, "uuid": "f4dccfcd-f134-4d16-9519-3f3ce7547c8a", "comment": "Malware payload (Dridex)", "value": "ce263d0126c2b70a336774322ea1f6dbb58db62ee2d41640bba8beebd8bf12d0b84b99c23139db07da6e0cf82aa655a0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648070, "uuid": "f210ab8f-f066-400c-93aa-cb5b7df2c5a5", "value": "7314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648070, "uuid": "ba8913d3-a65c-4bb5-84ae-3d3822581388", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648070, "uuid": "9caceeaa-6b7c-404e-a741-e3b8e4c48afe", "value": "3072:hBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:hBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617648070, "uuid": "b892f257-83c3-42af-b06e-44f542ea51a0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617648070, "uuid": "28e32202-ac20-451f-8a46-c11b0c8e3bd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617648070, "uuid": "3614bde4-7b10-4727-a762-865942c05d36", "value": "adb3fb7734c28828d738a6a428c86ac0c2b1fbf27f607dff1f3c2373c588e115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4854365-9654-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617657611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657611, "uuid": "7f43f168-fc05-4ab5-9d2a-3c8ea4b8d951", "comment": "Malware payload (njrat)", "value": "0ba3affabcc7040c8e4c2568131306b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657611, "uuid": "982fdcdf-e270-46ef-8290-c9789116250b", "comment": "Malware payload (njrat)", "value": "ae380a8d4305031f7dba4fe2c7f4ce47784f5cb6b65aaa150388f3422c70b685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657611, "uuid": "20a03a41-10b9-4e69-b064-032aa4d24604", "comment": "Malware payload (njrat)", "value": "eed53486cf1a8d3df8d86d4de50079aa0fe133f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617657611, "uuid": "c9882680-9192-4b21-9628-516d9bf4232d", "comment": "Malware payload (njrat)", "value": "af13cf658a366c9f59ff016f2dfb33d1d7f73bf78845d7b28be4d90651e86c7334eb4f36a042ce1cfb115917f6b2376f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657611, "uuid": "4f1db912-d5a3-4c70-87cb-78d3b826f3a4", "value": "8943F20973E0B077D25B873B68E793C63FE6EC498BA7CB0E3C4B446599996186313648", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657611, "uuid": "a6c091b0-6fa0-4adc-8773-75b214bd1352", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657611, "uuid": "5445fe59-36d8-410d-ac6d-bc50ecc6209c", "value": "1536:EkrhAn5ZrOTAlEDQ9yKC7ZQCtUW2f9D6aaNoU/q:hrhi51OwrCVQzW2fUxKU/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617657611, "uuid": "6042cb08-a81c-4ac4-adf6-6987502f6433", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617657611, "uuid": "b8cc90ea-4747-49bb-a6ce-f2410e683a01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617657611, "uuid": "7a31bfc6-8df6-4bf5-8e9d-48e776032ab1", "value": "0BA3AFFABCC7040C8E4C2568131306B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4463ff67-964c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617653987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653987, "uuid": "c730f247-e797-43a9-9526-473e360cc911", "comment": "Malware payload (Dridex)", "value": "e9dca658d15d02c85557adcd14a13021", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653987, "uuid": "2211b15a-ab79-4056-8b1f-1ab6591a482e", "comment": "Malware payload (Dridex)", "value": "ae45600a840ef5a20a163ed63d9aa87a3ce5d9c48cb68e83631650fb40d39e30", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653987, "uuid": "a4c44780-6dc6-43c0-a321-f4abb5f272f7", "comment": "Malware payload (Dridex)", "value": "fcb93332ade2ea4902a432d7c4d56cd01902fe52", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653987, "uuid": "0a13ce64-0030-4b6f-baab-52727347919f", "comment": "Malware payload (Dridex)", "value": "d9b0177cbd2e8cdca47387e8b456075c6d6f048a0818a943ae70ba024d831e41d0a8f5d8e899dd0f8017b5af4476e555", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653987, "uuid": "8e3a3d63-d6e9-4943-aff7-ef75211c8d90", "value": "B714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653987, "uuid": "9d22c757-6da7-4c08-95fb-54b54b9bd107", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653987, "uuid": "cf9528b2-9a7f-484e-a7ac-bc8daeb11fbd", "value": "3072:IBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:IBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617653987, "uuid": "c25dd022-5470-48ec-9857-d7c6c1b6528f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617653987, "uuid": "f3b9c9ea-98e6-4802-ad66-05ca678450ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653987, "uuid": "5788322b-d0de-447f-b9cf-59b1bfe105eb", "value": "ae45600a840ef5a20a163ed63d9aa87a3ce5d9c48cb68e83631650fb40d39e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765b11fc-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604249, "uuid": "d02f2e0e-1a4d-4c72-82a0-4a8f3d96c808", "comment": "Malware payload (AgentTesla)", "value": "99f09d69fb6251104190825e0af635b0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604249, "uuid": "54295569-07a0-4bdc-bd44-3a434f08787a", "comment": "Malware payload (AgentTesla)", "value": "af12302722b823290bbe03f069d0ec0c14b77691e80e1a917d87096e8b18381a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604249, "uuid": "c97a6485-394a-4a6f-a66b-bae22a5de726", "comment": "Malware payload (AgentTesla)", "value": "91fe482951f8e00e7ebc563b8f0ddaf45ecd4f33", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604249, "uuid": "0344060d-c114-4f70-8e5b-2de4f77053ed", "comment": "Malware payload (AgentTesla)", "value": "8d2c41f3f7ee558d40e4e8d9f2ca0b6125610b01abaaeea98a5b6e334cd97c4cb6f14dacb2fc038e51530b33ecc221f0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604249, "uuid": "e45a970f-950a-44d2-8807-4b9849e3f2fe", "value": "15B423FD0A1FA09D16F460D6A9F7CD519BE3439C99768C1B8C8782920433BE9DBE6D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604249, "uuid": "e96ec4c1-bb2f-4d40-b3b4-00e45530039e", "value": "12288://yDyKeQSJq77Mc77X7H6kzhVCfoXJNzd99A3Y77QZ2dIBbD02+://yDtee/7P6kzhlTj9A6kgd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604249, "uuid": "685e2962-a66d-4811-af69-e22fc4c8ccb4", "value": 501158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604249, "uuid": "1a716e0e-861c-4a77-afcc-78fedd945923", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604249, "uuid": "d9b1db70-c72a-423a-8626-b035a6dd4f54", "value": "MV NEW COURAGE.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fad8c0-964d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617654716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654716, "uuid": "97d3ffe0-b2ab-4dd0-b4e0-b44fc511344c", "comment": "Malware payload (Dridex)", "value": "90a9750d9f957a270dd3ad6d8ba92a84", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654716, "uuid": "51d74df2-4a10-40b2-902a-61ad009054bc", "comment": "Malware payload (Dridex)", "value": "af237433ce5faa8de95a9841374256f42243de0034614d35cfe4672998a7c652", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654716, "uuid": "71f80f04-a663-4121-97bb-a31815cd76ea", "comment": "Malware payload (Dridex)", "value": "8858ef0b1b1aa994625d531cce91e617d2c4f8ef", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654716, "uuid": "2dfb3490-8291-4340-84d2-9c5c93b5e778", "comment": "Malware payload (Dridex)", "value": "cc0c5c2743a4e8b173fa99fc798f5a72c7713970b7eed7161548207344f5276cce82929f1f0ab4a7737ac86bb4bf3136", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654716, "uuid": "65ade75a-cbfa-4e48-8196-c37423e666d0", "value": "9114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654716, "uuid": "a5b23ff4-0ecf-4fa2-b272-7b52f9de5b76", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654716, "uuid": "bcadbd67-798a-4509-bafe-49990a73f31a", "value": "3072:XBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:XBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654716, "uuid": "aca90d07-198f-4e80-b19e-ce96a14d9b39", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654716, "uuid": "1a0d5bb5-7243-4c1b-aa6f-5230bb0a5021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654716, "uuid": "0a5423e0-4f28-48cd-9b5d-efc04096bee2", "value": "af237433ce5faa8de95a9841374256f42243de0034614d35cfe4672998a7c652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c0547c-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "6371097a-9809-4e58-bda3-12408f4d6622", "comment": "Malware payload (Dridex)", "value": "9e9ccef5b59aa0cc405c0dbc0faeaaf7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "7df1c839-41eb-4312-bf13-44089f2f28e4", "comment": "Malware payload (Dridex)", "value": "afac0ebc89c1bd0a834547e3790ce60ddd5a9a431caa9d94e6182ff267649d1b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "dfdfebb9-c5e8-445f-946a-0cf1c917dfbb", "comment": "Malware payload (Dridex)", "value": "e9f72c62793de18301397de46b6ef2001b9c29be", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647819, "uuid": "6f5702fd-415b-44fd-ab41-8b1889f46ec8", "comment": "Malware payload (Dridex)", "value": "78631d38cfba2307189e37dc53adb8224107049630d93e021342ade1c3d0bbc193393ed021548d86028b1119c57a1479", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "2c10c735-03f1-4073-8927-7a4f94be836d", "value": "6B14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "6370156b-fb2e-4c44-92e8-1c0d8023e086", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "f2338904-ebf9-4c9c-9930-9c111bc0d2a9", "value": "3072:SBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:SBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647819, "uuid": "f08637e5-b84c-426a-bc28-9e356829347c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647819, "uuid": "ca6b3a2d-80d0-47ce-a503-2fcb89c2e190", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647819, "uuid": "ea6bf419-6ba3-44c6-bb0a-ad6b5ba3a4bf", "value": "afac0ebc89c1bd0a834547e3790ce60ddd5a9a431caa9d94e6182ff267649d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e121c53-95bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617592209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592209, "uuid": "bf7b9ef6-ab12-4303-a8c8-106bd6aea527", "comment": "Malware payload (ArkeiStealer)", "value": "ad8febdd16bfbb5c4d4730c7b5912e82", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592209, "uuid": "b7366cb3-de84-48ac-b533-9b46ed2e99c5", "comment": "Malware payload (ArkeiStealer)", "value": "b11bd18587058601cde1be46ec722f2ddc96fddd976f3a263e4d0358e8e08865", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592209, "uuid": "a051bc57-495e-4d09-a65c-07122646b4cb", "comment": "Malware payload (ArkeiStealer)", "value": "3ddeda3f503ed50175c27beb1c1f4b537728f9d9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617592209, "uuid": "c6cf0f33-f346-40e9-aa3b-c674e7a072bd", "comment": "Malware payload (ArkeiStealer)", "value": "50e16e90fa64cc11606a37a5fa9f8e0abf15719646925535da5e601a2e70bae3ccdb6cca232981968309e960aaf0dd92", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592209, "uuid": "ae37b661-318f-422f-b1d7-1aefaab08b0d", "value": "94B6330A669642B2E11B5C7E4907E2F9F0B27F1D443C610FB6EE0A9C56733DD2C025AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592209, "uuid": "0affbd7a-89d8-4d68-8947-f02b06e89483", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592209, "uuid": "7173ef38-e0d6-46eb-8a68-50567cb922a0", "value": "196608:itv+7MBr0wCCoxY85JzuXG03mB0ocqsuAssaksSth7GSH28wi8Fz5aK7RBXSdt:w+7MmdB5JzSwB02ExaarRHHs5aKlBCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617592209, "uuid": "b6415b72-3bd4-4a88-a727-1d6b02ebe549", "value": 11447492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617592209, "uuid": "a417e712-bfeb-41f4-9da4-5b1407075775", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617592209, "uuid": "a568dcfa-ec0c-48b4-9f26-bc481410abfd", "value": "ad8febdd16bfbb5c4d4730c7b5912e82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba4a2db-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "26d53f42-19fe-462f-a0df-c36a6128f074", "comment": "Malware payload (Dridex)", "value": "751d3bf2763b2fda096748d50ffa1f78", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "57d6ef3d-a3e7-450f-8098-d08e2125de2d", "comment": "Malware payload (Dridex)", "value": "b12c32fba932a87cf55b27fd0368d2726be4cfbd8a2452796f5a599907fadcd1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "d6ec265e-58da-4eaa-9111-f5ecef948dde", "comment": "Malware payload (Dridex)", "value": "012e3e7aff1261b401b5a9006c35a08d549415db", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649570, "uuid": "89e15714-290c-477c-a8d2-2485b5315109", "comment": "Malware payload (Dridex)", "value": "dc509858a20058ded5bbc171cb0a29ffd5e5296c37559aed8c74a23c9d4196989d98af4ea8fd195c9ab5ad7094e10f2b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "c686607b-39af-4651-a3f5-945ac73141f5", "value": "7714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "6b922f6c-a1c1-42cb-b651-0ae980e5edac", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "6b734267-6c6a-4ff8-a786-cf73710da383", "value": "3072:ABHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ABHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649570, "uuid": "b3af6e9a-ada4-42de-9d06-4ff68d148b24", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649570, "uuid": "11395bd3-372c-44e9-af07-75cfd7cf2b1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649570, "uuid": "95ae07e8-2440-4190-ab45-7d8048644fc1", "value": "b12c32fba932a87cf55b27fd0368d2726be4cfbd8a2452796f5a599907fadcd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5f885a-9665-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617664657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664657, "uuid": "c3939e4d-bb0d-466d-829d-60463446e606", "comment": "Malware payload", "value": "46704e473e2633371938e7a42c580a45", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664657, "uuid": "a152b174-ebbe-44b9-9385-b60ff3a0164b", "comment": "Malware payload", "value": "b22fad7e7ee75d72b9e1fb45ccd9572e8f5989874a7d3409336e2e3d5ee03287", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664657, "uuid": "061bae24-e2af-49f4-a8c4-1eea6aa35e06", "comment": "Malware payload", "value": "01080146c3d05fd8c3c5f4eb3951a9e1a7749978", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617664657, "uuid": "f7a74a19-01e7-4124-ba14-8b1d8c627e78", "comment": "Malware payload", "value": "ecf18b896f25523397b9b20d513984c77e19310a10244fddbd2d7dfd4afe4808c101bbb0cbf31e989f2e3d2a04f7d70a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664657, "uuid": "efcd391e-095c-4dba-a301-e02ca6492d2b", "value": "9E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664657, "uuid": "ca9fb697-f8f3-47b9-882a-27912fb7f5e3", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664657, "uuid": "0b857d9e-dc42-416c-a8e9-e8fabef7595d", "value": "3072:9BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:9BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617664657, "uuid": "106e09a2-c3ff-47f3-acf3-15dc00775014", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617664657, "uuid": "cebcb3f0-daff-4ee4-8a02-1b30164b3a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617664657, "uuid": "020b05b0-1f3d-4b04-9599-ee14bff20f8c", "value": "b22fad7e7ee75d72b9e1fb45ccd9572e8f5989874a7d3409336e2e3d5ee03287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29e1b7d-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647810, "uuid": "0e09e0ec-da58-4601-815b-3c5a8a45ff8c", "comment": "Malware payload (Dridex)", "value": "907aba85d75cb772e932bdc0f0f30389", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647810, "uuid": "4973dbf2-287a-4089-8a05-239ab6bea50f", "comment": "Malware payload (Dridex)", "value": "b26ce60981179a3e08947c8c16faaadcaf5cec20ee9f1f985fcd93cb6545f681", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647810, "uuid": "598041a2-38f3-43f5-95eb-f4def1b91211", "comment": "Malware payload (Dridex)", "value": "72454c468db08f4c1ff297d1361f75aec0acf989", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647810, "uuid": "a9f2759d-b427-4a5b-8338-d33c91c2f156", "comment": "Malware payload (Dridex)", "value": "8143c7791b25e72f3b8115104de9cf5e7bca149cee48bcc4c83fa70ab945cb4c7568b8972c8fb517f1de53ab9c289e93", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647810, "uuid": "463c5524-428a-4d9f-8ab1-3ec1d572d4d4", "value": "6114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647810, "uuid": "f1324ba1-f279-4cd8-85cc-defb580aea1e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647810, "uuid": "7674a3ed-ce07-4584-928e-7c44e040fa6c", "value": "3072:RBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:RBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647810, "uuid": "d2e9495a-8e25-4d05-88b4-c486220622da", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647810, "uuid": "398dd30a-65db-4376-9b8c-73d02cf29070", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647810, "uuid": "fceccd67-6741-4770-9a7b-0a5c971b2fe9", "value": "b26ce60981179a3e08947c8c16faaadcaf5cec20ee9f1f985fcd93cb6545f681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca58cdd-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604287, "uuid": "33b4b4d3-7730-4663-84bd-d2286dc59c0f", "comment": "Malware payload (AgentTesla)", "value": "5c1904a28fb3944c74793d5ddee36a42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604287, "uuid": "33bf1660-f2d9-40f9-84f1-4c418bd2c028", "comment": "Malware payload (AgentTesla)", "value": "b2ccefc9809053d0d590ad346ee8a3fc38ff405eefb28b9e4d8fb287bee761a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604287, "uuid": "37dc75d1-01dd-4f2b-8b49-5f7322d06b1d", "comment": "Malware payload (AgentTesla)", "value": "8d8ded975927b9d2b4dfdcdab7b5277d8bf13ed3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604287, "uuid": "efda4c16-66b8-467a-8630-91750ec122e2", "comment": "Malware payload (AgentTesla)", "value": "df3b590b5f7a78e6a1da2abcbe7ac1f961276223a606a9a93d114549a0fc95ee3bbc3ae86ddbbe39990f0255587ec418", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604287, "uuid": "dcbc3855-6f48-443d-ab02-218209eebd9d", "value": "FC25DE1D72809274E9EA2F34142741511376BE0F7D2DE61E6CFDFE593B33A8A820D692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604287, "uuid": "c559d071-8f63-4d11-9fc6-9259080ab06c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604287, "uuid": "cebc2a45-3972-4e9d-9c1a-77c36a5ea535", "value": "24576:1tejS7Dc9eekhTO9GlQMvYcg0tdJ60/c3:fekDc9eekhK9FSJTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604287, "uuid": "846f4cf1-9721-4d67-8885-137ace6fbd17", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604287, "uuid": "f35d0b94-c411-436a-8283-40fa7c084cea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604287, "uuid": "b7a7e5b8-5c55-42a1-9e4d-f00dbcbc2500", "value": "TRANSACTION_INTTRANSFER_1617266945242 MEDICON_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c3246d-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649560, "uuid": "f2618932-383a-4c01-9ec2-d49364300dba", "comment": "Malware payload (Dridex)", "value": "94519e5abf76f766e30ad8c20e5dcfb5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649560, "uuid": "b0b8d328-b8dd-4840-b82f-0d1dd45035a2", "comment": "Malware payload (Dridex)", "value": "b35372704bd9abbbf1b660dde6b6fdf17d92ff9bdab6c4a3a9e73e83e3fb8e78", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649560, "uuid": "ec69f014-ac0a-4b21-af88-a147b7b9ca60", "comment": "Malware payload (Dridex)", "value": "b6807849e0813f3410bb8cd2f9b3d19312fc7dab", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649560, "uuid": "175fc91a-a936-4d6c-b6d0-14d60f26f8dc", "comment": "Malware payload (Dridex)", "value": "de462c6152becf2eee5f75ad3a001154fde9e65f96d8e54d9fd77c1067c5389dfd2ca20fc8879f4fecdf20d3e43de2b0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649560, "uuid": "9a605bd0-5fb6-4cc3-a330-fcd15747f81a", "value": "8414AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649560, "uuid": "de9ba953-c578-4bf5-b417-c1f4a4543a92", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649560, "uuid": "4a0f7c8c-b18c-4c94-ad77-67d5c594d307", "value": "3072:4BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:4BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649560, "uuid": "aa58d9f4-55b5-4e1c-9de7-267ac70feb69", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649560, "uuid": "46c01642-fbf2-4c42-98cd-7f5849e32a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649560, "uuid": "26bb3824-320b-4000-8c1c-87c9fd123c0d", "value": "b35372704bd9abbbf1b660dde6b6fdf17d92ff9bdab6c4a3a9e73e83e3fb8e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6343d5f-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615147, "uuid": "7a96c828-d390-4321-8b7d-0be3bd68eb19", "comment": "Malware payload", "value": "d14020824b16fd32b2182512256d25cd", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615147, "uuid": "8189fa81-822a-4538-833e-0abe82b8b871", "comment": "Malware payload", "value": "b52a65b2b1353bbf2354a8a629b7e7105caf2a13827e4e0aaa4dde90b6d30ced", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615147, "uuid": "90baa421-6aee-4893-8d20-3905454aeb4f", "comment": "Malware payload", "value": "d0702326f9e56da60bcb822fdf48ae95ee12d85a", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615147, "uuid": "3820e5b9-a5a5-46d1-ba88-853a06b1f636", "comment": "Malware payload", "value": "28bc1bc7449a71de59cb523edead74271eb9b60ed0c7b03c13d8d04e2ef783dddb893163c60e3f58000807bf199a2715", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615147, "uuid": "e3d9c017-b25b-4790-8897-ad8c892ea1b5", "value": "6B663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615147, "uuid": "53392680-b528-4772-bd36-35de65aef4c1", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615147, "uuid": "cf62fc10-2d23-4b82-8dcf-67adb061acce", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazR:kfauN/HYOSIT/EVF9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615147, "uuid": "20ad8499-7cc2-494d-8512-22fa6198e52a", "value": 6967113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615147, "uuid": "0b20312c-5473-40ee-8779-9650c34e2c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615147, "uuid": "56f8489b-e0de-4ac9-a3e3-229344ad862c", "value": "b52a65b2b1353bbf2354a8a629b7e7105caf2a13827e4e0aaa4dde90b6d30ced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5e700e-95a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617581117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617581117, "uuid": "a46946a1-29dc-44e7-9ad9-ded5df1cf4d2", "comment": "Malware payload (AsyncRAT)", "value": "238654e2be62764775f5a2e4e586e706", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617581117, "uuid": "73de5111-5bc4-4c17-965d-9c71fee305e8", "comment": "Malware payload (AsyncRAT)", "value": "b541517770b13a62c4ea7002c3adc3b5a7a5f84b70053b53ade7e1418653cfac", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617581117, "uuid": "5c67c385-79d2-4614-9201-2cab64530204", "comment": "Malware payload (AsyncRAT)", "value": "3aab181066ec5e5849d55642a822cb4be57b42d1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617581117, "uuid": "396a76d8-6fbc-49ce-a427-1a0ab5a557eb", "comment": "Malware payload (AsyncRAT)", "value": "5635b2e90162697c66e8c531c63fceed516d85b57dd0e4a1c5cceffbcbcdc374efe52dc98989a2a542c46e93f168ad3c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617581117, "uuid": "91262104-3628-456f-835b-e5c64af28034", "value": "C80393546188C294DE14FF7CD0B65E0467BE7EF9343DD88E8C8A78AB3EB364546E4209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617581117, "uuid": "78944652-d1ab-416e-90f5-5944a775f50f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617581117, "uuid": "e63032d4-9537-4cd6-bebd-af265f60ab4a", "value": "384:UszM/tpSi7x0ajdNgxYbrMmsoJahXon/o6hwRpllR1RqRVRSRlRURXOR+ckGb/We:U7/tpnB3MRBXoTiHbu7mrsiZwJdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617581117, "uuid": "17e1ecf0-61ba-46b1-83f6-2099a036537b", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617581117, "uuid": "9e535fb4-49f2-4255-9841-bfc73d643866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617581117, "uuid": "5ad2c189-44e5-4002-9425-9435f852926e", "value": "DHLdocument11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324f7fbc-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617627328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627328, "uuid": "7b7694a4-f990-477a-8ba9-2dd15e1dcae4", "comment": "Malware payload", "value": "355049939c321d24725f11e691ad0d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627328, "uuid": "aebf7b60-3d69-4246-a5dc-2b8a782fad01", "comment": "Malware payload", "value": "b6e9b3510fa38447d20fde87e4c53fe26ea91289e9dc4498b7176e3d971faccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627328, "uuid": "6ef77da6-844b-4c04-83fa-2311c0ebca62", "comment": "Malware payload", "value": "ddc73126080f821624043fefb5d97b4ead827691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627328, "uuid": "3fe2561a-d0b4-48e8-bb0e-1d3d896d1bdd", "comment": "Malware payload", "value": "997a0c5432cf1a60d1e51998cd55ace370752a30a4445bc51b7b45b7dcdf0199165c030936645089561715177a74a248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627328, "uuid": "84e28fa4-9957-41fc-bd3c-a9e4d5b4c4d9", "value": "9E46F066B8E604F9C5BEE0308152A322B9713CB587353BD72ED426AA0775FE46B3D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627328, "uuid": "146029d7-6e9d-4cd6-891b-d41b9e5b19f2", "value": "49152:bG0dXKNWfxioNLFq5MWoX60ydzEyAJveHaIoPvgZsarf5lsdJ+b/BKjnGUyeUW9Y:9XCWfAohi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627328, "uuid": "df67bba8-47f7-4793-90d1-0e6244dd4f13", "value": 5605920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627328, "uuid": "be9b1f75-c36a-4b8a-9e44-005d7e3af6fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627328, "uuid": "4a01783c-6796-4d27-8f5d-6fd54c7cf7f9", "value": "355049939c321d24725f11e691ad0d9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f2c1bd-962f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617641717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641717, "uuid": "8dd585ff-ed60-4f19-9d24-a4b93309870a", "comment": "Malware payload (AsyncRAT)", "value": "a047cb9509bc4063bbc0fa13790d8d1a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641717, "uuid": "914f7566-a074-459e-b0b9-8273e1f0f624", "comment": "Malware payload (AsyncRAT)", "value": "b82ad958e9bca1812133f482bcbab72603777eb401c04c347d3849b7cc89f09f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641717, "uuid": "5531847b-4faf-40a8-ad55-8d499820f97b", "comment": "Malware payload (AsyncRAT)", "value": "3abf5bb5dc62c152984033257d09066d0e691e42", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617641717, "uuid": "2c30cac6-86b3-4ed7-83df-0fafc7f6c84b", "comment": "Malware payload (AsyncRAT)", "value": "e60cf178ee27d9b30d4cc36b8a06441a25e52a71d1f29f6ab5b9285424be657c9c8c1c63c47a80f43ee89da584659474", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641717, "uuid": "676877b1-57f3-4022-9b9f-9aa81943f57b", "value": "AFF4CF68268CD516E16E7F7CC12150F173B43CB1ED85DB87BA913CE839B239EA291187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641717, "uuid": "58c968e1-d304-4153-a042-5e09d70debc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641717, "uuid": "aff9335e-97d3-41da-af43-f1e1b7111716", "value": "12288:DDAx25GQlavtbNw76VwOXfcvkTh8KohN/i2ZvAY99PSXpfnwXvTWy:hkQ0vpG7wbvWDlf0Y/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617641717, "uuid": "2eb5ba20-4a66-453f-b1d9-d6030f7f1947", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617641717, "uuid": "65e3d0bf-95fa-49da-a9c1-861bc54518e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617641717, "uuid": "4f04ac8e-682a-423c-8032-634dea532995", "value": "PAYMENT RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd0d8e3-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644446, "uuid": "d3c20cfb-97b8-445d-bd25-c05275f3805f", "comment": "Malware payload (Dridex)", "value": "07a528445662c4de7438ebc6f12f1e63", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644446, "uuid": "c142df2b-3d2e-4955-a6f5-f6ac60b4089d", "comment": "Malware payload (Dridex)", "value": "b9943fd508ceba2991aca1b36c8edab20e0212bd2ad5bea946a67cd42eb101da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644446, "uuid": "25576127-54d4-41a8-a8a3-18541bb67925", "comment": "Malware payload (Dridex)", "value": "af31e3977814cb9d3d3c31782fa271b845b27b0e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644446, "uuid": "b6a76c8f-467d-458a-bd25-0540adc72f45", "comment": "Malware payload (Dridex)", "value": "71864ce4eefab53cc61e78e19f9415bd2db4c4c2568b58997791d3c05fe84493fca3c1746becb1ca352cc0b49e7cf11c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644446, "uuid": "8389e94c-8992-4c55-b529-baf73644d304", "value": "4214AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644446, "uuid": "df7a2210-89c0-4d55-a490-d5ab066b9cea", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644446, "uuid": "53c3e3d0-d5b7-4aec-b971-4f53517589db", "value": "3072:iBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:iBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644446, "uuid": "092b33a1-0da6-4fc9-b207-600dfecc99f4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644446, "uuid": "bba1a11b-09c5-40fa-a1fd-0c753d3a8b63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644446, "uuid": "ad0c5816-bc4f-4950-9f70-1240a515ab5c", "value": "b9943fd508ceba2991aca1b36c8edab20e0212bd2ad5bea946a67cd42eb101da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268d5572-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649642, "uuid": "8235ab24-245f-47dc-91c9-40399ff188e6", "comment": "Malware payload (Dridex)", "value": "5a24ca7e01c3f37584ac45ab58905505", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649642, "uuid": "70277af3-b563-46af-a9eb-a8d8f43c7ae4", "comment": "Malware payload (Dridex)", "value": "bab63b187c0a938d396c75b1f6a451ba27a448a46ab7344860364d31481f1f19", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649642, "uuid": "1b3354ab-3cae-48b8-bd5b-429b17bc2204", "comment": "Malware payload (Dridex)", "value": "16669d961e5ae3d7d940eed5401ef5fb2bf4de9e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649642, "uuid": "7836e03d-3a5e-4fcc-8f4f-72e6442bbc72", "comment": "Malware payload (Dridex)", "value": "a01da74572987ea1aa5a79b82f8a9b702d1b9a814c19c6c6ff352b70fe9991945b34e80b39c2003002001e21f8e986a9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649642, "uuid": "a8c8749f-7c67-4d55-95c6-08d3b91ae3dd", "value": "9C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649642, "uuid": "988e19d0-02d9-4da0-bcde-bc23cc7dd402", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649642, "uuid": "0725bcfe-7b5f-4622-8115-3d2cd11bc332", "value": "3072:IBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:IBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649642, "uuid": "01ff6267-67a8-4bfd-9c06-3cd0ca79e82f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649642, "uuid": "d930e20b-62d6-4a54-8765-bb0038c3f585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649642, "uuid": "34a2032a-e865-4fb3-8747-57aa776b5b87", "value": "bab63b187c0a938d396c75b1f6a451ba27a448a46ab7344860364d31481f1f19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d7eca1-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617604387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604387, "uuid": "5044a1b2-e671-4eb5-8054-b631a3824976", "comment": "Malware payload", "value": "509b71c21edb94cd886708245ea3d522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604387, "uuid": "ca1766a7-578d-4bce-ac7a-e2bebe68d807", "comment": "Malware payload", "value": "bc9cc50af2bb6edf9a3c343311bfc20f90b5244e4d126c22a41a3d2475f2ef76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604387, "uuid": "6138f476-4110-44a4-9449-d933fd4f2a31", "comment": "Malware payload", "value": "2e1203c174c15d07abf2b61eec0d405c754c5051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604387, "uuid": "838e77ee-eb11-45a2-a198-f83810bf09b2", "comment": "Malware payload", "value": "c12d3047907b892dc3558da1f53f537c200a3d0657b881b9d73b3c532800f1bab65fb30cea5382d0a9ce661e55ce5c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604387, "uuid": "45ccf43a-1bfe-436d-bd09-7ed9ec02ec81", "value": "1E05E01276849365ECAA2F34182795550373FE057D2EE60EADCCB15E2F33B878B12792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604387, "uuid": "0d741878-ba70-457a-90c7-16e0898d7fec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604387, "uuid": "51c95ca4-67e3-49ef-aaa4-396a895a693b", "value": "12288:rmEPPlNWVIuJhhsqsY1aclvlJnXvfSnC/N9OzFgmIA9T4lSozSk8:lVNHYwqsYY6XvkC/N9Mz6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604387, "uuid": "41232f02-e907-4696-9613-460de1d3c00d", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604387, "uuid": "78337369-6156-4739-9ee5-e44423fca84d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604387, "uuid": "e825dded-1957-4c39-851d-514024d5fee8", "value": "TW#9898748948-TZE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f5eeef-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650238, "uuid": "2b2511eb-11da-4173-ab1d-4a681b9a5d08", "comment": "Malware payload (Dridex)", "value": "29fb101340e1917d2ca5525182a9c9d9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650238, "uuid": "1ad71aa0-6b8c-4971-aa44-3d14f44ae680", "comment": "Malware payload (Dridex)", "value": "bda8d163cfb77d27607507652af7d38b837609c90cec67d038efc9d5d8d92d73", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650238, "uuid": "0e08d0d0-0311-4c20-9f18-3fa5a171ee52", "comment": "Malware payload (Dridex)", "value": "f3a8b1a76a728a30a40a8be618fed57c75cd21c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650238, "uuid": "c3490091-ff03-46c8-8f06-860af77795f6", "comment": "Malware payload (Dridex)", "value": "e34929d3fb28bf321169be053441ed54ae4cf4c111f0946219ca74cac7af83acaa4442a95cee87c5260f543721df62eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650238, "uuid": "a8bc13de-d2a7-4555-a489-b3d5a1a7a2e8", "value": "2614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650238, "uuid": "74ff1b55-7541-4d06-8fa1-a800fa49da67", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650238, "uuid": "c9d91947-8cf0-40b9-b7b9-507d0639a4d1", "value": "3072:lBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:lBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650238, "uuid": "ae2d0a0d-0026-4544-9194-8f07d71a1ee1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650238, "uuid": "c142b139-462b-4416-bdd2-3443eed9d1ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650238, "uuid": "7c866ca0-3950-43c3-8bbd-2e0d59b2f050", "value": "29fb101340e1917d2ca5525182a9c9d9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4f5c2d-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615161, "uuid": "d2894258-aeb4-4d91-9eec-b21d8e90cc45", "comment": "Malware payload", "value": "399f290d4092909f40188d037c75001e", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615161, "uuid": "c170373c-6409-4a17-b39e-3190d5165480", "comment": "Malware payload", "value": "bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615161, "uuid": "58754a8d-d671-4879-ad8e-52e9cd6200fa", "comment": "Malware payload", "value": "f2db04769b8227882aaca73a1f49e1afc3b0b14f", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615161, "uuid": "31b55417-3133-47cd-b438-06abe8f7a838", "comment": "Malware payload", "value": "f21a8391425c4ae204596a8a2dece9eff24fd8dcfe6f0f70aa629261198409977e3a82b26cbb6ac9ad5f835dbbf984cc", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615161, "uuid": "8819039e-ba25-47e1-85b1-25415a793e48", "value": "71663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A977A303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615161, "uuid": "2290d344-badc-48c0-96ea-f0074bac2fe0", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615161, "uuid": "e2ab62c5-f78c-40d4-9caf-c79e6043132b", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazC:kfauN/HYOSIT/EVF9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615161, "uuid": "c67945f1-a227-4460-aa81-ca7462a3cf69", "value": 6967140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615161, "uuid": "5497b211-0463-45b3-9ce6-06bca7593eef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615161, "uuid": "99fd2bbc-89db-47c3-b0d0-64c8f34e878e", "value": "bda942e7765c6aaca064d28e3ebab5a7c22be23469b4c4a8b07f907229b7ff25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73a12b0-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615176, "uuid": "d14873d1-3aed-42f2-ad00-183375839883", "comment": "Malware payload", "value": "433f2dd33ad43581ccd248d2fc65d9ab", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615176, "uuid": "1dcb5238-8cfa-4505-8e38-fb7b6330f89b", "comment": "Malware payload", "value": "bf4e77987670328a733aace139f5d47e600d3f98a6edef633d34cd47094818da", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615176, "uuid": "eee330a9-f531-4cf8-88da-31d0473bc88e", "comment": "Malware payload", "value": "e59089829cdc087eda6a879bcdf613ae57602c6a", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615176, "uuid": "da1686a8-605e-43bb-8668-97e7ebb96c20", "comment": "Malware payload", "value": "11ab79b04ce7ac80d686ef396281301e54258b714f337b611d5803730e04edf0c7f1676c9ef54d12d21968d0055ab06c", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615176, "uuid": "6a0670a2-f8a9-4708-a527-f9099daf2ebc", "value": "6A663381B092CC7AE8F3253606B7D1346D7EFD130B1049BB62AC4A537E61B92B779219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615176, "uuid": "0445f42c-1a2d-4efe-945c-30fee5449e70", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615176, "uuid": "1103fdde-392d-44af-816f-ff284579346c", "value": "196608:qbuCCCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazD:huN/HYOSIT/EVF9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615176, "uuid": "125a6b44-7510-4ef7-a54f-3f547a6295e8", "value": 6966592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615176, "uuid": "3d6cfebe-a4a5-442e-9b12-582bcc1beb8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615176, "uuid": "e5b5b045-09a1-439b-9aba-efbda04130fc", "value": "bf4e77987670328a733aace139f5d47e600d3f98a6edef633d34cd47094818da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc838be9-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647853, "uuid": "458f9480-acea-4c09-befb-dd419b03f184", "comment": "Malware payload (Dridex)", "value": "13ce6a7528c3637bf20c270a5aa6d784", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647853, "uuid": "fd012936-d9d1-4b68-a210-a19919bc8ce2", "comment": "Malware payload (Dridex)", "value": "c07f138a7f49954038222ee397af882a2c06b52c226b040219da88a704a42c50", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647853, "uuid": "540a1f9f-d7d0-4150-8562-d9a150dae6f2", "comment": "Malware payload (Dridex)", "value": "674b7d06d49b9599ce7e4a26ae2d1a680cd1d0d0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647853, "uuid": "d26e13f7-3e65-4174-90a6-2b1a7cf88cf1", "comment": "Malware payload (Dridex)", "value": "8927d1e5234d3e8c8592789636439a811e993494a39e51c0e38ea58e54349c4c432bde5a31f21aebf96c31812aaf91ba", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647853, "uuid": "0684039b-29fe-4073-99c4-2eec944f0ab8", "value": "F114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647853, "uuid": "d7c9dcd8-915b-4ed1-8fbf-8dc8771491b7", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647853, "uuid": "e785015c-e8a5-4d65-860f-75c0052ad393", "value": "3072:VBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:VBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647853, "uuid": "f8a6e67f-3c42-4264-8254-0be45bc681d7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647853, "uuid": "edc38750-5aa0-42f3-91f4-027e3d676911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647853, "uuid": "61d0d3bd-4b09-47a2-a653-979a11fa8507", "value": "c07f138a7f49954038222ee397af882a2c06b52c226b040219da88a704a42c50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4b6a9b-961b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617632899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632899, "uuid": "e02f24fe-c418-4075-bbc1-b30392b19842", "comment": "Malware payload (AZORult)", "value": "539bc38a1f4437ced0539a84f8a14afd", "object_relation": "md5", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632899, "uuid": "720550fb-a265-4c49-8264-57cd69a89d80", "comment": "Malware payload (AZORult)", "value": "c096616d7f98e5e26ac525769c7c4912cbb16e04d8af600aa0900a1d02e86c22", "object_relation": "sha256", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632899, "uuid": "726f3b5a-aade-44fb-85aa-2555d4a0f154", "comment": "Malware payload (AZORult)", "value": "e11339a97e3228c52ef5c65792f7364b8e03ce05", "object_relation": "sha1", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632899, "uuid": "d2c28062-169c-4b45-b684-223a09ff695f", "comment": "Malware payload (AZORult)", "value": "2aa0b49c48109b3818e79f48a8576d85f32cd3295101e915921e8d72ff9c6ce693db334901c034657fb19e2aa3139434", "object_relation": "sha3-384", "Tag": [ { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632899, "uuid": "710b4912-7767-4ffb-bd5a-32533346c0ad", "value": "E3E31247F45D10749F261476FCAA006B14A2E1B9AA705B2C4B3441BEE05E82EFD7E0BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632899, "uuid": "e8f44902-21f6-48d0-895a-61ce421ace02", "value": "1536:hIsmOlyzQfVBLQMq2LWUt6UXgZKzcr7PJO0ppV9PrlNdBWXRcJDkkMzk8R79y5jo:uNQdBLtRWUt6sgDFPrlNygHGx2f/J8nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632899, "uuid": "8ec594d9-ef2d-44cb-a651-3879c4d6ed4a", "value": 144409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632899, "uuid": "3e48d40f-2668-4113-907f-a9c6a1f72903", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632899, "uuid": "dcab60ff-e742-4f5e-8ea0-2224d3af41cc", "value": "TKS6670.r19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b61650-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "5580222b-d3d4-4a52-9ce0-cb0aee38fa71", "comment": "Malware payload (Dridex)", "value": "df8dc7c018f4fe16e6a4873d90d02011", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "d64279e8-f827-4bb4-b943-f22030b7319e", "comment": "Malware payload (Dridex)", "value": "c0c36b0948b31bfbd7955f8403fab37a629e612ba661266798e23432b69bab72", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "7adc901c-c554-4fd5-9cab-5913e77bf20d", "comment": "Malware payload (Dridex)", "value": "ccf73f7eadfe7c4fd7c5fa8b8dd846174707fd07", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647834, "uuid": "dbc6562c-1244-4013-b327-1bfa753aec52", "comment": "Malware payload (Dridex)", "value": "62303abc4430b213516fc6c88c75ec9b3bb4760f284bc5c5d4990b78148203eb7531a8f9f03de9d4aad77c77c99af969", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "3ae375c1-9508-4234-9594-f0c0618f8954", "value": "D614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "00caaedc-1e93-4c3f-9323-93dafec46ce1", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "98a975e4-a463-4e73-a780-02f25eb76392", "value": "3072:2BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:2BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647834, "uuid": "a23bede6-2a3d-42f8-9b9c-ba77ab892442", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647834, "uuid": "3277f832-bf33-4bc4-8175-0c9af23969a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647834, "uuid": "41630bc0-0311-4468-a3a9-bef2922940b1", "value": "c0c36b0948b31bfbd7955f8403fab37a629e612ba661266798e23432b69bab72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec42ed35-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649974, "uuid": "26727868-ec4f-4222-8b4c-1d9eaa52a13d", "comment": "Malware payload (Dridex)", "value": "74fd9fb5290bae92425cc0ca02960abf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649974, "uuid": "e73c9e03-2de2-460a-98de-9d9104e03b2a", "comment": "Malware payload (Dridex)", "value": "c15ab1a435149a1c7162c9df6940036dfb5c46b880cd9d82481ebe74700959e9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649974, "uuid": "09d35e37-7f94-4d0c-bfe8-4ebee038bd22", "comment": "Malware payload (Dridex)", "value": "ff2cf63ff40e55a364519abc65c180f40b58c8fd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649974, "uuid": "2ccc6246-c884-400c-af64-7740dede0a7c", "comment": "Malware payload (Dridex)", "value": "63b2c00a715c6826ee2706addcacae4f7c0ec476b1b3cd7231f317398b8ed99e130f600b0bd45c188e940470454929f6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649974, "uuid": "195e2ea0-0347-426d-97f8-8811d279d373", "value": "4914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649974, "uuid": "651037b8-83ef-4685-91ff-a5ce6209f37e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649974, "uuid": "55f7a11c-1d42-4bec-b584-1e40073be38c", "value": "3072:NBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:NBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649974, "uuid": "1fb52523-d7f8-4999-ac7c-0a898f33abe9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649974, "uuid": "0d06f384-99cd-4aee-bb71-f32fa3d529d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649974, "uuid": "e49a2831-d107-4b9e-9828-a57ac33b260a", "value": "c15ab1a435149a1c7162c9df6940036dfb5c46b880cd9d82481ebe74700959e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a8e84f-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649862, "uuid": "07e08f83-3c03-481d-867a-1da7b6e31a08", "comment": "Malware payload (Dridex)", "value": "534413ac8498cd6de115a206ff83635d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649862, "uuid": "ea2c4be6-e775-4e44-ad01-fffdfd67d65e", "comment": "Malware payload (Dridex)", "value": "c18dce85ab5de978068a730a1c85bc25065af792018dee37e172f074b68c7133", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649862, "uuid": "690fa991-901f-43a6-9434-8a1db7ebbbc7", "comment": "Malware payload (Dridex)", "value": "c9dcf346d2cbc43ed268bbc4a81d9e035fc25188", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649862, "uuid": "b0c83def-4991-49fd-963c-9a955ffcd200", "comment": "Malware payload (Dridex)", "value": "890063a329a4a914fd2faa78616eadaf4ef60604e54285652985a8b60fa89fd2a1d0dbf4942728334274af4079ac5305", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649862, "uuid": "1f97130d-ca53-47a7-9ee6-79b35901c294", "value": "6914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649862, "uuid": "e5b708fe-92ae-4b5b-8c91-e677bfb0ec4f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649862, "uuid": "70abdc91-9cbe-4e17-ba9f-82547499fe5c", "value": "3072:kBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:kBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649862, "uuid": "acc7df51-f509-4105-9063-3b6bcbbed2b3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649862, "uuid": "6ab55901-740f-4ba1-86ff-693131922c3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649862, "uuid": "78f29b0e-18dd-4d05-8d9a-14fa90dd4e09", "value": "c18dce85ab5de978068a730a1c85bc25065af792018dee37e172f074b68c7133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9136f227-95d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617602576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602576, "uuid": "d446d047-f10d-4b7a-9b55-c9fdfbecb3ec", "comment": "Malware payload (RemcosRAT)", "value": "c351441c20f9de042015f4e84682f15e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602576, "uuid": "827c0822-44c3-44ac-95ce-1c989988fdcd", "comment": "Malware payload (RemcosRAT)", "value": "c1df0eeb278d0021657d4610e403aecc826dd38e3e70fe4129723fcf651967a0", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602576, "uuid": "1f760ee7-0b4c-4f2d-92cb-6bf48bb35ead", "comment": "Malware payload (RemcosRAT)", "value": "dfa0d968c116572da15739be886623030a69863f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602576, "uuid": "0e6a5393-f948-4af0-be3f-e8494980348b", "comment": "Malware payload (RemcosRAT)", "value": "ee684610cdfccd8f06ceee9ca54f4a9607cfc3ce61a36f714f829c61368a92aad3aeb1d955a8b51cbf8cf1fd05747102", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602576, "uuid": "dfc45d52-ad05-4794-981e-b6cb20ea172b", "value": "78E301997A1A4039FB01E23852E2FA8180E374FA8CB3E457754E70C80F1B9A59D637C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602576, "uuid": "dd255799-6c26-4011-aad7-0c87a0e50302", "value": "1536:a7YTuUqTWUQdNkTo64ExewVny84RSnvnTIt3FIaxm4MPAoszOSJszb96CSCvm:JSHQdzExesvnTIt36/4MYos6gsn9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617602576, "uuid": "cab27d66-6fc9-4a50-a7b0-f318c4e96b22", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617602576, "uuid": "20c00ccd-0fbf-46f8-b21a-beee8842425c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602576, "uuid": "01e18a77-ea80-4775-8b29-5414262f942b", "value": "PO-21055-COPY.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2409b3fb-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617627304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627304, "uuid": "a98a239a-1374-4920-8af7-7412aef87266", "comment": "Malware payload", "value": "f42e0c667660baafc30102528fb3faee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627304, "uuid": "9bb32dd6-6bcc-4e9e-9906-ac629c295f8d", "comment": "Malware payload", "value": "c2b078e623fb594ee45a6ebcbcf023e9799f3b5066b798fa225d07e15144e353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627304, "uuid": "c099e099-640f-478e-8ab1-95dc8984472a", "comment": "Malware payload", "value": "ed351771784669ea8690be2d339a8b26150e926d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627304, "uuid": "44a6be03-0254-483b-932c-f0b99e299152", "comment": "Malware payload", "value": "69c2abdd6087ab3e55c7f8912185cd519cacd7e638091c5e36c1f6a49b4dd9a0ba26d3c3afb68cfc08475745689ad5fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627304, "uuid": "ec291159-0b4c-4450-9098-84381c112605", "value": "3A45012BBB750516F08245B1199599F35B3EAC337292AC0FE3439E1814E2686F8F177B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627304, "uuid": "3ad1445a-ac9a-470d-addc-362468923191", "value": "12288:VfXKDZ+P0rMoV1JsOs8tEDO7y8xL9WFoHLBVfeg/fXvf0JoAXtUrAWacPfXf1myC:xK4PWB/sf8iD78xgIvf0JICiNcSkCVCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627304, "uuid": "83b0d6ca-4c20-4803-bdb4-92fe0689ec7b", "value": 1222071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627304, "uuid": "66d8fe2f-e55d-4cd2-8a14-b586403792c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627304, "uuid": "72b0a937-538f-4ab8-9301-456fa4437ddb", "value": "f42e0c667660baafc30102528fb3faee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c939b427-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646479, "uuid": "682a6b50-2b2f-46a0-a4b5-50c0a8f6b429", "comment": "Malware payload (Dridex)", "value": "c7b00f96850f6de77239e4a5d2ecbc6f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646479, "uuid": "0425859d-26f7-4aaf-8cf7-dca7e1cee253", "comment": "Malware payload (Dridex)", "value": "c2d4f5ae5be9c3dea1be397cca4446038104d48d16e82e32dbb08a9a7ecb246a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646479, "uuid": "2df1682a-aaa4-48c3-b0e0-c3022b67d323", "comment": "Malware payload (Dridex)", "value": "cb0e9293de9d5cb63dd1af986d51ca581543506c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646479, "uuid": "a919496f-9542-4810-944f-2d3b4c4e1ee7", "comment": "Malware payload (Dridex)", "value": "dfd558dee31256f58fba09526a83aceecfec1ba3dcd87e7995bcaa2df11372f7b91009b3b5334d93e5dd2666b7219bda", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646479, "uuid": "d8ee74b4-dd42-4be5-b889-c9511fe501cc", "value": "1F149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646479, "uuid": "01702a73-fa2e-4172-a6d2-ffe4dfd115eb", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646479, "uuid": "7ae8bc7e-cbc0-4716-8e20-519a683aa603", "value": "3072:v6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:vZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646479, "uuid": "2e9f84f6-e705-4941-bf44-a9cf97d0a5ef", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646479, "uuid": "80126045-eb9f-486d-8071-1800eb5ff370", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646479, "uuid": "246db99f-7a9e-4633-9580-eec433e6a337", "value": "c2d4f5ae5be9c3dea1be397cca4446038104d48d16e82e32dbb08a9a7ecb246a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8585c419-9667-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617665693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665693, "uuid": "2421aa65-c655-43aa-bb67-705d04a847ac", "comment": "Malware payload", "value": "2bece3dba7813f59e577a339aca76131", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665693, "uuid": "8ad0599f-8e69-482e-aef1-d8501a395a54", "comment": "Malware payload", "value": "c38cec4043e8dd29070c4af0d7edaced125261c462b8de12674abe68f4c4b9ad", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665693, "uuid": "323f18a1-c895-4fb3-a94a-c8f1f131a8d5", "comment": "Malware payload", "value": "27691418d9ae7015a772278698928a64e38e6d2c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665693, "uuid": "a24a15e7-85d3-426a-a289-8ebe16d10044", "comment": "Malware payload", "value": "9f2bb19de962eb29725f77932a5fede248274efe0d22a2e33933a60e5ebdd3da9b3221282a1c6118aa8801e14f41ea73", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665693, "uuid": "ea9366a9-5cc3-447b-afd0-fddb1e14478d", "value": "C7149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665693, "uuid": "e9ab76e6-2b6e-437e-b921-40f8086de71d", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665693, "uuid": "ec171673-22b0-4bfc-a387-ec5a0ddd5ed0", "value": "3072:p6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:pZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617665693, "uuid": "01e229a9-e3be-420a-88b1-c5394ddc2d21", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617665693, "uuid": "f75ea30a-9232-48de-aee5-28a035bcbfed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665693, "uuid": "89020a24-8896-436f-9edd-45163832a7e7", "value": "c38cec4043e8dd29070c4af0d7edaced125261c462b8de12674abe68f4c4b9ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4120691a-9648-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617652263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652263, "uuid": "bd8df137-1292-49fc-aa49-7d37a4542d35", "comment": "Malware payload (Dridex)", "value": "6d65bad3b09bd3185bb622be6f6d6208", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652263, "uuid": "2d8a9ca3-8e8a-4571-8f55-6ea24ab0cf07", "comment": "Malware payload (Dridex)", "value": "c3b8ae2c45451739c88c7acaf94911de6b7b3fd7990caf681cc4fbc47d3793b3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652263, "uuid": "63f3af9f-7b34-4504-9e9a-25e6b5a79c1f", "comment": "Malware payload (Dridex)", "value": "d02c7f7f0f64bd12bf6d04da038a356ebbf52fb1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652263, "uuid": "e06096b7-72e4-4ca8-9079-fd69dbe88352", "comment": "Malware payload (Dridex)", "value": "266aecad82e0bf0aefb1fcf592bedee1522eb7137e7bcda8e740ac9c566718299339f603dc67cad6cb0c068087b7d917", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652263, "uuid": "73011cf9-7ca7-44b4-bee8-23a5eb0946f6", "value": "6E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652263, "uuid": "ba4a91d7-2d2f-4bb4-9a1a-570f792f4ede", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652263, "uuid": "c2b33a2b-0c46-4aae-bca3-3949be7cf2c1", "value": "3072:UBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:UBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617652263, "uuid": "b81f72c0-83d5-438e-9bdc-fe2098342d9f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617652263, "uuid": "b9c57a31-1f93-44de-a0ca-d0bcba8670e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652263, "uuid": "6cd3c74b-d7f1-4809-91f6-c2663bb2b348", "value": "c3b8ae2c45451739c88c7acaf94911de6b7b3fd7990caf681cc4fbc47d3793b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859a1644-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644218, "uuid": "3e8ec47f-0fc9-424e-89f5-7019b15e8b61", "comment": "Malware payload (Dridex)", "value": "dee4a640d859f410a776b754e23243a1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644218, "uuid": "bcf27713-4cbd-46d0-8368-029090e2c56e", "comment": "Malware payload (Dridex)", "value": "c4033ea51571762a87331f36f693f5d73e3f8ddcc920eda94a57590ceda57fb2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644218, "uuid": "5348bedf-a32d-4649-9787-cd64c1a03e1c", "comment": "Malware payload (Dridex)", "value": "e31bf00994cdc01f86f42fd0856f4b54a8bcf302", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644218, "uuid": "888675d7-6021-4bc7-b8fb-4622e08cca79", "comment": "Malware payload (Dridex)", "value": "38c0335c82de11db3aa38de4fd5177bb2789232806e75d6f7362baad21fdcc0be240974dcb63ce0cfabf9f1b87e0bdb3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644218, "uuid": "b40475ab-c006-4fc8-92e7-2a7d4f9c7a9c", "value": "4F14AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644218, "uuid": "0582c024-0791-4c91-8ae3-bda254724ea2", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644218, "uuid": "3b232d8d-a9af-46ec-bc34-3befb5a6fedb", "value": "3072:SBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:SBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644218, "uuid": "64be1096-4281-4c89-a6d6-21bb92125bdc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644218, "uuid": "8e81f016-bc6d-4ad3-8e52-377efdd16314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644218, "uuid": "b6cd1e99-7a88-48d9-ae28-b3e0d3d6fb6d", "value": "c4033ea51571762a87331f36f693f5d73e3f8ddcc920eda94a57590ceda57fb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61190c80-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644157, "uuid": "7ce89bf7-bf0e-4467-983d-c053d4d221ed", "comment": "Malware payload (Dridex)", "value": "25b11a4511a74b9b53c3ccddf8143b77", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644157, "uuid": "14b46012-4f93-437f-8971-6014989b3d6f", "comment": "Malware payload (Dridex)", "value": "c4e1bdf1f97eec680f19e2d5e3de9d2467c0ba72de30125e98256de1ce8b477f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644157, "uuid": "365a09a3-1075-46d2-bc8c-ce437fc6135b", "comment": "Malware payload (Dridex)", "value": "f0ea6f6a7d94d0760f292b5f98007d7e5ee9d9ff", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644157, "uuid": "be0e3f2e-18f3-492d-bd03-6406ad974196", "comment": "Malware payload (Dridex)", "value": "c8646f5341a757c29ed6d092df05680ff58e17a40ea0e71d8ca758427811882f7a21cb345eed154afecbc6a40a7eb4ab", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644157, "uuid": "8079e5f7-0196-44ac-acf1-794c13152284", "value": "5414AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644157, "uuid": "d5db364b-e5ca-460b-9a69-81847e7007fc", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644157, "uuid": "4a96ebf6-9631-4a62-89d9-b6e64a5e6e80", "value": "3072:EBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:EBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644157, "uuid": "4719adf3-b7a8-4b9e-bd2d-639c5f218b50", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644157, "uuid": "6fb257e4-c13c-48f5-9429-59e7b9b94495", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644157, "uuid": "4ba91ece-66ff-4505-9a20-6a0932911454", "value": "c4e1bdf1f97eec680f19e2d5e3de9d2467c0ba72de30125e98256de1ce8b477f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e960925-961a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617632502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632502, "uuid": "5172f034-b38c-4643-bb2c-c8d0c17e0066", "comment": "Malware payload (Dridex)", "value": "037a2f59adfc465c86514df41ff400fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632502, "uuid": "41d85b72-9450-4d27-8e5c-999a0fd5123e", "comment": "Malware payload (Dridex)", "value": "c62ec8e32f33269959656c043e2efd0d07f2372c4be0129706832ed9047849b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632502, "uuid": "882f6c9f-fc7c-45a9-bea0-b5b08e4cb562", "comment": "Malware payload (Dridex)", "value": "326738d0a50599181306527ec3c6fe7c2aac54f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632502, "uuid": "d4d661b7-65c7-4e62-8cb7-23f0f9a37ff1", "comment": "Malware payload (Dridex)", "value": "ea99464deb7fc45cf777456e98fe0cb831360bc5ad9aacd8a2e585f541cf9f67ee5aefcd81c099a5296274b0900188d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632502, "uuid": "92b18ef9-975c-4fcc-91e0-be9d6f73105a", "value": "BF94BF05A317A02AEBA3443E355136FEE5541E3C1A238997D2977EA829343F1A4F4F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632502, "uuid": "fe350a3f-b409-4e44-a768-953dee288211", "value": "3f3ba078c16643680f43f2373ecf22c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632502, "uuid": "f0b4baff-0903-4a2d-9c99-7027dfff7197", "value": "12288:eY92Tq7zYZ/WsddXagbXVbijaLP0vGz2:eY92Tq7zYZ/ZDX3bXVbijarwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632502, "uuid": "27ce5471-f0de-4bc2-af0c-b3155a2badcb", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632502, "uuid": "40132f75-a896-4b4c-abb9-f8c9c196481f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632502, "uuid": "b47d0503-3710-406c-b061-4159f28f20cb", "value": "037a2f59adfc465c86514df41ff400fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d403b7a-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644633, "uuid": "82317cc1-eeb4-4ae9-b482-121d1caecc57", "comment": "Malware payload (Dridex)", "value": "6a0cef92d84163b1370dd327175c277d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644633, "uuid": "7d37f231-c4fc-4a92-9f92-60464e09b0ac", "comment": "Malware payload (Dridex)", "value": "c632a87b7492d5f664ecb05339b10eca861a8db89eed13d29db862041c5fb6fd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644633, "uuid": "d3cc6d9e-f061-4ba6-ba64-1cd28ee71e28", "comment": "Malware payload (Dridex)", "value": "98ac7229970f3a543b7d93a3a56170b70209efa5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644633, "uuid": "bd67186e-98a4-4b8c-94ee-ef7c85e56d72", "comment": "Malware payload (Dridex)", "value": "9d746bb4556b5c5fa11e7e8366f176f7d8f3a1167328e86ea43b8df5b96cd56990421afaa8aa70b1bf50c1ae79f4f240", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644633, "uuid": "46ece96b-08f2-48bc-81dc-943694e9db20", "value": "9B14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644633, "uuid": "1b43ed29-d77d-40c9-866e-c20ce366bc75", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644633, "uuid": "a2b06126-7d10-4c5b-b4aa-e4a8f06f7d9a", "value": "3072:aBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:aBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644633, "uuid": "6a7d7164-059e-410a-9798-51f90591e31a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644633, "uuid": "fbdbdf21-1e22-4cdf-8e72-d82bf3874701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644633, "uuid": "b4b545f9-07af-4a89-a2a3-d5ee88e3b08f", "value": "c632a87b7492d5f664ecb05339b10eca861a8db89eed13d29db862041c5fb6fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d183e64-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650136, "uuid": "27f060ad-64f9-4dac-934b-b9cd11644c31", "comment": "Malware payload (Dridex)", "value": "64da431054504c753837cf91bfd4f922", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650136, "uuid": "795f1843-137b-4c75-949c-57a928f8630c", "comment": "Malware payload (Dridex)", "value": "c6ad8689af0ccdf57f71d6e7d52dcebaa2d9866c75617bba443d0366774c3747", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650136, "uuid": "1380afe9-1a7e-4869-bcac-e6625c0943a9", "comment": "Malware payload (Dridex)", "value": "f627ecfe5a549beb1a821876f0d11f796582d538", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650136, "uuid": "4c91913d-7d9a-471b-af1f-e12a5ff8f00f", "comment": "Malware payload (Dridex)", "value": "17720d956e7a58c65bf9e874a3f2deaca08b4b346b70205aeee937c98df1801552f2b24c67823a53f426c38feaf2224a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650136, "uuid": "bbea5f87-d493-433c-ace1-f122e8a4435e", "value": "A714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650136, "uuid": "a2f2edbe-a889-4f73-98e9-82f264308aec", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650136, "uuid": "53303e10-8e29-4215-beb4-c02db4f4d96b", "value": "3072:aBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:aBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650136, "uuid": "0977f2be-9072-452e-b4e8-1647b138be59", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650136, "uuid": "5dca7d63-15e7-4508-9a12-7e81fc926de3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650136, "uuid": "ca8b6f41-a254-48be-8ffa-b6f7eea16455", "value": "c6ad8689af0ccdf57f71d6e7d52dcebaa2d9866c75617bba443d0366774c3747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9404a8f-95f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615206, "uuid": "fe01f64d-5302-4a8b-b5d7-9e5a7c5ea6b3", "comment": "Malware payload", "value": "0094ddabaa4f3d4229b4e78deb1d7d9d", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615206, "uuid": "51d22be6-2dad-4250-a87f-5d850681e411", "comment": "Malware payload", "value": "c6ccf378d15a7507961614597999d5fc963b3f59b74006ef0cff3e99c2cd02f0", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615206, "uuid": "d6c5e34a-8b69-4a22-a7b8-548be9d3d7db", "comment": "Malware payload", "value": "3a114da90f80d6109975d5f3bf5270cfe9922819", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615206, "uuid": "c25f8fc6-a6be-407b-b479-2aafa2b6cbc3", "comment": "Malware payload", "value": "9f9f8ee5f4b6760ca3a581db31c7ccc10a3d5cba25fa47a2f09f47672c4f4cbb3640f380e63dff2f57ac1163e22c0e8c", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615206, "uuid": "749a5833-807f-4ce1-a2ed-22d2de29bcf4", "value": "B5863381F0A28CF7F8FA15362AB2D13A3ABAF513074545EF139C16937925391A77C62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615206, "uuid": "92729256-cb1a-4586-bc9c-061e8f0aa07f", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615206, "uuid": "a21655be-80fc-4265-bcfd-10d6f886625a", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazSXrIQQtIkz:kfauN/HYOSIT/EVF9YTQth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615206, "uuid": "5af12fe0-6a57-4241-a166-9b7fe5486bd2", "value": 8230498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615206, "uuid": "4887eed9-abec-4ddb-a35a-5e8aef30fab1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615206, "uuid": "db46a4b1-2d85-4d75-b344-66c7cfd9756c", "value": "c6ccf378d15a7507961614597999d5fc963b3f59b74006ef0cff3e99c2cd02f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c5a6c9-961a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617632602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632602, "uuid": "d3bfde92-b4b3-4646-aa6e-f0193a2fe9d9", "comment": "Malware payload (Dridex)", "value": "0683355cf49dbfa8fb2865a1c5e72633", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632602, "uuid": "3dee3bd7-51c3-41c3-bbfa-7b0bb8a283a5", "comment": "Malware payload (Dridex)", "value": "c73ed14ba72eaabbb2c2f72626ba0cddfb59b88d47f3f354bf0c1b37b8759fe6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632602, "uuid": "05ff2abc-1ef0-44f9-aa25-4bd3ab86a578", "comment": "Malware payload (Dridex)", "value": "454e26997a9ecdd570706f637241c1a5619b7d4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632602, "uuid": "f440123f-4d18-433e-a937-a6a40c52bd2d", "comment": "Malware payload (Dridex)", "value": "188d9dfaa05ba37db3934498b30170f9d3764fb42dcbc0d78bb948290a0c3c745073d60000ddf176f1b447f47ad762a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632602, "uuid": "e626856b-4ba4-40ac-b8d4-b2eff7f523e4", "value": "C073E19DA57E724CF73340BCE5182A9BA34D30F15E00A50DED72310F57A6ECA3A5A396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632602, "uuid": "0f9f915c-f36b-4a59-b764-499c031d8cf7", "value": "1536:cYwxIP2YdDB3AeWOiX0mT/WGH+lMVGoIahaDHTU6hryF70w:cYwxIP2YRB3Ri1/W2+2sTU2yF70w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632602, "uuid": "823caf88-8203-4534-b623-ee28b12c3ca7", "value": 80500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632602, "uuid": "5bd15f3c-af8f-406e-84c1-302c54c5bf30", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632602, "uuid": "dc408cf9-c30d-4ad4-9ce4-a689f8d2e741", "value": "Documents_1760959998_1062944183.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc92303-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649604, "uuid": "2a03518f-a74f-4fe5-a28d-5bf00510b76b", "comment": "Malware payload (Dridex)", "value": "3697b1e1c3e677e86361423108d58231", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649604, "uuid": "77751afd-ed0d-42a9-bed4-0143041f1089", "comment": "Malware payload (Dridex)", "value": "c745689396697bb2c81d0eada13ee045658be6c4d71e20a45694cc2a3f0a0da4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649604, "uuid": "f8a3427d-bd68-4ba2-8c64-b24d0ca0f74e", "comment": "Malware payload (Dridex)", "value": "1cbdad97331d3efc5680fbf7747aace02478b7ca", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649604, "uuid": "3c56bbcf-e73b-42ea-ac5e-4db91b592edc", "comment": "Malware payload (Dridex)", "value": "210b83d4431169c970cf4e39d69ca4753cc85e776c7c9b07ef0ad7a3500fe4872796dd2f09a4b1868118a3709ac6d65a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649604, "uuid": "20c67c05-2972-48a7-bc63-7fa3f63785a1", "value": "6214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649604, "uuid": "ef44539f-bfbd-4a65-940b-35a528f028a4", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649604, "uuid": "f5c19884-557e-416c-8b6c-9a5cac80ef54", "value": "3072:6BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:6BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649604, "uuid": "23288e43-3d8f-4659-8353-f917ebab15ec", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649604, "uuid": "fe19ffc4-0ee9-4605-b3a6-b4bf5c757df8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649604, "uuid": "d36a5f95-6a04-4fef-bb24-45531d1ed56b", "value": "c745689396697bb2c81d0eada13ee045658be6c4d71e20a45694cc2a3f0a0da4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5010758a-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647994, "uuid": "6b79593e-2096-43ea-b52d-d157f0ff53f7", "comment": "Malware payload (Dridex)", "value": "6e4f286f95e1c3fa054e7686aa723c13", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647994, "uuid": "83e917ca-f2c6-47d2-b4b1-59682b6e9f93", "comment": "Malware payload (Dridex)", "value": "c7abe437bda66a1bb505c252dc067a0ed508aede3cfa4c7d3b17c8845dedfe75", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647994, "uuid": "ef8afb99-4c14-4d90-a87d-3143facdf21d", "comment": "Malware payload (Dridex)", "value": "d96cd3bb447c741095842021c724055baa940858", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647994, "uuid": "7ae81160-2763-43cc-9045-cc88524411a0", "comment": "Malware payload (Dridex)", "value": "907a473f9a37005cfe3039c8a3ad3c23fc0cf4027c9cf5b56c541fca788d7475052b712516b619750ac9322479783f62", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647994, "uuid": "4881395c-66cb-4236-952d-f37374427e81", "value": "5314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647994, "uuid": "a5c5d43b-d2d4-4458-8f65-ee02f198f84c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647994, "uuid": "d5219a1f-4173-427e-9462-79eebcf39ec8", "value": "3072:UBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:UBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647994, "uuid": "f663ec07-1ba5-41f2-a6fc-151f0f3e8706", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647994, "uuid": "444b42d2-c1ed-4c9c-8fd6-3ff698a72c56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647994, "uuid": "971e949d-4c29-417b-a659-e5a2bd141915", "value": "c7abe437bda66a1bb505c252dc067a0ed508aede3cfa4c7d3b17c8845dedfe75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e2f8b9-95ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617598403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598403, "uuid": "53c3ea8f-bfa8-404e-aba5-8ee85c33c869", "comment": "Malware payload (Dridex)", "value": "b0dbc0693b1f165a85c582c96faa6cfa", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598403, "uuid": "adaade93-ac6e-43d9-a7f7-799cc90c4d40", "comment": "Malware payload (Dridex)", "value": "c8e7238efe1fe73ffaa9ef24972602b11c6c2e633a95a883794607bd88de5375", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598403, "uuid": "c9796725-127f-4da0-8d87-aca5b13982f2", "comment": "Malware payload (Dridex)", "value": "c8224c465acd76b6e9e1be31c864fe0f15d9bdcb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617598403, "uuid": "14c79d62-2b04-40ca-99c8-8fdc0e19278b", "comment": "Malware payload (Dridex)", "value": "d739a7c6149c61cbb589e3b6d1c923cfc97181422a722ddcbe055f6467b21641de80eff7984e8aa7e4cd0214be71aa96", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598403, "uuid": "1b04f2cb-25d2-41d5-8951-df1b998ccf2f", "value": "D414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598403, "uuid": "69aca6e1-bd82-4ce3-8598-0fcffb62f7d1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598403, "uuid": "8f4c8192-4719-4e89-a9c5-c3c96409ecc4", "value": "3072:Sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:lpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617598403, "uuid": "8d2a3b02-10f8-41b9-b0d8-f4f258d29e7b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617598403, "uuid": "4be08831-d325-4237-8f16-72903048dfd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617598403, "uuid": "4ff5cb2f-2ad7-4239-abdb-a83ab1878d31", "value": "c8e7238efe1fe73ffaa9ef24972602b11c6c2e633a95a883794607bd88de5375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7da25d-9634-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617643775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643775, "uuid": "80469a87-c73e-4b32-ae44-1b6964f298b6", "comment": "Malware payload (Vjw0rm)", "value": "c43168b1b2dd02c6f36195f78ff2965d", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643775, "uuid": "778abd8c-1ca5-46e6-86e3-3886a28a7dea", "comment": "Malware payload (Vjw0rm)", "value": "c9773c0e6400723de53caa5fa8688975700ad7e6401630c202174e0014b57e58", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643775, "uuid": "519d54fa-adbb-432a-bcd5-5b6bf4723a3e", "comment": "Malware payload (Vjw0rm)", "value": "492465ca494a1432fc6ab143ccc61dcca5b1bf46", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617643775, "uuid": "cf189a0f-8382-4524-8019-b3003973e77f", "comment": "Malware payload (Vjw0rm)", "value": "cedf67e74069c70ec40c075412536a6726ca565441a636f69b5eee87e7547e30198328d7e733d322991545fe18fbc331", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643775, "uuid": "945dc59a-2d91-440f-b85d-c72969f1f9b4", "value": "D84574882B464279F394377A419ED248DAF1ACB57B61C2A3358CD7843B0DAB54B718BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643775, "uuid": "9f933eee-805f-4a6d-8167-050ebc92437e", "value": "192:ZMmxwjM8+S42c24ZRMlBI0Ys+fJ3fRf4:XPvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617643775, "uuid": "b920157a-bef8-4851-a299-66b34faafb30", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617643775, "uuid": "34359886-a6c6-4486-96b8-87e4f518de5c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617643775, "uuid": "f5e10ccc-50dc-4491-b412-0f1f1208aa1c", "value": "ADP_Inv_#9045.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5c7644-95d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617602996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602996, "uuid": "82f7bef3-0316-462f-8e50-dc6220b05020", "comment": "Malware payload (Dridex)", "value": "6d30b0883ffaed58046a131139b0ab0d", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602996, "uuid": "35c5cf8b-ca84-442a-82fc-b37f0df09dd3", "comment": "Malware payload (Dridex)", "value": "ca4c37153d439738af3183275ee0b289bd210a3b0da45e37436a55b0457cd7c1", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602996, "uuid": "63a7f284-ffd2-4afb-9910-145262e1f055", "comment": "Malware payload (Dridex)", "value": "f594c4089d77661a029e5e3120a0b22fa6099be4", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602996, "uuid": "8f9462b3-8d2f-402c-9105-eb31b83ddfe3", "comment": "Malware payload (Dridex)", "value": "054e9eb6cee0aacc7b204da689dcc74ff9f539dadfbbf928a529a9efcbadafe2521fed0a118a04865cf1c62e476f5207", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602996, "uuid": "cdf05c7f-d7ec-4c73-9728-066b41f99443", "value": "E2058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602996, "uuid": "5bf6f2d6-8fdd-4a64-be64-0104b27781f8", "value": "523b18dc1c7a7f2ecc8f20b6295beddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602996, "uuid": "0f728bc5-dde7-4003-98b8-a325912e633c", "value": "12288:HbqkjZV1VuMMpJYosZUmc16RWdrpo8+FFcLxT8HoxmRsDJteMKT281MOU7qOkQR1:HbqkjZVqhYjxoArwQobmMKNiOUFkK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617602996, "uuid": "566711bc-7a4f-41eb-b0ea-2b76f5dafdef", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617602996, "uuid": "a49b2d37-aea1-4a9a-bd06-3ecd1ff9c8ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602996, "uuid": "b07277ed-11d1-4f17-bcc3-65926193988b", "value": "ca4c37153d439738af3183275ee0b289bd210a3b0da45e37436a55b0457cd7c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feffec7a-9640-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649146, "uuid": "16b788f9-2a1b-414a-9808-c0f70dee0ff6", "comment": "Malware payload (Dridex)", "value": "702fc9cdca6827671dbae2d621ba5c75", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649146, "uuid": "40ab45f9-5598-4b65-a9ca-5ab60ee8c290", "comment": "Malware payload (Dridex)", "value": "ca665a38fe754ae65618ec461abafc6e1e41b4b3d469ceaf0814edb4008559dc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649146, "uuid": "5584c5b6-5ebd-4279-82a3-deb270e22e6a", "comment": "Malware payload (Dridex)", "value": "bef8093708938093fa45d78b1fc7563307b0e0c5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649146, "uuid": "2bf410cb-f8a1-4ec4-982b-37ea1c56b4e5", "comment": "Malware payload (Dridex)", "value": "8d159a232d5723e6e34e531e41b38e49966ad1ff7bd4e46f0b3bbc531adeadc6bf3f14459079d8645bf4023f70352a5c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649146, "uuid": "0f44a2b8-9902-4f10-80bf-daa56230f69f", "value": "B814AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649146, "uuid": "b3dfa692-4a61-43ab-aa42-4fd21c6af78a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649146, "uuid": "d04e79da-a58d-40f9-a90e-45c71c98c51d", "value": "3072:8BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:8BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649146, "uuid": "b100c80b-286d-4359-b50d-8040709ef845", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649146, "uuid": "034f8641-a2f2-4dc0-8bf8-bfaacaa0c1bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649146, "uuid": "bec69a99-1291-4033-a156-7b26a65a0953", "value": "ca665a38fe754ae65618ec461abafc6e1e41b4b3d469ceaf0814edb4008559dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99bde88-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649566, "uuid": "a82b0664-ab9a-48b6-8266-cd07dc09fd1b", "comment": "Malware payload (Dridex)", "value": "75e633ca05828cb6c875668031f97755", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649566, "uuid": "294004b3-e3ca-46dc-a002-4a703cac2e37", "comment": "Malware payload (Dridex)", "value": "cb7099873a9e82080dd4ed9e6e7dc41c2ee56a25663d9e126947d0788ca096a2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649566, "uuid": "d9791199-49df-4ac2-8e3b-e8a6588e1b55", "comment": "Malware payload (Dridex)", "value": "ddc307b541b99bda2e165ad87bbe55762b8f18f1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649566, "uuid": "0a93df7b-6ff3-4432-8bca-52fb7a10ae6c", "comment": "Malware payload (Dridex)", "value": "4fee30d74986e56805fd7f9fb9fd86df0f28dd8085543abe1fcd787e0c504488b3f4981cef99b230854f7cff40bc9e3c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649566, "uuid": "866a6834-870c-4d8f-a8d6-51e011897bc7", "value": "8314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649566, "uuid": "d7481dfb-c147-4b9e-817e-6aac536c5321", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649566, "uuid": "7093c573-9606-42df-b0b4-0f13113e8190", "value": "3072:ZBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ZBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649566, "uuid": "69d70263-bc00-4ab4-9e0d-664e551a4312", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649566, "uuid": "137cf9ce-05e1-4da0-bea1-c1e9f01c4e55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649566, "uuid": "b1e7f59a-0084-4e8c-8d93-7377b4fb2c32", "value": "cb7099873a9e82080dd4ed9e6e7dc41c2ee56a25663d9e126947d0788ca096a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02ec032-965f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617662436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662436, "uuid": "59ca6413-98b3-475a-bcbe-e097428dbeb0", "comment": "Malware payload", "value": "937e2c551368757c5e3c3598c41ea7d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662436, "uuid": "41807a1e-9ad9-45dc-af4b-f7ec23d505e2", "comment": "Malware payload", "value": "cb73a2cf01aa499376231e1c5c14dbf0abfae7a2f2036c78bcfbc35b2284a5d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662436, "uuid": "3f5be92f-00f3-403a-9358-4b4e4fb414aa", "comment": "Malware payload", "value": "599b5bc9138bec69ac61a82858d2a2115eeab943", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662436, "uuid": "b9791d68-b9cb-40c2-b8c3-e8b2a4692e0e", "comment": "Malware payload", "value": "96084236e55a115760e62e305c289cca97c4019d150c8bcd73c57284611832162efaa6927476a01709c379c48160fa02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662436, "uuid": "4e41f39f-3e4b-4d22-8e88-10a7baa972e5", "value": "90C3BE0CF7E950C1C5DA3AB750B19E287228EE128DB4243616F62E797FF71A37C29485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662436, "uuid": "459d4c1a-dc30-4f2d-a208-5833859cf276", "value": "3f728412058b62c418b1091768b74d7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662436, "uuid": "4d737880-e620-49a7-a150-a3dd25556b16", "value": "1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617662436, "uuid": "750dc6c3-b403-4e64-994a-cb0e4fd92a4f", "value": 120083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617662436, "uuid": "6cbcf6e2-cdb0-4132-91bb-a172d39e61ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662436, "uuid": "c732a44b-fadc-4466-a406-440b835630a7", "value": "SecuriteInfo.com.Mal.EncPk-APW.3323.18304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb8572b-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644443, "uuid": "35936dc4-4b57-442d-b5d5-11ec079c723f", "comment": "Malware payload (Dridex)", "value": "d2d72a998732d49d89e5181fad4f5ef6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644443, "uuid": "ba79dd6c-e974-42f4-9328-7a6f4d05f9a7", "comment": "Malware payload (Dridex)", "value": "cca8133b580dd288f56b75c8735da7edd4f77472bfcebdb8ba535090babf381c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644443, "uuid": "969fb011-e33b-429c-9217-d3b7bd8e0aa9", "comment": "Malware payload (Dridex)", "value": "e0214a60f35aab977ec3a8f0c9589e5f86b8f898", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644443, "uuid": "14d09dc6-f1fb-49bd-a751-1f302f002d2d", "comment": "Malware payload (Dridex)", "value": "4cbf8e6ff892f360f3242ecf7ad24892e435975586524dd1b46cdc8c9721ad39ba47ba04d9b9bc8f810e88ea60a0a265", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644443, "uuid": "9fcb3d14-0344-41bf-9fe3-41aca26f4631", "value": "4E14AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644443, "uuid": "7205edc1-ec8e-4777-84dc-ba7e0999b48a", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644443, "uuid": "544d7b17-8f8f-4a60-b752-98bd012f3971", "value": "3072:3BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:3BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644443, "uuid": "64c4c384-2889-4fe6-8e46-ca740b14933f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644443, "uuid": "ebf2f1b3-2226-440a-93cf-13af59d9b3b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644443, "uuid": "557a6462-b3bd-4ff0-9146-8cee32775432", "value": "cca8133b580dd288f56b75c8735da7edd4f77472bfcebdb8ba535090babf381c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5ff8ad-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604071, "uuid": "f4498dd9-1c7b-497e-a4f7-4df771818341", "comment": "Malware payload (AgentTesla)", "value": "2fb9e9b071b8bb86f3dabc03d8864c2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604071, "uuid": "cff09726-fafb-401a-a0f7-eae801701a87", "comment": "Malware payload (AgentTesla)", "value": "ccadb83ba60ee8071cc3a4dd12d7169c78a8bd17aef30865101640b3cd73cc34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604071, "uuid": "10c6b0ef-c9ed-40d6-be73-c2cbb88ea775", "comment": "Malware payload (AgentTesla)", "value": "d4598a10a70c65a63d45524e51bee8950fed1dc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604071, "uuid": "f3cad86a-67a6-4432-a7c0-c2045ef2105d", "comment": "Malware payload (AgentTesla)", "value": "461bd40c00290c64c78eae68bb7f4d2aa83364eb49b86af19b95214554fb8458536261ba29a9ab97268265be77d9a508", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604071, "uuid": "f1a191fc-a433-449b-9bd8-0a722a65b65a", "value": "82F4022073DAE716E57D37F68496810247F9F1DA3913DB690E98A2C6302A74C0DD9EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604071, "uuid": "9ada21d5-da82-4b2c-b5eb-801ced01069b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604071, "uuid": "8f37ace2-39ec-41ac-a3a9-4ec478711cd7", "value": "12288:8ofCEdJjjgbcyehU3gqC43XFCC0Ti4Gh60GKaunectd9QmPaKX1qTSckskgju:8oaEd5gbcyegNu0AHctd9Q8B1Akj0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604071, "uuid": "5f0c5366-4f35-47e9-9b14-5abf75728054", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604071, "uuid": "34acac71-18b1-4d31-be2a-7071ef7cc3d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604071, "uuid": "ccbbf5f8-35a0-4ddb-a85a-8fd9d1d2b534", "value": "Remittance copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de706ad9-95e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617608719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608719, "uuid": "78c2eb71-e6e4-44ae-8fac-4f4676478402", "comment": "Malware payload (AgentTesla)", "value": "8c49d3615bffc672cef2c91ed794358b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608719, "uuid": "9cf445fd-77d6-4082-8b42-30e568b06255", "comment": "Malware payload (AgentTesla)", "value": "ccaed6d340b8a3072f1c577047ad975f0678128f4a0516cb40b8acb327037bc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608719, "uuid": "1d5e2e92-915d-42bd-9b85-813191bcc645", "comment": "Malware payload (AgentTesla)", "value": "9a02dd3e684f7ce2ecb3b3d54829abf0ef55adde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617608719, "uuid": "aec8b0ff-69b9-4483-953c-05cfc05fa955", "comment": "Malware payload (AgentTesla)", "value": "1c031c4af60a014668b39964face075ac9b369911df1c0174146ab80b8b54fccdb31163bbaea9635c0931d6de7dd4761", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617608719, "uuid": "29ad4b57-c6c2-4439-856f-59cefd47acbb", "value": "2325CF0132859996E4272BF148AFD0104269FDDC6523CB0D2682B7A765F370D2CEBF9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617608719, "uuid": "05428cf3-5864-4a01-ac42-e4e9799b1868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617608719, "uuid": "5e60aeed-ddc8-470c-9598-899385aa177f", "value": "24576:BOjKtmNaxQhfrnqOAQwffSKXdv+GDA6sXfoxDzVRRN9wV:BOuAaxQ4OAhffSUvswLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617608719, "uuid": "cf29958b-4e04-4877-810d-d73536752548", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617608719, "uuid": "53868518-6aa3-49b1-871d-546623cbcb80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617608719, "uuid": "e81b050e-17c0-4a3a-9829-f7865b3d7d36", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0310fce6-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "47bb82e6-b5ef-497e-aed3-223e5bcbeeba", "comment": "Malware payload (Dridex)", "value": "b9f146496e062b384c8d6de5f0e9fd2d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "961aae42-7b67-4dd4-ae17-1b6c45e504bb", "comment": "Malware payload (Dridex)", "value": "ccf51670b4edda68b17b9c4df78eb707f3cf5759a2e1a0c51522083b041dc6e0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "09dce854-d446-445b-9c94-efb786150ccf", "comment": "Malware payload (Dridex)", "value": "6fa0d5a10c519f6126bf70139b0146d2f790f090", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649582, "uuid": "93f4482b-bce0-42f8-88c9-4406d3526902", "comment": "Malware payload (Dridex)", "value": "ddafb6f292e313e6f6aa82279f56d2774b2bbb11a1adc2787322082873195cf49faccff02ac23dba0de67a887961425e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "e47d0bbe-3979-449a-9ba2-0f6923ae9ada", "value": "8C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "a2f6ee80-c6a4-4b1e-99fa-b3879065ab63", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "101416c4-e909-48e7-9eb9-53273ddb6716", "value": "3072:rBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:rBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649582, "uuid": "bdcff186-37ea-42aa-8a8c-a11adedef7a1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649582, "uuid": "96f3613c-6aa6-4696-ac5c-ac29e8cefbca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649582, "uuid": "58825e74-624d-450b-9f0b-b895c93e83a6", "value": "ccf51670b4edda68b17b9c4df78eb707f3cf5759a2e1a0c51522083b041dc6e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e354c0e-965f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617662110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662110, "uuid": "92004503-9176-485c-a13d-105e637b13a8", "comment": "Malware payload", "value": "27515a95a6330ad159f94d13be75a1e4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662110, "uuid": "5c5eac8f-708a-4b33-b726-cb716c60dffe", "comment": "Malware payload", "value": "cd808620b4c15be3d1391e214d3f7c5d65281ba065814c9ef7b644a98146bdff", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662110, "uuid": "a26e6246-0cf6-48eb-ad19-401754275219", "comment": "Malware payload", "value": "60cc78db6496e2522c39c438760e1cd01a9d6231", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662110, "uuid": "24f80253-bd7d-4961-af88-e892cea01546", "comment": "Malware payload", "value": "fb1f3b27c80f8366228a4b5be17ae348dca530e387d30fbfaaaed239ca97978fce8d4603e5259789b4dcc12a5aa27991", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662110, "uuid": "869909e5-54d8-477b-8f2e-128d43464faf", "value": "9E14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662110, "uuid": "eac98a96-4cbe-4439-8239-8dd96465f926", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662110, "uuid": "53e5c204-3996-4af1-bfb6-b1e9ab4c5e5c", "value": "3072:CBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:CBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617662110, "uuid": "24efabe7-f3b7-416d-817b-9e30c8f894b8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617662110, "uuid": "54280f3e-4c88-48f6-9497-513b9984c0d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662110, "uuid": "9673fa3e-50ce-4d3c-bbf5-2253ac51c0f8", "value": "cd808620b4c15be3d1391e214d3f7c5d65281ba065814c9ef7b644a98146bdff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa93b00-9641-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617649541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649541, "uuid": "6449d0e0-c859-4e90-ad25-306d656daeed", "comment": "Malware payload", "value": "e2c19cc1a323f12e60c360af203914f1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649541, "uuid": "dc7770f3-bcea-40a3-bc3d-1cd57372e353", "comment": "Malware payload", "value": "cda6562ec9e9eb568e96d6e9e97e865ffd677ef67cb11d30c423da4f1a23bdb7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649541, "uuid": "5b1d04a9-10d3-474f-a825-807bd3966e82", "comment": "Malware payload", "value": "f0d9d8d23a209e19c0322ade572968304adb04bc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649541, "uuid": "9c5c6f3a-25f1-4fc0-b0c0-29eef16ffc29", "comment": "Malware payload", "value": "2d5f2fdb21f19d3a7776b2dc57895929705b3f383a17e16db620d1a15c7445d4c288533b962cae384a4ff396c53dbdd6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649541, "uuid": "863dc6e4-e134-4f5c-99a0-8e99440d8f8c", "value": "F114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649541, "uuid": "9bc30190-309e-49f0-a2cf-fbf8a700df6f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649541, "uuid": "6cccf103-1701-4131-8336-f3b6653156e5", "value": "3072:SBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:SBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649541, "uuid": "b7ca20a8-5968-4386-bc54-c117da11057d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649541, "uuid": "0c06ede9-f440-4c23-a770-8cd30ce3d7cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649541, "uuid": "a5416529-5c60-4003-aa1f-51b658cb7d19", "value": "cda6562ec9e9eb568e96d6e9e97e865ffd677ef67cb11d30c423da4f1a23bdb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2b67d2-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644628, "uuid": "533eb22b-9794-46c7-9dc8-f1cc1131530f", "comment": "Malware payload (Dridex)", "value": "3396efb71384e97917526aecf0abdefe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644628, "uuid": "d3877f36-3199-4b71-9014-52cbd995a881", "comment": "Malware payload (Dridex)", "value": "ce51d522bd21f849872d31eb944f6e70a10b2f5978df2784277d3ec0fb7bfb69", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644628, "uuid": "f3716a40-7df6-4ac1-a470-5320e5031d90", "comment": "Malware payload (Dridex)", "value": "c0eb02965b8bed99013721d69400bc6504cd43c3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644628, "uuid": "49088498-0c66-43c6-948f-614dc8cc7380", "comment": "Malware payload (Dridex)", "value": "31672c33ce9e1c498187133ab22be8085974fd9e6f29841dd0c622f2c38d81a5749aaba5d16e65fb5b83a57fa7b4abfb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644628, "uuid": "66e72cd1-3a44-4c7d-af6d-9897c57c2739", "value": "0C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644628, "uuid": "270130a6-7455-4ba8-88a4-77f348c263cd", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644628, "uuid": "11ec1ab0-e0e0-4313-a7a1-6f65d0538209", "value": "3072:ZBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ZBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644628, "uuid": "f9a1ec2c-2409-4edb-882e-21bd006f84e4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644628, "uuid": "04cd1241-34ed-4770-afa1-50c19835ee5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644628, "uuid": "c51c3dd1-f957-4d6b-b508-4a5e7d49c9b2", "value": "ce51d522bd21f849872d31eb944f6e70a10b2f5978df2784277d3ec0fb7bfb69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e31583-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649943, "uuid": "ce3e8d45-a444-47ad-be82-5162b76f3fe3", "comment": "Malware payload (Dridex)", "value": "f14b8e26906a2c8cbec7d0eeef109e65", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649943, "uuid": "9da1e565-c3e5-4edf-8e3d-507ccc6badca", "comment": "Malware payload (Dridex)", "value": "cf78c480103698111c1ff7decb8bf9d82745adcdd7d3c6b23d4d5009945d781b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649943, "uuid": "2c457300-26dd-4051-a634-b699ad856e74", "comment": "Malware payload (Dridex)", "value": "ccfb43b01762be06af2585559327e44bc11cb8af", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649943, "uuid": "cc38817a-c087-41a7-95ab-9edd40be278f", "comment": "Malware payload (Dridex)", "value": "a0a0e3a767b92cec6e3f3a834a9fd8fb8533bf5caf427e1f6ffbf549d5511457020d9cb4977ea9b72a52aeb582ab92c1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649943, "uuid": "11a52034-24b6-45de-8170-ae38345b174e", "value": "BA14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649943, "uuid": "cb4bff5f-89ee-4f1a-b556-6b8c5c191e3f", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649943, "uuid": "e41e8227-ff24-4fd0-a18b-806d7981036c", "value": "3072:mBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:mBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649943, "uuid": "1ae7dd6e-1d94-4066-ac09-adca9eeee1c5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649943, "uuid": "1d124a9a-1704-4345-a4a7-22343b4cd5c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649943, "uuid": "088611cc-9c14-4aee-9f6c-9662b33d3055", "value": "cf78c480103698111c1ff7decb8bf9d82745adcdd7d3c6b23d4d5009945d781b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257ddf71-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617627306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627306, "uuid": "f2700ae9-d07a-45eb-a8e2-24a45a0ce046", "comment": "Malware payload", "value": "0c79fb961bee8127d0db5d0e69b49a8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627306, "uuid": "728e901f-2f59-4f2c-a75c-61010ddb8512", "comment": "Malware payload", "value": "cfa6ba5f7cc03de5a84234a8be8f4abb98b0bc4d688688f420981d6c5f993429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627306, "uuid": "713565db-129e-4bd3-bdc1-0d0cdb3c67ac", "comment": "Malware payload", "value": "dc9800e08bb1a1293093a80a75999936349b6daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627306, "uuid": "c0be596f-ca1c-4430-a5a7-de998831dfd7", "comment": "Malware payload", "value": "3be68e782c3c70a9c85598bb2c8fa47af990d89b50301e4566e1284f088d890c7833851b19eb94f35a7ca7eb4204a379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627306, "uuid": "c130d7d4-8a53-4cda-bb06-c74d0adf5c20", "value": "7FD412603BF85B2BF67CA7FAA525581087B5B21A2473D30C8DD060DF597AF814A40FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627306, "uuid": "29ff5503-7817-4aeb-84dc-63c9f7c872fe", "value": "12288:wwumsN3fXf8Tv7wmbklxP1C66LEDlcIuWl2vz+/5QxTkBI:wrNX8v7dYpALWlQvz+/6xTkBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627306, "uuid": "397916d9-5580-46fb-bb73-960329e4b153", "value": 628079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627306, "uuid": "fd5cd579-5bde-488d-8d95-787aa6ff0671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627306, "uuid": "ac4290a2-34dc-44a8-ae10-a0ec781b7e9d", "value": "0c79fb961bee8127d0db5d0e69b49a8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ad0b93-9657-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617658628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658628, "uuid": "d06c79c8-8249-43e9-8a48-9b175d5cf1e2", "comment": "Malware payload (Dridex)", "value": "101a5c8e621a6008439d2599e2121b85", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658628, "uuid": "34dffbb6-fd27-4165-9b8b-f44a99d050a2", "comment": "Malware payload (Dridex)", "value": "d0c3b45e82ebb92e2309cccf0ffa69ccd43311418f0d9b0bfbdb7ab545d8394b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658628, "uuid": "087f2075-261b-4804-96b0-4b0137a7ad8d", "comment": "Malware payload (Dridex)", "value": "9314711f277cb8517c03f11f8871eb8c94f01882", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617658628, "uuid": "8005061c-0a48-4891-ab47-740587f06883", "comment": "Malware payload (Dridex)", "value": "ba6f3d8e9b88b52c9c538de4d431619b24c5c1889674584de482bbba8c69a9805bb198404730e3a7fb1c39a379d9bf62", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658628, "uuid": "e2bf68c8-4608-48c0-b8c9-d115b7d6b62c", "value": "CC149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658628, "uuid": "e679e850-7be1-470e-83a5-176014cc70a6", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658628, "uuid": "066532dc-d9cb-46a1-a0a7-601f2cd4cdb9", "value": "3072:f6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:fZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617658628, "uuid": "b6a17782-a8ec-45db-b317-3aca198ca67f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617658628, "uuid": "9575d148-325a-4041-a189-9c13781ebf18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617658628, "uuid": "b1b21e31-bb0d-4e13-88f3-2846f7359eb7", "value": "d0c3b45e82ebb92e2309cccf0ffa69ccd43311418f0d9b0bfbdb7ab545d8394b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22979c71-964b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617653501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653501, "uuid": "2a780490-5e7c-4bd0-8999-7aca6486ea7e", "comment": "Malware payload (Dridex)", "value": "52258fdcd4532d514001c951a1a0867b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653501, "uuid": "9f48ffe9-0eb1-43a5-940a-6c8c71a74dbc", "comment": "Malware payload (Dridex)", "value": "d15e34ac49483de92053000bc812ab9b7b11e2da230a9ed9ca5e2906c85d1d94", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653501, "uuid": "7c2ffaee-35a5-4144-855d-3a2201e53c61", "comment": "Malware payload (Dridex)", "value": "f1c50212083d9d6f02be80f90fa710aed25310f9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653501, "uuid": "d1f93afa-7365-4b11-adbe-a0865fa914e7", "comment": "Malware payload (Dridex)", "value": "ef85e786f668df0906f15cb4a6d6f34a2f296c35fa430e027b136a65dc5993630cc18e6942cad9f74d1f755b71775bd2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653501, "uuid": "a860676b-0172-4f72-a560-f09d85be04c3", "value": "AD14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A018D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653501, "uuid": "0ebf8cb3-1228-4373-b467-ddfa20a2de5b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653501, "uuid": "4f9751a9-dbfd-4a80-9c27-f43e12ab6e07", "value": "3072:bBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:bBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617653501, "uuid": "0db4f73b-c2a2-4c68-aacb-96bd47098f5a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617653501, "uuid": "54bddbec-d442-4c6d-83a4-e7ac411c03f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653501, "uuid": "53cd1ddb-6333-4297-a38e-b8451aa14a80", "value": "d15e34ac49483de92053000bc812ab9b7b11e2da230a9ed9ca5e2906c85d1d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34faeca3-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647948, "uuid": "d0057aa6-7217-4b7a-ab84-b2dde297ec7e", "comment": "Malware payload (Dridex)", "value": "977443b3b9e80e218162d214de2b137b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647948, "uuid": "70af340f-aae2-4892-8de0-b7e4b5c3b8ba", "comment": "Malware payload (Dridex)", "value": "d2f07ae8d5bc3acb47ef573855ac1eb82fb16c94ea965e43d84b8626fabcd9ba", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647948, "uuid": "c891f6ea-4710-4762-b741-852469fde4e0", "comment": "Malware payload (Dridex)", "value": "8eddd9a72bde9970c30a3d38dea42f725ce139b0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647948, "uuid": "3a2e931e-712b-4c4d-8d3f-d475b1f35334", "comment": "Malware payload (Dridex)", "value": "d06b32954a4314d78d4b6ebf0b6962d818f4ed8da4564f1766ec55a52a239dd7ccbf574f6e605c5d1691e548fd4e3eac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647948, "uuid": "ea6d23e1-7f66-43b5-8169-21fc9718e07a", "value": "D314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647948, "uuid": "87d46dc6-6d7b-4667-8f18-5e973426d3ca", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647948, "uuid": "55a2968e-500a-4cd5-aa6a-0b6de18e78e7", "value": "3072:oBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:oBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647948, "uuid": "c3adcfa2-6e12-4941-a20b-4bec5454f87b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647948, "uuid": "9cd1820a-5ad6-45d6-a812-91c574f31261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647948, "uuid": "29205ee7-1a83-454e-becf-2854eb805591", "value": "d2f07ae8d5bc3acb47ef573855ac1eb82fb16c94ea965e43d84b8626fabcd9ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0eacab6-966a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617667081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667081, "uuid": "dd06acf2-bf96-48f9-b13e-f088f3d3c81f", "comment": "Malware payload", "value": "db30a16cb403245d398787524979804f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667081, "uuid": "772ec779-322f-4bde-89fc-653590e7b9c5", "comment": "Malware payload", "value": "d32b19efda14425733fc9a6d9567b335624fb74c71bfb6653ad27f110f2e7aa3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667081, "uuid": "6a1b6840-dd19-4b2d-83e9-67450470e67a", "comment": "Malware payload", "value": "bf46c9640e8e0225fc5d2f9f4c940b8e195113a8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617667081, "uuid": "a1ceeb5b-eb9d-4866-89d6-566dd2c39828", "comment": "Malware payload", "value": "b4ac4f1fedbcdb9b80e2301590e357a258c5e9618c9a22d6e8677d2eeddb9b956c22fe439645c5598ae9bb36e5197d62", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667081, "uuid": "211868ab-038d-4e3d-8303-8a7a16901de2", "value": "6F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667081, "uuid": "021ab708-6b81-4006-a15c-4f3d190b06b9", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667081, "uuid": "fe0ef91c-108d-47c2-b862-0ca26a26f91f", "value": "3072:EBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:EBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617667081, "uuid": "2c547d52-860c-4357-9940-cc9c16246bbe", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617667081, "uuid": "7c4de627-d4ba-42a2-82ae-63b224de91ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617667081, "uuid": "eecdb4b1-3cc4-47c8-b92e-0f28cec973d6", "value": "d32b19efda14425733fc9a6d9567b335624fb74c71bfb6653ad27f110f2e7aa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf73bf9c-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647751, "uuid": "ae9ada46-3734-480c-b277-e1461b14f5d4", "comment": "Malware payload (Dridex)", "value": "2cd84a26b6d6ac60b0ad61e460f354b3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647751, "uuid": "63ec98e8-5458-4390-89cd-188385e62b12", "comment": "Malware payload (Dridex)", "value": "d46ddc227c46129af381747ff4e8ef204e540b2918edcad18f3e42690cc60a12", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647751, "uuid": "1ce12e95-3021-4d67-a7e3-1de386c2989f", "comment": "Malware payload (Dridex)", "value": "728d4a3f33e6e96a48826b7443df96de0a76b3e2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647751, "uuid": "61fa5630-8b11-4ad4-828b-375241dd330d", "comment": "Malware payload (Dridex)", "value": "0161a7a620e6d57b2634e8401ddaef8cf68bb450d9df6d2abdbcfde06cc714365dfeabd5752250d16a307f1fabd28328", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647751, "uuid": "4e062226-4d62-46df-9143-1f51822fdf62", "value": "6214AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647751, "uuid": "532f434a-fd44-42bf-aa38-538df7173a7b", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647751, "uuid": "44cb5430-e88f-4527-86f8-571af66adff4", "value": "3072:OBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:OBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647751, "uuid": "f4672a9a-e5b9-477d-af80-4f17181f9cc1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647751, "uuid": "d54f50f8-faea-4af7-9f9c-9577b4cdde03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647751, "uuid": "0b989bbe-7657-43af-b7ed-863ab6b0cb37", "value": "d46ddc227c46129af381747ff4e8ef204e540b2918edcad18f3e42690cc60a12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a842252b-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649859, "uuid": "32049cef-ebd8-4d5b-9238-a692fad226a0", "comment": "Malware payload (Dridex)", "value": "704204300d2eb6064b90cc0bb9ee1a8c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649859, "uuid": "12441629-d76e-456f-9011-805cd22cbe41", "comment": "Malware payload (Dridex)", "value": "d4a2dd652b881171caf145fbf0d62ce40d34299a9c114afe2e239c2fce4d8f92", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649859, "uuid": "c09e9f71-eb7d-40fc-bd37-8f1767e9a8be", "comment": "Malware payload (Dridex)", "value": "e6bfaf80ca2bd729c5c0c9dce37d292de392a7bb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649859, "uuid": "ff4f0eff-0a87-4ab4-819d-b1159a884836", "comment": "Malware payload (Dridex)", "value": "d35166405fded27af49659fceff23d5a625486fedeb9a0c65f4c7ef69b52adebdfd5631ff1f09db981795c509eadd2a6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649859, "uuid": "f8791f4f-164c-495e-814a-2277297acfd7", "value": "D014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649859, "uuid": "658b9383-5294-4338-a4cd-e862299265f5", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649859, "uuid": "2f162030-196a-442d-933f-edfb3e740334", "value": "3072:XBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:XBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649859, "uuid": "a882120b-d720-49af-ae95-a197d534144e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649859, "uuid": "872936b5-eb95-4e0e-9b7c-2a00dbe115e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649859, "uuid": "b5f5761f-f8af-4872-a481-eaa6f3aeb401", "value": "d4a2dd652b881171caf145fbf0d62ce40d34299a9c114afe2e239c2fce4d8f92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9ca437-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617627348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627348, "uuid": "77232a0a-184a-413b-99c7-0f2b54ebf3e7", "comment": "Malware payload (RaccoonStealer)", "value": "92d07999c80cccbc4905d68a49c10ffb", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627348, "uuid": "e80e546d-5da8-477b-959a-c4090cd69cc4", "comment": "Malware payload (RaccoonStealer)", "value": "d5c5e40afe4cda3f04420bd271612e8eedd17d2239f1f08f34b96911aad028b0", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627348, "uuid": "3b1d3b1f-2c9f-48f2-bdd9-b1486e5264ea", "comment": "Malware payload (RaccoonStealer)", "value": "d06a22bab883bbd67df3ba816fc16dfb1e392494", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627348, "uuid": "d779aa02-c36c-409f-bf10-c810e0eefd25", "comment": "Malware payload (RaccoonStealer)", "value": "0898f1492c551a403e564d44fe1d3f5f44ad11a0eaad23dadb391b5ed2705932df9f128874a448f58a3c696202e5cfd9", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627348, "uuid": "c56f09cf-656a-409a-94e0-7e16eabdb971", "value": "AFC4E01237E0D072D1A261B55A29C3F04EBBB8721B3569CF7BD41AB95F243D19B3930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627348, "uuid": "32126a70-b0b5-4025-aa03-4dcf3e16f556", "value": "757fe3cc049352cdae367297a43bdc84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627348, "uuid": "3c1784ef-80f1-42d9-a3c7-3c2d58c0fe51", "value": "12288:Pvp6pckU8lv85nfZUqFOKQc1eyozxf4GeFLxU4qTfvhUnLY9t8va:JYckzMnfZUnKR1vozGFLALcLY9tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627348, "uuid": "a5cd4be7-37af-4e4e-ad18-02eabab05278", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627348, "uuid": "03b1884f-eb33-47b2-a0d8-56df0b51a603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627348, "uuid": "609c7f8f-dc0a-40f1-97b0-13e4bab26659", "value": "SecuriteInfo.com.W32.AIDetect.malware1.10758.1978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b44bb40-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649811, "uuid": "209a62f5-51b2-450e-86e1-c9f73fc7e158", "comment": "Malware payload (Dridex)", "value": "e697279f85e5bb9d111f1e35b3fbd748", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649811, "uuid": "3f484600-6100-4c78-a42b-814d0c17e3e5", "comment": "Malware payload (Dridex)", "value": "d61b8951a284c1adc72bdfcb4f0235bb5c23cd211d4058a4f404f3c776681115", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649811, "uuid": "08f1ceb4-8297-44af-a476-b5f9d66c39e7", "comment": "Malware payload (Dridex)", "value": "a6800b3a2d562358812cc94cb326c50c9f50d377", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649811, "uuid": "e8212ca5-1a02-4ef5-840a-43e72fa9e399", "comment": "Malware payload (Dridex)", "value": "d78bade472e355a53f886178e27431da4c780ee254af0a178b3e2bb82e1ff6dfb5853f811c4bb9285becb9347d85dbf9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649811, "uuid": "a457723b-beee-457a-acb4-141494f0463d", "value": "D914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649811, "uuid": "ae1b2718-1636-4af7-8ea6-6e1b7f9392ab", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649811, "uuid": "0d603dfe-d9ca-4f55-9fa2-cdc9e1e36cd5", "value": "3072:ZBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ZBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649811, "uuid": "eca55cea-0445-4b26-9dd1-17199d8ba9e2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649811, "uuid": "b3916c38-7332-43ca-99c8-9cbbc35081e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649811, "uuid": "4f966764-b4b4-4d31-b589-20ef2e03164c", "value": "d61b8951a284c1adc72bdfcb4f0235bb5c23cd211d4058a4f404f3c776681115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27628446-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647925, "uuid": "4221cffd-6b01-448c-910d-fdd6e9c59275", "comment": "Malware payload (Dridex)", "value": "97566e95a8a54982271d923d9493cf34", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647925, "uuid": "6de76d62-e269-4d10-8725-0aa2351abdaf", "comment": "Malware payload (Dridex)", "value": "d6cda3864014faba3f656f98ec9f4c02cbdda545873b71639d4d275fd8090d64", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647925, "uuid": "d3ca4804-213f-4aaf-bebd-5ae2f44cd0c8", "comment": "Malware payload (Dridex)", "value": "9b2f5cb926c2c98c4864e32d376f4c277ff95a03", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647925, "uuid": "d42d2760-fc76-4a72-bdfc-dab06ace8336", "comment": "Malware payload (Dridex)", "value": "aaba4c692918aad3019f546ff0e242b636607c794428b764159fc48b8a6823bd665575b1908647ef6dfab679f4e52e8d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647925, "uuid": "550e5415-9b95-4234-b5ce-3abfb7038d82", "value": "0714AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647925, "uuid": "b9e19686-1a34-4fb1-92d7-0774f8cb65e6", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647925, "uuid": "193659c3-33ab-4cec-ac7e-226963e0a87f", "value": "3072:JBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:JBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647925, "uuid": "136a0f4e-170b-4dc1-b312-eb5e56cbd98b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647925, "uuid": "5b0ec9ef-c7b2-4f92-9163-e00bf153b12c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647925, "uuid": "a4554106-02c1-4fde-8d46-46fdf6b8f71a", "value": "d6cda3864014faba3f656f98ec9f4c02cbdda545873b71639d4d275fd8090d64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a407449a-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649852, "uuid": "2ddb5f7e-f83e-4dbc-8cdc-35847f47f280", "comment": "Malware payload (Dridex)", "value": "29c1840a80da82819d416f5feadc61e1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649852, "uuid": "2eaa94bd-2c67-4a3f-9453-1756c4a9af6d", "comment": "Malware payload (Dridex)", "value": "d75e29486e43ed74225731b83c11434e935bbda6ec514ced22e9282db1be9a3c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649852, "uuid": "89c58f65-3f78-4e84-8cb0-545bc9eaeccb", "comment": "Malware payload (Dridex)", "value": "131f67ad8c83612caaf4d4f16172b1f3da7a68eb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649852, "uuid": "4439d7bd-3641-4b79-aa41-ae499196e85a", "comment": "Malware payload (Dridex)", "value": "36cfb5427b01b690d3d28251dc0210df6c70d3b29a276916067c8c5acef080c6d2e5ae523c05f57ad74905488b52ef3e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649852, "uuid": "3c50cb39-545d-4fff-b37a-f88facc2f7a9", "value": "B114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649852, "uuid": "20189795-16e8-42b1-8433-1c0bda2fcb3c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649852, "uuid": "1cc80ecb-9881-41c0-b6b0-7d18484b16e5", "value": "3072:rBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:rBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649852, "uuid": "ce7e102a-789f-46f3-9f6d-4738edb7dcaf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649852, "uuid": "5488fd7b-47fb-4ce7-9de0-9d28bf3d5b2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649852, "uuid": "9c7d4cc1-b811-4adf-99ce-08f6dfd8f27a", "value": "d75e29486e43ed74225731b83c11434e935bbda6ec514ced22e9282db1be9a3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0289f711-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647863, "uuid": "99705dcc-5b5b-40f8-8866-86ca7e8b351d", "comment": "Malware payload (Dridex)", "value": "0151f305b3a32442b93df01507704ed4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647863, "uuid": "d711bac7-d4da-4f4c-af19-d889b882b53e", "comment": "Malware payload (Dridex)", "value": "d789e0588d495391e4776a7dd14c75284f865763a4f1ff62b35c6ffd71d2f07d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647863, "uuid": "2eb82e46-7e39-48c4-8740-ba50faa2caa3", "comment": "Malware payload (Dridex)", "value": "9f02ce1eba0b09c6a3fffc01c6433d750b59a19d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647863, "uuid": "d92009f8-c240-41cd-9458-4c8346ca6101", "comment": "Malware payload (Dridex)", "value": "b686c8c8fb73f5df929fc75e9b7b652f637fc3bf6a0890d224f5462b92904a767b6805cec0a9a60134b3f67edafa9eb2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647863, "uuid": "c306dbca-c5ab-4d1d-a058-8871cfd495ad", "value": "5314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647863, "uuid": "0335a9a2-447b-4756-a8e1-f2322925718d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647863, "uuid": "7c5e9714-3f73-46f3-8e57-cf1acf573234", "value": "3072:tBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:tBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647863, "uuid": "c92cc2a0-47ba-49ea-a037-552df486eec8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647863, "uuid": "e6a54c41-5647-4c0b-9524-d0497d873b9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647863, "uuid": "8663c274-b80b-4f69-9270-a0f776ccc091", "value": "d789e0588d495391e4776a7dd14c75284f865763a4f1ff62b35c6ffd71d2f07d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea0f9b7-9639-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617645924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617645924, "uuid": "4834c35c-fa95-4265-bf7c-8af69785cdff", "comment": "Malware payload (Dridex)", "value": "89207766496f2841f9f4f28f790ec4f2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617645924, "uuid": "fe5c5520-fde3-47b3-a10b-b7b2892c20e0", "comment": "Malware payload (Dridex)", "value": "d89b0f93222529c438d40897c0c367be04e40272ccda6464053bb188bb108b40", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617645924, "uuid": "03cfa731-4d90-4bd1-9fd3-221e7fd00141", "comment": "Malware payload (Dridex)", "value": "297e1521dc9c3d094d4a9c2404e471ffba587351", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617645924, "uuid": "f26f25cf-4d7e-4520-bb0a-61f4bdac0dac", "comment": "Malware payload (Dridex)", "value": "11954125a441f8dc0a44092d623fad03b1622e1f7c4c8fa76cf019ec0546e57d9a36182dc9af5c99d085cbefbd0da1a9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617645924, "uuid": "d369f318-3fc4-4172-bd71-909b3000dc8e", "value": "9C149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617645924, "uuid": "d91610ef-4243-4e9b-a294-0a8ff7f30e1d", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617645924, "uuid": "be339057-9bfd-4252-bf03-43ae574be040", "value": "3072:S6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:SZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617645924, "uuid": "0049f20a-94f2-48c8-92de-d1d03bf4648d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617645924, "uuid": "db8a0b04-2639-4636-9807-2162ccc80882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617645924, "uuid": "2f367f34-6296-489b-8f9e-a9f94ac8b36a", "value": "d89b0f93222529c438d40897c0c367be04e40272ccda6464053bb188bb108b40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a9a660-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644252, "uuid": "0421494d-c7c9-46c7-8e36-1080d9ec844b", "comment": "Malware payload (Dridex)", "value": "9bce570b0052aaaa727390f0cf4f0e99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644252, "uuid": "3d27adb0-e034-479c-ba66-d53d0f03ef9b", "comment": "Malware payload (Dridex)", "value": "d8bfaf243c752e82e2bcef171a4d0f3e1688c8f7fb858c65179bf8b5e145cb9c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644252, "uuid": "5780ff57-eeaa-40b2-9bf4-3b4fcf700c72", "comment": "Malware payload (Dridex)", "value": "d17290780afdb1a8f2003bce9c04034e2210c675", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644252, "uuid": "afc9cc73-936e-415b-aace-e6e7a839b49d", "comment": "Malware payload (Dridex)", "value": "13496959c5ebcc3722ea73b333d247ed8f99c2fb42997c4c811e3b8001e45c3d9da442e38060b8342a9b45428c680646", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644252, "uuid": "5c462276-98f1-4423-ae9f-a133543254e5", "value": "B414AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644252, "uuid": "a2d7ecb4-458b-4931-ab46-fb21d3919657", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644252, "uuid": "a72c12c8-c771-4a4f-9cb3-ea7bf2747c8a", "value": "3072:gBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:gBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644252, "uuid": "3205ef48-bc2e-415a-af46-5bfaeaa7f4cc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644252, "uuid": "e5e38987-fbc9-4e54-b629-244800a26729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644252, "uuid": "bb35ea22-11bb-4e9f-8671-6d50e00eda64", "value": "d8bfaf243c752e82e2bcef171a4d0f3e1688c8f7fb858c65179bf8b5e145cb9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38da47d4-9645-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650961, "uuid": "85533108-96d6-47a9-b901-f894e38effba", "comment": "Malware payload (Dridex)", "value": "abda198aa70bfdd014ef60d97dd503f2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650961, "uuid": "2fe9dc1e-7e37-4023-a289-910c760cf4e5", "comment": "Malware payload (Dridex)", "value": "d90cc4c06020f1f47b22d9eb3d98d183248d8339cc31299f241d63c3d7264d27", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650961, "uuid": "be89ee95-9395-4afc-9af8-f7fd88e0cfe3", "comment": "Malware payload (Dridex)", "value": "a16e962327a357df2ce44a0f7f07393a23c286e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650961, "uuid": "a162ceb6-6090-418c-91d5-414bd63cfdcb", "comment": "Malware payload (Dridex)", "value": "0fa26402d49917753e0196cb1d1248fb147ed24cef37e928a31f90267cb0cfb415bd64f478998bdb5790beae2471f2e5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650961, "uuid": "74868c63-3c02-4cef-b05d-20134bac47e3", "value": "9614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650961, "uuid": "a0223179-fb39-4fcc-83e0-da8eecfafd2d", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650961, "uuid": "35b611ba-768d-44ca-ad82-a4464e06d11b", "value": "3072:6BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:6BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650961, "uuid": "a495f1e8-dfbd-451a-a847-a632591a832a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650961, "uuid": "b7206ef1-745c-4ec8-a35d-fe7f4925763d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650961, "uuid": "248000ac-121e-408b-ac7c-5b38eef3ffbb", "value": "d90cc4c06020f1f47b22d9eb3d98d183248d8339cc31299f241d63c3d7264d27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e4ae8e-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644492, "uuid": "2b2fef16-8085-4b72-8822-800b7ef4cd9a", "comment": "Malware payload (Dridex)", "value": "1e3239b757c985eabaade34b4404476f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644492, "uuid": "7c31b395-bf72-40cd-953e-841ea78f734f", "comment": "Malware payload (Dridex)", "value": "d96619d0048bb46e77631e5b9d82a0a2273d61f3feabca5d6427614a7a14d434", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644492, "uuid": "f1bd2090-c590-44eb-a292-18c6a728dbb6", "comment": "Malware payload (Dridex)", "value": "bfaaf7526ad043689b5c2c747a9ae9d66e3f0b3d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644492, "uuid": "d7a0c03b-203c-4728-8a50-92e156ae7772", "comment": "Malware payload (Dridex)", "value": "d139d345049eda455d5a968d12fa9f72b60bb52730ea7d58fb0c1055b54e5e339e7c3549a035bbe9d467f05b1536ba22", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644492, "uuid": "85bfc51f-6f1f-4bba-a4f3-891d6b54e315", "value": "C314AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644492, "uuid": "f83eb045-2768-47d4-be4d-b1399995a774", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644492, "uuid": "9549ded2-b2ac-41e7-bfdc-fbf2d20063b7", "value": "3072:7BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:7BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644492, "uuid": "4ab232f4-085c-44c7-af78-26bcedc2a958", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644492, "uuid": "78f61845-534d-405c-a011-c3af20935212", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644492, "uuid": "3e885abb-e45c-4f88-93cb-5892918cffae", "value": "d96619d0048bb46e77631e5b9d82a0a2273d61f3feabca5d6427614a7a14d434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d99f370-9652-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617656687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656687, "uuid": "08f93388-62c1-49ee-8791-0327ca062ad6", "comment": "Malware payload (Dridex)", "value": "d02255e13e924079a0d39fa1e4026045", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656687, "uuid": "f94e4fff-9e02-46e0-aecf-51e46f86d8e7", "comment": "Malware payload (Dridex)", "value": "d98b99d7c80e99f2986e99e1a76ddeb81c0ddae2940cdcc20839636cc875b151", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656687, "uuid": "9df39a56-2ba2-4e94-b8f6-cb2d988508b7", "comment": "Malware payload (Dridex)", "value": "4c8c13f81212b1f8778077fdadcd3f66c220c5c9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617656687, "uuid": "d0f6df70-ef67-4bc1-ac1a-7d533cc7ce6f", "comment": "Malware payload (Dridex)", "value": "33ced56c0b173c6b00aaf6d99b4b5b107c806a4389249b90e9790290ad4d897173a25b24e43a708cfdb62b0d3d96c909", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656687, "uuid": "658ada2e-b6e3-4495-a534-07e9d1268d5e", "value": "D514AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656687, "uuid": "6c02cd5f-54fc-4bda-a25e-2a1a406a1fc5", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656687, "uuid": "c27d3c07-42d7-4587-bdbc-84b15c9bb2e1", "value": "3072:ABHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ABHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617656687, "uuid": "430c6c04-daf5-462c-9e10-fa8738849f07", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617656687, "uuid": "d1926ebe-30de-4765-8e0e-acadb0e33106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617656687, "uuid": "6fdc9935-2c6f-445a-840b-e38e388f2ac9", "value": "d98b99d7c80e99f2986e99e1a76ddeb81c0ddae2940cdcc20839636cc875b151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0a9a12-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604259, "uuid": "710d708b-15f0-49dc-afe7-370f74f0b97d", "comment": "Malware payload (AgentTesla)", "value": "5650df6a69a3f2319f59f7a1dacc293a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604259, "uuid": "9e94de09-e428-4950-bc1f-9408ca352a67", "comment": "Malware payload (AgentTesla)", "value": "d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604259, "uuid": "e1916442-3bf1-4f77-a3d7-d0079e479451", "comment": "Malware payload (AgentTesla)", "value": "c4c3330188b53375ffe6e99ba3a5893339c99443", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604259, "uuid": "bcaa4c13-723e-4598-b4dc-c155d84cb26e", "comment": "Malware payload (AgentTesla)", "value": "b1fc457c36d515722e31fcf8ede19efc7d7d2e9516e2c08deb275ea04185fe788566c2140c8e869da3e89e316ee156e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604259, "uuid": "34d93983-75f3-4e0d-9558-520630ba02ee", "value": "5F355AE631724A08DFE90B36502647F90EA07F326B9FFEBE74E43B491A38958D21115D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604259, "uuid": "c527983d-a3f6-4841-8452-85b80d60964d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604259, "uuid": "57b20baa-4190-4a9f-8b76-4aa1210da211", "value": "24576:8+o5h0d9Z+biJm8o5hfOxGGvOZnOU5C8qhN:BZj1xGGGZ7C8qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604259, "uuid": "d7559425-6dd5-476b-9b52-62ba3ac5dcdb", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604259, "uuid": "3e84c2f3-8786-4f08-bb90-a8e4bf0703b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604259, "uuid": "d0dd9a82-1ca2-4afd-8d1c-f93d72e9a518", "value": "e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23ae6d6-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647836, "uuid": "ae4248cc-7e61-431f-905a-292b3f1dd5a6", "comment": "Malware payload (Dridex)", "value": "4e06b984bac9c6b9dbce2b61f3040fc1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647836, "uuid": "941d8060-2051-4b50-b614-cdd60b7acaa7", "comment": "Malware payload (Dridex)", "value": "da00b5c19409db71469e75e673497fd8740d2258056822d483f200f60bacd363", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647836, "uuid": "9b2ff404-6c70-4090-8fd2-cd76ed124291", "comment": "Malware payload (Dridex)", "value": "1edb495b9a88bf042b737306932ee5ae8b1e3927", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647836, "uuid": "12dc1e60-c43f-4c77-b6f6-da0b1ca10440", "comment": "Malware payload (Dridex)", "value": "9000328024fa547e5253ea69bc8c39b0c9c295bb702efe63d892c36134819cdaac3925b6e9c558766b24e846c568411c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647836, "uuid": "46f26a08-ff91-42aa-b5c1-dcb47d44f54f", "value": "AA14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647836, "uuid": "582adc7a-f0ac-4d14-99ee-84ce0ddd0e35", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647836, "uuid": "bc044b18-099e-49f8-bcc9-6700d9f27585", "value": "3072:1BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:1BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647836, "uuid": "2ede8a6e-afa1-4a98-8b23-84a585b7ba47", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647836, "uuid": "add6eec0-6db7-4194-b104-48502bbe205e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647836, "uuid": "7cc48c0d-3fd7-425d-b339-c8c6a775934d", "value": "da00b5c19409db71469e75e673497fd8740d2258056822d483f200f60bacd363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945e36b9-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "6c6c9b1f-ec6f-4b8f-a98d-a32cedc657a9", "comment": "Malware payload (Dridex)", "value": "c62b3deb534ade3932e9edb68bd2f3ba", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "d36750c0-823c-4b25-aab8-0f6737001c8f", "comment": "Malware payload (Dridex)", "value": "dc38bde6fea22e7c53a24056dc369b0266ae607c1a109ec200776a0e43ee0c5c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "eaf44143-ef8b-4d91-8c0c-0b8c2487ace7", "comment": "Malware payload (Dridex)", "value": "97a54b1db02675ed6b6f1da5c5091077ca36afea", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644243, "uuid": "259e3fac-687e-4e63-b3d4-0844ed426103", "comment": "Malware payload (Dridex)", "value": "7bebffa45ea3fa4c51b4b790c8e0730dd8832fc77b9d78f36dedb761cc4c883e4366f14a5e0989bb94ff2ba2dd69a7cb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "2d0cc592-4395-465b-82bd-f443323095b7", "value": "E414AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "fd7444d2-6aff-4d44-8e35-14b9672016d6", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "01d928b9-63c0-40ed-8701-0089c8b9042b", "value": "3072:WBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:WBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644243, "uuid": "a71dd3bb-a652-4f26-a1df-47cbd503468b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644243, "uuid": "ce0aa363-03ee-434d-bbea-aa3dc351a79b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644243, "uuid": "53a6360b-0a25-40b1-b94d-42bcc32a3a99", "value": "dc38bde6fea22e7c53a24056dc369b0266ae607c1a109ec200776a0e43ee0c5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c2a32f-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646493, "uuid": "6a8c7515-2f73-469e-8e5f-d7bb150e4616", "comment": "Malware payload (Dridex)", "value": "f1edbe49e82c3b9c7771140511b0d590", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646493, "uuid": "7143fbdc-0074-4252-bc03-22bb1d7abe41", "comment": "Malware payload (Dridex)", "value": "dd007b0cb6ea944dd51665106d2e51197a224658d3245e0f1da514b031aab228", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646493, "uuid": "0dca4d66-463f-4280-9c74-725cc9395aff", "comment": "Malware payload (Dridex)", "value": "8c7f6b24a38dba395da9c6923953b7738620591b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646493, "uuid": "dc93258e-0e3f-49f4-b015-cbc993992388", "comment": "Malware payload (Dridex)", "value": "39186f5c4e17cee543711899ddbd6219ee004687655f1ea8fd46bee54ab3cae872dd8bfb06547f64d79eccae721e3252", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646493, "uuid": "41d22969-b959-4825-b3c9-1d77de7999b7", "value": "82149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646493, "uuid": "12f38f67-106d-435c-a161-c1ed129f74fb", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646493, "uuid": "93dab2b6-353e-46c0-8408-b979e75e1056", "value": "3072:g6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:gZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646493, "uuid": "e5686485-9c46-4d27-8cd2-eb8315ad468b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646493, "uuid": "128e0fd1-8f20-4c6a-8ee7-e8041de4b31c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646493, "uuid": "22f0dcfa-b5b5-4cd4-a5e8-46a51d0e00cd", "value": "dd007b0cb6ea944dd51665106d2e51197a224658d3245e0f1da514b031aab228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef8a51c-960e-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617627430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627430, "uuid": "993778fe-83bc-4b2c-8a2a-1575c62923c4", "comment": "Malware payload (SnakeKeylogger)", "value": "99357096ed5f6e4a82508508295f9e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627430, "uuid": "98776da9-700e-4dc3-b126-4436007e3b45", "comment": "Malware payload (SnakeKeylogger)", "value": "dd7bcf5d3a6899cbc9afc67d4d746bb636cc1867e3fc1cc5f9573965f1dc1c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627430, "uuid": "8ed92621-de98-4200-babb-730c480ae088", "comment": "Malware payload (SnakeKeylogger)", "value": "8a4d654707fdd8ae1156df40a1934bc21076960f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617627430, "uuid": "3fd7ce72-10c4-4b21-af1e-90244f5ce366", "comment": "Malware payload (SnakeKeylogger)", "value": "70f2f22d4e2fdba077ab9230223f750a0802c409377eddb9ca3eaecd15a3b8580d91503c3bc0e52edd3c17195de67364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627430, "uuid": "6da25588-6ef7-404e-9b6f-9a8eefacd3d0", "value": "8615E502EB5CCA71C870757B0A8B626E3766E4D7D7A0C7C577099A3D205AFC22BCD648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627430, "uuid": "a3619716-3c98-4c62-a512-8ceb2b13d038", "value": "6144:QopQQy0mOTRcoy3DF/5892Rfx7iZ5a3c+Z5a9B923Aas9NFYtk7gp54t7qgnKj/Q:QeQQYwyzF/B1eSdILkqEpwAg/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617627430, "uuid": "8d947362-6318-4bd5-98ad-ef1fc71bc49d", "value": 936993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617627430, "uuid": "2d1eb784-50d9-4e7b-8b61-e0564f74e48c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617627430, "uuid": "c5433b17-c6bf-49c6-97bb-615d1fcf0e63", "value": "99357096ed5f6e4a82508508295f9e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dce97c-95d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617601963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601963, "uuid": "8e8d3ef7-e5e0-409c-9f18-f6f5274b0362", "comment": "Malware payload (AgentTesla)", "value": "eaa5cc047318ebc1ae4a0c35f62f598b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601963, "uuid": "3095bb33-70c6-43d9-8350-98af8de999ac", "comment": "Malware payload (AgentTesla)", "value": "ddbac22b9a8b0955b57925d72e10f6a3502e55cf3284b42cb28033812ff2f668", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601963, "uuid": "ce17c7f6-099f-4307-aa76-3633d922b784", "comment": "Malware payload (AgentTesla)", "value": "bf559873b483efca7342426258665ca9152ff890", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601963, "uuid": "3a244bde-ca28-4c1f-92f2-56dd7c1aa1f9", "comment": "Malware payload (AgentTesla)", "value": "9e620da51d734725b8df21d3a411ad9acfed468d060cf236c71720ace38adbbc65cea4968a8177e3aacab58cad986ea4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617601963, "uuid": "57ac2a89-24c3-46b9-a4ab-36723681b853", "value": "37D423DD88EC4952503109F18F586C91A8E72C39389A344DC294BD1D6E8AFC2E53FF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617601963, "uuid": "e8920bb3-d57e-4803-be63-945d02bb656a", "value": "12288:zN1kjtE9TtZT+hyI9OxCBvnNm9kVXayi9i/nwPCMAa6Nf9L33GBF:rkjtEZtZTI9p7maVXa1iIPaaq6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617601963, "uuid": "876ae8c4-879a-47e7-9532-6298ba67262d", "value": 648187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617601963, "uuid": "cc149987-4a66-479d-987a-cd9e64f30482", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617601963, "uuid": "630a520d-16b1-4dd0-8297-eff623e56788", "value": "Remittance copy.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a5b308-95d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617602548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602548, "uuid": "83188f53-1fc4-42e9-ad54-eed535bad231", "comment": "Malware payload (AsyncRAT)", "value": "e4f0e223958e6d2eca9f6dde5008940e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602548, "uuid": "fea70e79-951f-4f3c-86b6-8266b4ed4009", "comment": "Malware payload (AsyncRAT)", "value": "dfa1a4d46ffa6b858ff8de047d842f434834440921e03472e4ee138fc13e97bb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602548, "uuid": "ceae46bc-088e-49ab-b892-43f1b815a356", "comment": "Malware payload (AsyncRAT)", "value": "7ce7c4c14121abc3ee1c18584074b78bf74122e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602548, "uuid": "715b710b-ff15-447b-a9a5-ae4cd6605947", "comment": "Malware payload (AsyncRAT)", "value": "832ddf5bd60fa7999ff88fd9339b2cc2e5e0e678d8ad844e553846853d126a015b2ff6baa7f5a34417cefe4c93cdbe05", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602548, "uuid": "78ece0d6-10e3-4c4c-9a34-25b215b046c1", "value": "F4F03A6A9809C011210D0C510CBB4A77E3AF7E02722B4390F0539F9138D9F1726CDF2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602548, "uuid": "68c682cf-7673-44d8-acb1-af022be97b0c", "value": "6:ZNgNRwwqlqDG3uHT0WYlyD6A2/zDccKx50NuT5SGXdLse0FXOilDJw1LB:z2+IDGuyRxv5NuQMdLfgX9loB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617602548, "uuid": "b81b6db5-3a67-430d-bc75-e9e580fd14a6", "value": 556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617602548, "uuid": "9a6af3e0-3a37-492b-8504-d4b8b26d4968", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602548, "uuid": "61c5cf2b-3aae-4f6e-8096-aa72bc0fda37", "value": "FK58.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610c93ba-9630-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617642009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642009, "uuid": "c27ab82a-9063-4021-a8a1-6f0f0df35b50", "comment": "Malware payload (RaccoonStealer)", "value": "e7aebfa7aa15ac239d507ef73d6fd783", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642009, "uuid": "71c99fc0-a5ee-45c8-a45f-f524c53d91c0", "comment": "Malware payload (RaccoonStealer)", "value": "dffc13d1cfcc907792273c3a9423844a659ef1ca31ea5bed0d09c1d4f5f58984", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642009, "uuid": "ba74fc95-e0b7-4ac0-9790-8548c0f15d39", "comment": "Malware payload (RaccoonStealer)", "value": "5d3bb0cf2c9c7142f3aff8a6759e5c69384b12e2", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617642009, "uuid": "cc2db947-12e9-4a09-9684-f7bd2f943aae", "comment": "Malware payload (RaccoonStealer)", "value": "272236a812790642778ff5da7a7a32783debe9ad825d94e9b1289914a346dc197613129d0786b6c171f355562d801681", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617642009, "uuid": "bd172c66-929e-45d2-99b5-d87e47e5af68", "value": "86D4E11132D0C072D1A221B55625C3F15E7EB8725B266ACFBBD81BBD4F603D1AB3934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617642009, "uuid": "d78ea329-624b-451e-b08f-f446538e9d57", "value": "2f6204fbe7d12f9994fbdbc383c525c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617642009, "uuid": "601a39f4-5449-4dd6-b8d9-c9c8ccfd9ffb", "value": "12288:N/G45XvuktQwiNFkUR1NqXVs28fDDG24f7X+96lmNKT0YP:NueXvV5iNFj1NqXVs/DDG24bM6UKT0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617642009, "uuid": "b284a348-7e77-4bd3-866e-1ad6a453fa3a", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617642009, "uuid": "95b071c6-ff32-44d8-b01b-31155fced4a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617642009, "uuid": "b53157dd-51a7-4378-8024-91503e74544a", "value": "SecuriteInfo.com.W32.AIDetect.malware1.7401.16062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314b61e3-9658-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617659109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659109, "uuid": "6489c2c0-bb39-4fe6-ba2f-535a82098db2", "comment": "Malware payload (Dridex)", "value": "9a85b7a21e23e83ab1d03dafb1e305a2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659109, "uuid": "a53cdf20-0f20-4e40-a82e-94d249b9cac5", "comment": "Malware payload (Dridex)", "value": "e015a6820e95546a2c75a1bb2a31931d01c8426cfaa7c845d0efe036b163ac84", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659109, "uuid": "0ac29c7d-edf8-4bc2-a7cf-b26f8d4e0250", "comment": "Malware payload (Dridex)", "value": "21d3fa8e9ba2a34f91fb54d26c437244ea8ddacc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617659109, "uuid": "167bc86f-be48-4e84-8550-a7ad21c0e234", "comment": "Malware payload (Dridex)", "value": "26bfd486a79defe9f6205303b727d08bc63c56a0bab7a845d4f0b4b3d3ef82d8fdcd621032de6b49a5d31d04cb2bb409", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659109, "uuid": "e4411927-e780-4c59-8ea0-111994f9d9fd", "value": "DE14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659109, "uuid": "516e227b-af4a-4a7a-b9c9-7c163ce4f2c1", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659109, "uuid": "53c72956-2e78-4234-a0b6-6d156b4ccc5e", "value": "3072:7BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:7BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617659109, "uuid": "eba0d380-8ddf-40d9-ab84-d01ad01c8876", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617659109, "uuid": "a7dc89fe-6291-45c2-b77b-b37b045aed2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617659109, "uuid": "526fbaad-b4e5-4561-ac74-bd35c6987186", "value": "e015a6820e95546a2c75a1bb2a31931d01c8426cfaa7c845d0efe036b163ac84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3334345-9647-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617652025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652025, "uuid": "725b9f9a-8670-4fab-be47-7d03a7e1ac81", "comment": "Malware payload (Dridex)", "value": "0ad901224464baad85fb6245a5c6c897", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652025, "uuid": "eafcca13-41f7-468e-a6b6-1ad4669e6635", "comment": "Malware payload (Dridex)", "value": "e05769a9163d5a4785849693d8a946a29e13e1baacbeec9afc906a3e70c024a7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652025, "uuid": "e924e96e-3071-45ad-9d91-b3554de8001b", "comment": "Malware payload (Dridex)", "value": "6ebe6d47d9d5143c98276861f867357d2fe0102f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617652025, "uuid": "08392315-b030-482a-9071-570ac7f3eec7", "comment": "Malware payload (Dridex)", "value": "a7aff68d78790609154f04152adff5462e176594aeea8d0388b033895657d1b554e0cc344f2da88a751bf639b40fa8ea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652025, "uuid": "df0525ad-b9fd-494b-acdf-28a875d5f8ef", "value": "5B14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652025, "uuid": "86f31955-8657-4c13-b35c-4fc63bdcbc62", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652025, "uuid": "b2d616e7-17fd-4ff9-a831-6e9fe60c1efc", "value": "3072:NBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:NBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617652025, "uuid": "52e20b92-701f-4993-9f7a-f7cb348737da", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617652025, "uuid": "698995a4-dbc6-41e1-9746-aa37a5c15602", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617652025, "uuid": "1b69724a-aa70-4720-b7b5-7cc83f1df814", "value": "e05769a9163d5a4785849693d8a946a29e13e1baacbeec9afc906a3e70c024a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03d6ced-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649846, "uuid": "20860f2c-d12a-44fa-bde6-55d14a74eae6", "comment": "Malware payload (Dridex)", "value": "087b98a4398878becfd784e4ca607edd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649846, "uuid": "d28395db-fd4d-489b-9b26-e6519a5477e8", "comment": "Malware payload (Dridex)", "value": "e17475552c4835847693166626b95f9816cd925cfdfe78733c6ef2ea5e66ed73", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649846, "uuid": "7adb5d9b-43a8-492f-b52e-0ff50989054c", "comment": "Malware payload (Dridex)", "value": "e46bbee200199cff06a0bdebda7a4850422c12bb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649846, "uuid": "6b4d3f94-7752-4bea-944e-281dbef4589e", "comment": "Malware payload (Dridex)", "value": "90da9a7f6986e60a6ad4c6539987dec6405fcc8ec2025861508a90245c994e653da9aa1c566bc5824dc1afff2e95b293", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649846, "uuid": "f1991264-d5ed-4333-be99-935cdfd981ce", "value": "5014AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649846, "uuid": "2fee1bbc-1f7e-44d6-8dbf-5aecaf68878e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649846, "uuid": "c29cf73c-6dbc-4155-a3f7-d68effb92895", "value": "3072:MBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:MBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649846, "uuid": "bfbe4b9c-7588-4b11-8142-6497722b14ef", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649846, "uuid": "eb73374f-fe20-4b85-bd78-a54a6558aab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649846, "uuid": "465f26a1-41f7-414a-9fbb-55715a2127eb", "value": "e17475552c4835847693166626b95f9816cd925cfdfe78733c6ef2ea5e66ed73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecfdec0-95e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617609229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617609229, "uuid": "4f6ba97c-a3f4-4c79-8f91-525e90e456c1", "comment": "Malware payload (Dridex)", "value": "1eae92f006d8d82dcf1251ddf731985d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617609229, "uuid": "cae800e5-67a9-43fe-9a82-c49c83b91255", "comment": "Malware payload (Dridex)", "value": "e37a40c2af8e4fa5e693d60ce2b126ff661430a31e92e5a4c7623a6bee57c190", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617609229, "uuid": "dcec3493-9718-4d78-af74-cbea222c2875", "comment": "Malware payload (Dridex)", "value": "76481174f74e3137f16d78aaa3d3ff3e8bd50e6c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617609229, "uuid": "24ad74c9-c058-422e-bd72-408ae910c8d4", "comment": "Malware payload (Dridex)", "value": "874cf826a96746596d0cc2ab13723800be17e1e3b3c79ac05c54beaadd2ee5dd40a6e15fb4a88b065f0b0256bb65f907", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617609229, "uuid": "633ee5f3-27cb-422d-bd7d-3de65252a77b", "value": "2714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617609229, "uuid": "22ee0660-3aa0-4fef-8ee3-6ddac73b3bc5", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617609229, "uuid": "cd0ced17-7d16-4ea3-84f3-941836c3364e", "value": "3072:/opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:QpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617609229, "uuid": "e48671e2-9193-4cac-94fb-94bf5d00d837", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617609229, "uuid": "c723542b-12e9-4cee-afe5-af0bba279e86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617609229, "uuid": "7e2505ed-f434-4e4e-a8f1-77b0228096fe", "value": "e37a40c2af8e4fa5e693d60ce2b126ff661430a31e92e5a4c7623a6bee57c190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbb1369-9667-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617665730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665730, "uuid": "ab99e70a-1bec-4609-8a51-f5455b62391a", "comment": "Malware payload", "value": "6a965934394f8ee9ba6674be51d509b0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665730, "uuid": "fdfbea80-dd83-4f3c-9a7f-4086f9837cb0", "comment": "Malware payload", "value": "e393c72d9e833e166cc5ce5d9b36b67a83d5fc754b90aeb1ba4370f8565b15fc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665730, "uuid": "4d181ce3-6b52-450c-b368-c5d7ed292d25", "comment": "Malware payload", "value": "86e8f563d10fd3d1b6b75fb66964b32944eee56c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617665730, "uuid": "10814c5f-b86b-4448-9767-4da32c108caa", "comment": "Malware payload", "value": "fe17fc4b39bf7e4caba145db5c683a70cc900840101fed6fdb036ee7e5801fba291dab91c85cccd9981cc7a0cc3ad310", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665730, "uuid": "0f0afe74-cd4f-468d-8387-fd3be7a5f43e", "value": "BA149C0CC367D281FFF3DAF2101A76759A339C81856F861AEAD0263F8ABF84D154616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665730, "uuid": "b905bad3-9d29-4ddd-89fc-4325f248e557", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665730, "uuid": "6a3e6331-9747-48a1-9987-23355c27aa1e", "value": "3072:t6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:tZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617665730, "uuid": "1da3ec36-0f74-468e-b2e6-6f5e093ba9f7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617665730, "uuid": "4cdcbb90-2136-4914-859d-3cf4178d1820", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617665730, "uuid": "182d7268-0ae3-4a5e-8595-f154fd1e4dc2", "value": "e393c72d9e833e166cc5ce5d9b36b67a83d5fc754b90aeb1ba4370f8565b15fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1344c49f-95f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617615250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615250, "uuid": "34fe6b5d-b487-42bd-80f9-894b65faf249", "comment": "Malware payload", "value": "5a59ce4c687a7f855f1079dc98f71170", "object_relation": "md5", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615250, "uuid": "c48a750b-2862-4774-a62b-cfccd8fbe0e8", "comment": "Malware payload", "value": "e3a3ce745bced26cd26d5d219e75dfb281738e2545ffc45cc91d19da9d21c73d", "object_relation": "sha256", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615250, "uuid": "4364c038-2c02-4e93-b72e-195570b88d0f", "comment": "Malware payload", "value": "3198daca631983b3301c3ce88961ee7bbcafc222", "object_relation": "sha1", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617615250, "uuid": "6ddf6689-b160-424c-ab9a-72aeb3cf58b5", "comment": "Malware payload", "value": "ff6a67f88814212c2ec18a67cde76bad55ea80c9d4ce3f72e524839da6c123a069162db9969dec30d1de26d53422d44e", "object_relation": "sha3-384", "Tag": [ { "name": "Shenzhen Smartspace Software technology Co.Limited", "colour": "#978D31", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615250, "uuid": "dd6a8d7e-ff58-4a5c-ad8d-356ac458a74c", "value": "51663381F0928CBAE8F611371AB6D1353E7AF5230B0585AF639C5A9779303D1A77C61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615250, "uuid": "cef5087d-7d72-4237-b7d8-87d26ec375b2", "value": "4df47bd79d7fe79953651a03293f0e8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615250, "uuid": "3365a21b-4818-47b8-9d52-a05fc9d777e6", "value": "196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazG:kfauN/HYOSIT/EVF9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617615250, "uuid": "22edbb74-5cac-4194-9355-3b8ab914d7a6", "value": 6967188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617615250, "uuid": "6f2bfd0d-ce4a-413c-8a79-48bc6f7713e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617615250, "uuid": "eca79fb1-9b41-4f1f-87be-fe2f22fd70d0", "value": "e3a3ce745bced26cd26d5d219e75dfb281738e2545ffc45cc91d19da9d21c73d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5411c41-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646526, "uuid": "051010b6-4060-4a3a-be96-bc2e2230cd0f", "comment": "Malware payload (Dridex)", "value": "0710693cb4488c4a18e3dd624077a25c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646526, "uuid": "a55d2344-11b5-492a-82ca-2e13886387f9", "comment": "Malware payload (Dridex)", "value": "e75cbe877c7b35daf16910b5428d180a703aa4a623245c40783a25a0d13101c5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646526, "uuid": "fc201940-2145-495f-a1aa-edb4e688ae6c", "comment": "Malware payload (Dridex)", "value": "b94311a724053adf233cdaca6e494a34eeba8d0d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646526, "uuid": "c1781cf8-ffa7-423c-98c8-ca5304a383fc", "comment": "Malware payload (Dridex)", "value": "8018bc4c68ca71ab4d9fa1ad7eba039cda7d10a59b931e9e26c1f7ae05e95b83cf42c44330c954ac47426eb31a1d2cbb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646526, "uuid": "2dbfaea8-4398-4a91-b954-a0ecf0355b55", "value": "D7149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646526, "uuid": "b247ac49-f43c-453f-8ea9-5035a729abc2", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646526, "uuid": "306ae565-737f-4321-b14e-a889567bd4e1", "value": "3072:F6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:FZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646526, "uuid": "c062eebd-7cb1-4c82-a187-d2c27bf27e8c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646526, "uuid": "182bfed9-3577-4456-8a36-235bb94eaf12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646526, "uuid": "2a8f3229-deea-4a64-b9f3-142af4cd2c1f", "value": "e75cbe877c7b35daf16910b5428d180a703aa4a623245c40783a25a0d13101c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60b072c-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604383, "uuid": "eb7e5f46-4cd8-4507-ae00-e77d8b7abe5a", "comment": "Malware payload (AgentTesla)", "value": "51a3fdec12808c18612726e430b9d005", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604383, "uuid": "95a3f343-9fc0-44eb-a82f-f15b90cf2c4f", "comment": "Malware payload (AgentTesla)", "value": "e78f2342dbacebef772c2a8d775abe436fc3b7501f7019939e9b9fd3e3eced40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604383, "uuid": "efb0728d-5721-4e9a-8b91-6c4b2126b1ce", "comment": "Malware payload (AgentTesla)", "value": "bcd6c0c4e3833fbb43556a2d8912341d4acd249b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604383, "uuid": "bb6ea9ee-6c06-4ce3-b058-0565e0b41e99", "comment": "Malware payload (AgentTesla)", "value": "1183e43e58b75583b588038ba73a736166100a2368b6a582ac1be2c4c278064ef8211c6bc7449bb70b53bf6870964f7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604383, "uuid": "c820561a-61cb-4b28-ba43-6514a8e4901c", "value": "C5859BD1EE43D244D85A1AF0D42FC25D5662FF082F2DED09698CF3081A72A9ECAD56F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604383, "uuid": "6a2823fd-c4e8-4bd7-9b75-6b865d71f679", "value": "12288:1a8169VIVvHn9dY8rD7b6s5FT/AOwdSf/aQkeDAnTMBfEcyiYyjcaWVT5rzjxJ+e:n16IVvHnbYQPJFLAyfkHQCqjcaWVzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604383, "uuid": "f6b73b28-a3dc-4730-a04e-2b7dc22c10be", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604383, "uuid": "ac534966-f278-4e2c-a231-a111bec86e9a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604383, "uuid": "68b79cdd-6438-460d-9c87-2f08ed9f8c3b", "value": "RFQEX50GO_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db35736-961b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617632903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632903, "uuid": "8aa4ca77-6e4e-4187-aeb5-20ea0000eb75", "comment": "Malware payload", "value": "4f7146062f1e5c9eb5e1796fd10db94d", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632903, "uuid": "53a2b0be-49a2-41c2-bd6c-d1f2e45895d4", "comment": "Malware payload", "value": "e7ead24c32fd5736e17156830ea9275982c0a3f517a421f96d37ebe58f647856", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632903, "uuid": "4c3e75a0-39fe-41d9-8d85-007a72d51f37", "comment": "Malware payload", "value": "0baf18a79cf0f83bdab0cf64f5ceaee236135551", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632903, "uuid": "a0aa1204-b3e8-44ff-956c-c5f7ef8cacc3", "comment": "Malware payload", "value": "32e23766ed4ad1b27e01eed999e1639bfee45e1296ef2f09604052446364bb92e586bed200e1862a6dfaac2fcc06af2e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632903, "uuid": "4196d575-20e0-4275-bdf0-05162b164e83", "value": "0F45E6ECC99D4AE6E02CF33243F2640E4670DD732951952BB68C215B4FE9BD019DA89F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632903, "uuid": "caaeb8f1-6e39-4e38-b42f-86b4e6cd54b2", "value": "768:ocfN3dppcAb52RgnG8GKd0JUGfliGflvx/FIwVLk9TuCRJQOU2/:zfN3djcs52RoG89+JPoToY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632903, "uuid": "2a1deefb-b529-4ea9-bd03-f0179c63d1fa", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632903, "uuid": "e1c51b55-e672-48a6-a80e-dcd9408b4c8b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632903, "uuid": "d1cc6a11-7319-48f9-8395-3fc8b9eb8197", "value": "Invoice_Ord00000023413.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe968b54-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647857, "uuid": "d0a36d23-cd27-40dc-8723-76a315e19934", "comment": "Malware payload (Dridex)", "value": "ad7709041e403c6bb3a71b22f8ad6f94", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647857, "uuid": "5aa2e1e4-ece8-4ab6-90c3-4df29561210b", "comment": "Malware payload (Dridex)", "value": "e800d4018d1824cc3402298894154bb82d31bfef758347c2d69e8a604e583af1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647857, "uuid": "5824ce58-96b8-4f83-b934-9fd981aef31a", "comment": "Malware payload (Dridex)", "value": "20142c0e50d0e2be5946024bcc4e0af67879e067", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647857, "uuid": "c0373e35-d7f1-43ee-87c3-ce5fadda5850", "comment": "Malware payload (Dridex)", "value": "660aec787e2ab35f16dcb3822219c93de6bf36172aa12ff321f1cd54ee7d93c02cdb97a413454891165b906f051e1904", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647857, "uuid": "f2323805-322c-4264-9f3f-2c1a2af604d1", "value": "7114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647857, "uuid": "57c9d506-3fbf-4463-9150-64d6219114d5", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647857, "uuid": "a9702ce3-306e-4aa1-99fa-851d1300c5aa", "value": "3072:ABHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ABHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647857, "uuid": "ddfd5a90-45cf-4dd2-a47b-83d22317fa22", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647857, "uuid": "ae21620f-ba2d-4b36-b6bc-84b2768c2ed2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647857, "uuid": "b4e7b0c0-01e1-4288-a297-e0f428594e71", "value": "e800d4018d1824cc3402298894154bb82d31bfef758347c2d69e8a604e583af1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcc1f05-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649896, "uuid": "28bc4a9d-a4e9-4b71-be1d-651cb4730708", "comment": "Malware payload (Dridex)", "value": "256254fb29e348155a4c89e4bcd3632e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649896, "uuid": "0b285dc4-9961-4658-8493-b56669141253", "comment": "Malware payload (Dridex)", "value": "e85f4b6cba2aad1fead5327a826d51e91df1323f8080bfe1b9c1cde014f50360", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649896, "uuid": "d87e79ab-28a4-4801-9c0e-290c7884d9f2", "comment": "Malware payload (Dridex)", "value": "853caa704a37d2e3c93b59c94eb9059b99f1ef7e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649896, "uuid": "9bf409c9-c6b8-4d7b-9c8b-098df850e76c", "comment": "Malware payload (Dridex)", "value": "4ce76b9478a97f660e45c49395a99d43df438d9134db207399a670ebba129b1247bf55af07b21a31dd021d0a9b746170", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649896, "uuid": "350f368c-3331-4390-9354-9f953286ad90", "value": "D114AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649896, "uuid": "b775b191-2c59-4ae0-adb4-a9cf7ef856f3", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649896, "uuid": "c20b5e54-159d-4e9e-b501-3b1c7c600f75", "value": "3072:DBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:DBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649896, "uuid": "1f733b4e-68bc-49c0-98df-715eba824fa8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649896, "uuid": "8d69ef12-a5c1-433f-b6c2-facef30cc297", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649896, "uuid": "4ffdf934-dea9-4149-a046-f1ac43ac0ed3", "value": "e85f4b6cba2aad1fead5327a826d51e91df1323f8080bfe1b9c1cde014f50360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc972b1b-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647746, "uuid": "0a166a64-3efd-4101-bafc-0d5520b30799", "comment": "Malware payload (Dridex)", "value": "dd47638fe96530c7854659038ddc2c6f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647746, "uuid": "34a28dfe-c3e8-4369-9a83-d48d96b0ac2f", "comment": "Malware payload (Dridex)", "value": "e89d406a9250579dec890f0baabb5b067003a8be57ac1c5510454d9e2e8b9b1e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647746, "uuid": "923aaa4f-8a0b-437e-bc97-ee18458a0974", "comment": "Malware payload (Dridex)", "value": "ef520009b52b1f6c35190ebf71f83a4309c8b8de", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647746, "uuid": "0f9c4703-2b8e-4c12-a35f-c56c6e979040", "comment": "Malware payload (Dridex)", "value": "815f4244a84b403818add32dc76532f51970198db438e3a3f4898a51b23cd360585d6e9fa2efe2ac8408f60978583864", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647746, "uuid": "36167815-92f4-46a8-b235-793c778c2c6f", "value": "0614AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647746, "uuid": "d532f6be-689e-4404-a892-f5e92266d58c", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647746, "uuid": "b78eb64a-9115-4ecf-8697-6adcb9f71303", "value": "3072:MBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:MBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647746, "uuid": "4d532cb0-0dde-49b1-acdc-cbf59b924e51", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647746, "uuid": "392faae5-5eea-4079-a096-f62eb3928bd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647746, "uuid": "715a0336-5583-4a65-bb3b-6464f85a4fa8", "value": "e89d406a9250579dec890f0baabb5b067003a8be57ac1c5510454d9e2e8b9b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c973a76f-963d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647768, "uuid": "6bafcc75-8ee2-4090-990f-331a04a9979a", "comment": "Malware payload (Dridex)", "value": "bdae15a5add9882718e9efbc8c969a70", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647768, "uuid": "6d1afd05-bfc7-49f4-bda2-66273864424b", "comment": "Malware payload (Dridex)", "value": "e98022f86b68c714bca63b98a693d8f96e5c72b15d9648dd63bd0354a6e47b42", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647768, "uuid": "3ede2c3a-0eba-436e-b9e4-74abe840d1df", "comment": "Malware payload (Dridex)", "value": "6604424ee3dad5cde9b0ba8571abfab665e89fd0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647768, "uuid": "9b0aa072-e128-4615-be3a-6aad0d8f3992", "comment": "Malware payload (Dridex)", "value": "037a73e9172783ce6def95dd936453177ff6a14711366c34bab2e4805229034da0329c22d151c938210ed810e8d2abdb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647768, "uuid": "f5ba8675-a965-4847-972d-82b797046896", "value": "9C14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647768, "uuid": "94d6b416-3e04-4d17-afa7-136a4f2be2d6", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647768, "uuid": "08d23939-298a-4b69-8950-ac7360f38b70", "value": "3072:5BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:5BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647768, "uuid": "20fc2ebe-989c-4891-9249-f751eb9dda8f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647768, "uuid": "79f4c0a4-8a21-4441-81ea-b1bd3f271338", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647768, "uuid": "6cd9a901-d642-4562-ba1d-3f5ce7b51fd5", "value": "e98022f86b68c714bca63b98a693d8f96e5c72b15d9648dd63bd0354a6e47b42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a82554-962c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617640193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617640193, "uuid": "ad7a052c-9205-420c-8107-8e86846b1bb0", "comment": "Malware payload (Formbook)", "value": "db19a498922eb6b34c1b34952f62a123", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617640193, "uuid": "043ff77c-a918-46d6-9e40-72031ec53c6d", "comment": "Malware payload (Formbook)", "value": "e9d83ca5f0618ad4965291b81f71da92242b086984388645cdebcf7b81a9a6d1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617640193, "uuid": "5d920a01-969b-4dd8-873c-e09a72853e1a", "comment": "Malware payload (Formbook)", "value": "f3210314e6b4a1d717df53e41d82e0b7a76a7973", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617640193, "uuid": "4de468fc-c283-4280-a0ce-b850f95eeec5", "comment": "Malware payload (Formbook)", "value": "95848cbf09a5a8b0267d2bb27a8f0f04c730283426dfd09b0aab75f67cb5fddcf8ea039ee979e4ff5ccd86c8dd8b8889", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617640193, "uuid": "fcfcea86-69f4-425e-a709-a08ecc78c5fb", "value": "AAC423ED704DD0C870E27848D289861EAE721C5AFE4A7872E1FC88A3459461F5BD2DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617640193, "uuid": "16265796-4f0c-455f-b59a-ed470f6a9814", "value": "12288:pxR6nBVeORf721SWl9DB3J3sW7oXT1oAsvOPBue3E6R:px0nB1tKY6DB3hsWsK7vwEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617640193, "uuid": "9148511e-b99e-4595-af18-81dbbc888f7a", "value": 592956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617640193, "uuid": "0136edb8-92ca-44e9-92ec-2ffbf34ad370", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617640193, "uuid": "3afaea74-b272-4021-ab51-904f59150115", "value": "2021-04-05_0993783809.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faaec08-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644611, "uuid": "c5730888-402c-4fe6-a291-7bb00ac501f9", "comment": "Malware payload (Dridex)", "value": "06df64b3cf99737cd49e35be867057c8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644611, "uuid": "658c1cc7-8757-43fa-99a9-806bb123158c", "comment": "Malware payload (Dridex)", "value": "ea2c0345cbb112d1a51506ee97647fa0f665903df7cac64eb0de7f52ef76feba", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644611, "uuid": "9b783e17-652d-4870-a23f-b98362a6d717", "comment": "Malware payload (Dridex)", "value": "333870977b1e5a341a3289994d1b620e8ee870e0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644611, "uuid": "d105daf3-3924-4554-a148-a9886ba48845", "comment": "Malware payload (Dridex)", "value": "bdab54d261335c42c4f1c800c2ca7bbd636dc2c60c9df589962664a76a842094e0e5b0131b1f26a90ab99077adc1aab8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644611, "uuid": "a1337d16-fde9-458f-b839-77f29454343d", "value": "4F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644611, "uuid": "ae45b15b-baa1-4f59-bbeb-26be1d1a3216", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644611, "uuid": "9789acdb-2f28-4ab1-9896-9dcf05fb1d1f", "value": "3072:3BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:3BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644611, "uuid": "4fba5578-21ed-4bff-9ba7-51a7718c76b4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644611, "uuid": "7117b10e-956b-4830-a920-ae29fcbd21a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644611, "uuid": "7cefda3d-3545-4380-a433-56d550e88064", "value": "ea2c0345cbb112d1a51506ee97647fa0f665903df7cac64eb0de7f52ef76feba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace0e46e-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650297, "uuid": "2c4fa46e-7e17-4a60-9e4d-57e4b52b69b7", "comment": "Malware payload (Dridex)", "value": "578ad29967360fd046ac621e53206e9d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650297, "uuid": "1ac9a187-701e-4b29-a52a-aa5b81431114", "comment": "Malware payload (Dridex)", "value": "ea46f5e357b2a36c24cb90b8531185ad665b4cbdd028b7219d0ad2efe9264c67", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650297, "uuid": "376d1509-7eb6-49a3-b305-4cca9b4162a1", "comment": "Malware payload (Dridex)", "value": "7838bd1008fb5095e632b638c2abb99db624b48b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650297, "uuid": "01a16038-bcbd-4217-b77a-084a4b218c46", "comment": "Malware payload (Dridex)", "value": "bbec299ac9c5aa84fba1d019b2b833b4b0409366c7dfc42deff33e612b7e65289766e7a836ee683f966f08263d77a4ea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650297, "uuid": "c0bb3466-1e93-47f6-af95-14a77b0d3b69", "value": "D914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650297, "uuid": "bdff4e7a-44eb-4d1a-9792-e7fa3c598f98", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650297, "uuid": "d7ef57e4-4dee-4643-85b7-28d8d5ff8404", "value": "3072:ABHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:ABHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650297, "uuid": "06320472-80fd-4dc2-a430-ff3afdc10fd9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650297, "uuid": "72e7c053-4e3e-4abc-a7ae-03cc798b72f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650297, "uuid": "d5527834-9856-4b99-978f-95b3946580dd", "value": "ea46f5e357b2a36c24cb90b8531185ad665b4cbdd028b7219d0ad2efe9264c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d975179-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "d40b59fb-fe43-4074-a860-f12901a7819b", "comment": "Malware payload (Dridex)", "value": "d74f7e39d5faf6f30fab3db8175b4072", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "f178f81f-abe8-4dcf-bb3c-6cde2e710be5", "comment": "Malware payload (Dridex)", "value": "ea616d735eb3eb2ef29f35061b2b3208d6b811fa52d833eb2d1c8415dda13734", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "667aed96-e4ad-4556-bbaf-176715b513c3", "comment": "Malware payload (Dridex)", "value": "018ee5cebe5883a5ce4285a6319f5c564e5a9cad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644258, "uuid": "35f63096-b7af-4c34-974e-446d61665035", "comment": "Malware payload (Dridex)", "value": "f4146ac07ac0daa9a59acc132d2a5cbea3693d036d16f99d996feff10071025d5e24977ba186cbdc93af4e89a162cc74", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "b0cbee08-d045-4ce0-99fe-a3af4952b874", "value": "8214AD5ED77BD182FBF3EAF26040521512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "2a49659d-6497-40f2-a0e0-311a4634bf09", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "40b93d39-8a43-4f3e-9bd9-a1277f32b0da", "value": "3072:4BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:4BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644258, "uuid": "6a04eed7-f826-4255-aa4c-9dee23f4ce39", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644258, "uuid": "3a11822f-aced-4b76-ae8c-9c6fc56f124d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644258, "uuid": "9aa0edbe-4d94-4c73-8af4-0a9c7bdbacbb", "value": "ea616d735eb3eb2ef29f35061b2b3208d6b811fa52d833eb2d1c8415dda13734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe0c2f4-963e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617647886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647886, "uuid": "d55c238e-6d85-40e2-a803-3f743bf6fe48", "comment": "Malware payload (Dridex)", "value": "32dd946ec5b4d11af47603be531799a2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647886, "uuid": "045691b3-680c-4280-a8bc-1580481ae207", "comment": "Malware payload (Dridex)", "value": "eb8a2ace0807a67e3bf217946a771b3fe5b74075e3871ba2b96d197d70a82e40", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647886, "uuid": "871b5637-087f-4f34-bc7d-0a2aaf2aa9d7", "comment": "Malware payload (Dridex)", "value": "eb512556dc332d7a2cb5f2d085118a5ca87dcb10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617647886, "uuid": "7444bc13-2ffe-4f09-b823-4cd5dc066454", "comment": "Malware payload (Dridex)", "value": "8d1ebe564481f352abb6b2e13b4690b908b57dc7ba849aa14b901ef2da6418e14cf6b6848e303a74dac0509009455180", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647886, "uuid": "7b3487a9-3048-4742-8f18-d057364f388b", "value": "FA14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647886, "uuid": "ab7e773f-8865-4809-ac13-aea1b5919473", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647886, "uuid": "647e5981-4b27-4349-bfa1-b96b016de97a", "value": "3072:zBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:zBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617647886, "uuid": "fc062230-9c15-46d3-8167-cba1ae4a8f71", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617647886, "uuid": "0ed3bfe5-ed04-46ca-b335-5e1277177963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617647886, "uuid": "2699b760-4f2b-4be1-8def-4674920672e1", "value": "eb8a2ace0807a67e3bf217946a771b3fe5b74075e3871ba2b96d197d70a82e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085029e4-95d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604494, "uuid": "7bac2900-554a-4a7d-a161-44353b9ee214", "comment": "Malware payload (AgentTesla)", "value": "e32848d6814202662bc76bb09558e390", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604494, "uuid": "c8036242-7284-4f54-993e-42ea2c873b53", "comment": "Malware payload (AgentTesla)", "value": "ed4351f2a2d480f3bc7e25389753b9c640cf34b7b2b9a0cab16aae41754eb5a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604494, "uuid": "715c3229-166b-4513-b140-495c382ce4a8", "comment": "Malware payload (AgentTesla)", "value": "84783c1f1b25c06dbe3808f324d2d77153315fa6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604494, "uuid": "2b2c8f13-82c5-4ebd-aef3-3e743956abe2", "comment": "Malware payload (AgentTesla)", "value": "c3d5ba2b044b8a778f3c6fd0a60be608c9e3f424ca82a76c49f65b866470be4f3cb0a92a06dbd3dd8d66e4e9c45d8113", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604494, "uuid": "00acf98d-c156-4732-81d8-5381cf9a672e", "value": "B6457D66B341D084F95E2871CDA1FBF00517BD2ADE0E6D0B158E3E82757BA9B473A183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604494, "uuid": "c2eca176-553d-4f3b-b020-b88a119b737e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604494, "uuid": "556d3f1b-1070-4a83-995d-a8a25ca686b8", "value": "24576:hq+HYKkBXJDru8UbY9xKIJVOl6n2BGwx/oy9ALTq1:NHVyXT3PVyBVAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604494, "uuid": "f6136380-8059-4dd5-b5cf-ef8dad9787f3", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604494, "uuid": "648fcce5-133d-45d3-b797-ddc548758129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604494, "uuid": "2b14bc83-feed-4786-ac66-d8d20fc31d52", "value": "PO AA21C04U3101-MTXGA6_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c37b46-95d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617602986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602986, "uuid": "86c89fa0-0385-4d16-a418-f1349110a232", "comment": "Malware payload (Vjw0rm)", "value": "32ee76e97a1c81245b6a46f58d325c6c", "object_relation": "md5", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602986, "uuid": "647429e4-97ac-4b6f-93ed-c767ea9b7aca", "comment": "Malware payload (Vjw0rm)", "value": "edfc2ab4dda22155a535eade581e2acf7b7eb4ad340812901b74c8383026d5a5", "object_relation": "sha256", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602986, "uuid": "e7f0f388-a2d6-45b0-8be2-48f001652f01", "comment": "Malware payload (Vjw0rm)", "value": "9274db4ef24695412530c05e3405b8ec3c472088", "object_relation": "sha1", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617602986, "uuid": "5a215ceb-791a-401c-a0c5-b2d9ecaa90ed", "comment": "Malware payload (Vjw0rm)", "value": "ed78624ecd0ba299aeefaed323b6fbd748e2e4f669e7a60eb20b786afa94b70d2b72431d8064a47f81a7ed80adb304aa", "object_relation": "sha3-384", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602986, "uuid": "dfb8a867-f172-4a70-a549-d86a647740b3", "value": "0ED2C45125FCCB85DB70E3122BA2BC535C75D180D4BF6068F8869D08EE0C6ADEB9C6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602986, "uuid": "c319e7c1-a51a-4d6b-b93d-8c170c91ea62", "value": "192:BPD4FkmBEbX5RLIFiAMgW6lk/Rq5cUgwHzzj/glUUWRxQ8xI:Br4FPkiRrnMRC9gAzzjolUUWxQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617602986, "uuid": "b0d1d9f4-647a-422a-96da-416fecb2248f", "value": 30608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617602986, "uuid": "928a04bf-1958-448b-a828-eff1162d8cd6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617602986, "uuid": "910495f6-12fa-4160-adf4-53ee0a747d4d", "value": "ID8428456013.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f02e0a2-961b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617632906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632906, "uuid": "d6fbb703-bfa7-470b-a682-bae8d5a4de3e", "comment": "Malware payload", "value": "e89499aa9c03cfa2d6f09288e26bcf23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632906, "uuid": "9411ca7f-708a-4549-bf77-f52a6e98900e", "comment": "Malware payload", "value": "eeb94d0ce7213c5b8c070a7df59ba79aaf8248361922980368c31295c6641aae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632906, "uuid": "6fe52e5e-90a3-48a8-ab93-47efd15b907d", "comment": "Malware payload", "value": "f0722e275e583d2b18447cd290b5fb32958ac157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617632906, "uuid": "226e1ea4-38ff-46fb-88ad-cb1e7316f300", "comment": "Malware payload", "value": "67f7363df83369a614f6ac9b4d98356f0e8764e60dd6f7ac4ad2a13febe817f9ac5809a59705bdbdd5f7e486323d84b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632906, "uuid": "a35a5987-6d10-4940-af64-2479bb347d42", "value": "B0F2E6ECC99D8EE2E02CF37243B7640E4674DD732941952B968C20974EE67E118DA8DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632906, "uuid": "9c737c62-4f18-4216-ba9b-04ce669ced3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632906, "uuid": "d908f86c-5f1c-4d6c-a85f-502df9530f1a", "value": "768:VfN3dppcAb52RgnG8GKd0JUGfliGflvx/FIwVLk9TuCRJQOU2/:VfN3djcs52RoG89+JPoToY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617632906, "uuid": "56f67a75-c4f0-4a88-a54b-08b5a5c3db6e", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617632906, "uuid": "ca844494-4dc5-4355-9660-87a001bbced7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617632906, "uuid": "e08ab375-0ff6-40f9-a82e-f04bff1840a0", "value": "Invoice_Ord000002341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd6ac2b-9643-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617650270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650270, "uuid": "a9cbccc4-c4d7-4dfd-9a79-f7f87bca96e7", "comment": "Malware payload (Dridex)", "value": "eadae4ae2e9d62717e9e0b4eae92cb11", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650270, "uuid": "d6afd01a-15e3-42cf-8ed6-dfeea7491323", "comment": "Malware payload (Dridex)", "value": "ef74b45d50718f84292f5b177def506fb9da377713f285d87cd264a2393ea3c3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650270, "uuid": "167d75e9-a4a2-4780-80c2-db3cbec64380", "comment": "Malware payload (Dridex)", "value": "ad577f4ea12d44ffface3fe5f264861ccb5baf63", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617650270, "uuid": "308aa1d6-891d-4978-9b40-00a208fbb613", "comment": "Malware payload (Dridex)", "value": "e999e597189ded7de984be1600de5b271928a0a9b58f30b7df8a0cbfe19c74dfc98ac31e999750c6cd0f113e9a12c5f6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650270, "uuid": "0fa3804c-cef8-48c7-9066-c518857bce1c", "value": "CE14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650270, "uuid": "fa7fa71c-2b62-4732-9a9e-711a17b33bfc", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650270, "uuid": "da6deadf-a195-4e93-ac03-41d8f49b0df8", "value": "3072:YBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:YBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617650270, "uuid": "e7491771-b97b-4af4-8b06-b5c4f8e3bc6e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617650270, "uuid": "c8c883ba-12f3-4045-a624-95ce2c764658", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617650270, "uuid": "32f409db-1393-44b2-accc-35799403d275", "value": "ef74b45d50718f84292f5b177def506fb9da377713f285d87cd264a2393ea3c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e590f7-961f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617634905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617634905, "uuid": "9fc08df4-cd8c-424e-8b0e-93726b67c056", "comment": "Malware payload (Dridex)", "value": "0baa8263199bac58971b6c10b057dd53", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617634905, "uuid": "d72104f0-d0d8-4395-9138-47b2ee42dc97", "comment": "Malware payload (Dridex)", "value": "efc67f1c77aec88eda7cf1f5403ca9d942b0187512d6621fc7f818e9ad1a6cc8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617634905, "uuid": "80af5576-f93c-4b2f-ba9a-6edd4a6cd22c", "comment": "Malware payload (Dridex)", "value": "f7918ed05c39b579814156266f410a4249f310d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617634905, "uuid": "23e41ec2-17c6-4072-9868-bd9d52956704", "comment": "Malware payload (Dridex)", "value": "ff7cac3ebc453da0c2c968281936f25de8ea7611257cf00acacd54552d1e52560ec0673a96947f45d0a54b87c800314e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617634905, "uuid": "d123dd69-7301-4039-85e5-adb47f6c117e", "value": "D7752242FAC6DF1BE16E91391E53CA787A6AED946E00C267716C3B9E3D310314AC674C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617634905, "uuid": "f0031a12-eb72-4917-aa19-06a85a577f12", "value": "24576:UIiUW+OUbrouAYPdhxFdGZj1lSu15IpwpXqjTWu5/Ayr3wHdyDZkJkYd:fkUJNEfl/q7jd/AyLUdiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617634905, "uuid": "507d6be3-850a-4f6a-b783-0a28e78b5b04", "value": 1695232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617634905, "uuid": "a004dcf8-0a30-4447-b1d5-09d41b0a3465", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617634905, "uuid": "67ede285-9d4f-422e-a5a7-f3b9665e812a", "value": "1569--1569.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd982b6-964e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617654996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654996, "uuid": "58c4c0c0-8580-4a19-95d3-1c1435a038b2", "comment": "Malware payload (Dridex)", "value": "91bfcaca7db4196960a55a8caf2b8b99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654996, "uuid": "8ffb303b-f8c1-400b-a5c5-2a5f0041dcdc", "comment": "Malware payload (Dridex)", "value": "f03b63d5eeb7affb18bb6a675e2aa49a47377f36953ce750ab0e62c305700078", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654996, "uuid": "3851fa47-f4d5-4f55-b1d1-0e913e6b8596", "comment": "Malware payload (Dridex)", "value": "6b97752d5d62cccefc30f39f5b9993087ab16dad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617654996, "uuid": "b2a7c7b4-d100-433a-baa0-57f413a2f4aa", "comment": "Malware payload (Dridex)", "value": "ef2d59e59b5823de8ba4d56aeb76f083dd68621d6f2e1fba2855707751ee2d9b4d7ad5e33e2515840d1e8aec5f43464a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654996, "uuid": "96d5c516-5c73-426c-8f71-6e323347b08c", "value": "C314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654996, "uuid": "14ef4ad6-c6c4-4463-a2e6-acc4fbb14f58", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654996, "uuid": "5caae967-c2d8-4482-8ddc-af13e1629d07", "value": "3072:cBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:cBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617654996, "uuid": "8122a5ed-e0c5-4111-8722-20509bb98221", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617654996, "uuid": "df286e7a-71f3-4d1c-91dd-df9138c9fa7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617654996, "uuid": "694de77c-5bf3-4fd4-b986-2fa1ffafa868", "value": "f03b63d5eeb7affb18bb6a675e2aa49a47377f36953ce750ab0e62c305700078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e0e1b2-9635-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644277, "uuid": "e8f4617d-0efa-4c66-b747-6fae1a42488a", "comment": "Malware payload (Dridex)", "value": "ab4a9d6e6fde2c488c32f722f43b564f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644277, "uuid": "c18b8637-54c4-4eed-89e6-b5038f3ea926", "comment": "Malware payload (Dridex)", "value": "f0c6fde27bfb0a958d4ecf6870722800d9ef9aa28e8a6f7e6bd7d58eb397a17e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644277, "uuid": "ee37a718-8c78-4ff5-982f-41cd4595236c", "comment": "Malware payload (Dridex)", "value": "a0916bc31aa83a609a90fedb4942aefdcfbf1ec2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644277, "uuid": "05de8bdc-71b9-4182-835f-04b4f6938537", "comment": "Malware payload (Dridex)", "value": "fd83f63b7bba658265d12b56404a0b258ea869775dd0f075ab47a8aadcfb702330d956b647b449598ac54b8079a8882d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644277, "uuid": "579ab036-6794-4809-a366-31f044919981", "value": "3F14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644277, "uuid": "cc60e244-57f7-4c89-ba5c-ceee18bc35a4", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644277, "uuid": "b4e7aa3d-88e8-49c2-b8e8-56b14ddcbe88", "value": "3072:0BHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:0BHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644277, "uuid": "46faa85a-1e8c-4b7b-b808-aa45c5a1f18f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644277, "uuid": "323090e5-a4d1-4243-b569-2ab3a661e697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644277, "uuid": "21c492c4-1bb8-4dc2-ad9d-2a7056c9ba0c", "value": "f0c6fde27bfb0a958d4ecf6870722800d9ef9aa28e8a6f7e6bd7d58eb397a17e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550cfec0-95c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Babuk)", "timestamp": 1617597321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617597321, "uuid": "56edfd0f-0460-47ea-b24c-9f3130f5776a", "comment": "Malware payload (Babuk)", "value": "0bbb5eafade47a9d212a23fc886646b7", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617597321, "uuid": "c874ed59-b94a-4021-a026-ee93c466b7f3", "comment": "Malware payload (Babuk)", "value": "f1719415abe4dcba0daef0a1e5c8994d1d3c0c659d3e0a11b34f307370dd8683", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617597321, "uuid": "4bc5f356-baf3-43d5-8bbd-5f27eaa19bf1", "comment": "Malware payload (Babuk)", "value": "e0968b05a8c11386bbfd2a7f85e2ce3510b31094", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617597321, "uuid": "423c8208-bdbb-40f2-92e6-66d1c812c001", "comment": "Malware payload (Babuk)", "value": "ea4fb34a44e78702be721394746ed39903ef75f008f595f6ee9f730b141593aece1cdcd7e111e9c7b6161e94605b3fd3", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617597321, "uuid": "4edcc17a-fca2-4b8d-86ac-65f2da901481", "value": "B883E8115D45D2B6C5D1623151A7F1AAC13A197003B5B38B63C027AEFB10AE8F6BCF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617597321, "uuid": "22091505-da21-4549-a04f-3a3e7f08aa3f", "value": "202fa14f574c71c2f95878e40a79322d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617597321, "uuid": "abdacdf3-2c75-4204-85b7-bf8cba76280e", "value": "1536:Ik36UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:IkLhZ5YesrQLOJgY8Zp8LHD4XWaNH71m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617597321, "uuid": "8ac0a80f-247a-4e08-ab88-77eec2a4b0a4", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617597321, "uuid": "e6ce8ddf-65d1-4d6c-b352-294a11b1c929", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617597321, "uuid": "28e8a535-7550-4f18-93e9-fe26db84f311", "value": "e_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3b9f68-964c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617653893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653893, "uuid": "b794b1e0-2848-476c-be93-8648e4d2ed2d", "comment": "Malware payload (Dridex)", "value": "096010fd6d1129326e992365aa941481", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653893, "uuid": "6da78da9-ebba-4e22-a5fd-523884519678", "comment": "Malware payload (Dridex)", "value": "f26f7ce7f4795e1fbfbb8d604cd01f368f104a12d4fe6dbb4d4fc5d9fc2ed4a0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653893, "uuid": "c1aa3925-2c7e-49f0-bc2a-634e6f758143", "comment": "Malware payload (Dridex)", "value": "77d2010798fc1c4f2335aaef8af8b01d40a1fd62", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653893, "uuid": "73582aa8-b4dd-4cee-8857-74e1d8ffe1b4", "comment": "Malware payload (Dridex)", "value": "936fc77e20eadb4904935c94a96b928d45593f4a9f0c791e6352cc4842231fb68efc61c11b42429c3f5c085754b8f36a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653893, "uuid": "db174669-5674-4de3-a9cf-3058875b7a80", "value": "7A14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653893, "uuid": "e7afc158-d53e-41dc-9296-2fb917c9fc8e", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653893, "uuid": "d61bc456-53c6-40a8-855b-1ee5d79dccce", "value": "3072:VBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:VBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617653893, "uuid": "caa62c3e-399e-48ba-994d-64094a3346f2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617653893, "uuid": "52bad936-4199-48a7-93ac-eb03c610473a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653893, "uuid": "0c99178c-9880-432c-b5be-aaef0e1d6036", "value": "f26f7ce7f4795e1fbfbb8d604cd01f368f104a12d4fe6dbb4d4fc5d9fc2ed4a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b28efa1-95d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617604284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604284, "uuid": "8da52645-7a68-4168-912e-773260915cb1", "comment": "Malware payload (AgentTesla)", "value": "5752a517f0cfaccc399835da7d9d2d1c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604284, "uuid": "39ee5f87-072f-4dbe-b56d-69bfe136d7e0", "comment": "Malware payload (AgentTesla)", "value": "f71a9f6c889da0fd4e9ce426199db359bd615fad7808ea5d86a0be289ffa950a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604284, "uuid": "a4c00f90-61ac-488b-98d8-68d71c8ee30c", "comment": "Malware payload (AgentTesla)", "value": "f363ba45e3490e67a679e8bdac90e965fc1e31f0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604284, "uuid": "c4815f91-4820-48ca-95ad-ad041f9c639f", "comment": "Malware payload (AgentTesla)", "value": "5466e4c779efec980b5899e0245e38498537938b16dfca7e7bc946ae2dbe24b5fbed20f4ae17c9df699743ed7068fee5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604284, "uuid": "110fcccf-f98b-4278-9e65-5fdac64a144f", "value": "84F423F35E2650C8BCCD05F5DDBD349E6FE95591A0E879198698DC2EA1F4613A0CB303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604284, "uuid": "c5d90f7b-7edf-4a55-b215-0a519ea04bda", "value": "24576:hr0qVroyaFzSO+n9ZASLv5zo00ho2tBq2/cPTYtFvAXt:vOeBLvq0AoIWPcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604284, "uuid": "1949bf53-adcb-46eb-bb4e-33c064bdb538", "value": 788586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604284, "uuid": "186b9067-969a-4bc8-8be7-ddc2dcb221d0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604284, "uuid": "1951c1c4-2118-4d28-b7a8-344bcade6cca", "value": "TRANSACTION_INTTRANSFER_1617266945242 MEDICON_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb2c61c-95dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617606622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617606622, "uuid": "f282fd6b-8081-466d-b287-517c77fc786b", "comment": "Malware payload (RaccoonStealer)", "value": "c7845e1fc375b2edb666c547c83fb76e", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617606622, "uuid": "e736ea29-4de2-4a68-8c20-544a010206ae", "comment": "Malware payload (RaccoonStealer)", "value": "f72a2fd77ccffec0e2c9bf4570895a48942135778325d52ca2996f54d26a45c3", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617606622, "uuid": "02f7179c-cf53-4594-880f-a7d90581bc8e", "comment": "Malware payload (RaccoonStealer)", "value": "f8ed59baf8d4479019832842d1583e80d1cd7ab4", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617606622, "uuid": "a3dea221-39c9-48d0-855e-a543dbdd6184", "comment": "Malware payload (RaccoonStealer)", "value": "fe6a012fdf6cc21a81fbcb51c5833fefe6945fed63729b203f2c5a48b6c0a2cab7db8799699ae920861b1c5fca320525", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617606622, "uuid": "173c0368-cd72-4be2-8720-ccced89061ad", "value": "15C4E01132D0C0B2D16765BA4525CBF14ABF78356A369ACF7BC40BBD2F247E1963930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617606622, "uuid": "695ed0f6-1270-42ef-81c6-be4cb32df7ca", "value": "74c8fac989671e15368b35a402c5961d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617606622, "uuid": "a124a0d1-d803-47bd-bc1f-544784a6230d", "value": "12288:+mMFa2DRucv5S7xdHpp2wmZEM1AU12E61K9NQFeZvk6L:Dca2DGnTO2E61kNQOvk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617606622, "uuid": "b2e71cb6-a16f-4ca0-bc07-9f62cbe10775", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617606622, "uuid": "55264b12-1b74-4c2e-a7d0-5dc35f5bc878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617606622, "uuid": "9e73087c-90d8-4df2-ae9b-e2c10fb5bda3", "value": "SecuriteInfo.com.W32.AIDetect.malware1.1450.913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5908e7-9626-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617637683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637683, "uuid": "d8131e88-684a-40c5-935d-0b095ba232a1", "comment": "Malware payload (IcedID)", "value": "27d0b2e263e87aa65bc7756a51dcda5b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637683, "uuid": "ee778b0a-12d9-4d64-b36a-05e7e50fe342", "comment": "Malware payload (IcedID)", "value": "f8f782b7fca0552ece30d0d8be455103d30e81817ca249d0453a1e6416e92f9c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637683, "uuid": "8bc62a6e-4d26-4246-befe-c1689aa556ac", "comment": "Malware payload (IcedID)", "value": "2d86e411d683fdc5e42d9224462ec5f6a532f226", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617637683, "uuid": "ddc456de-939f-415d-8812-bafdb7ae0ba9", "comment": "Malware payload (IcedID)", "value": "a5e0f7e66e3597a5044189f2bb7bf04802e9791365beb1d4746413d44900f95050eb7fc346e2f84b5548222c9691ff8c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637683, "uuid": "9a1042e7-6988-4566-83ff-af5a02f75df9", "value": "FB04123CD06A4D58C2E5543BC858C55AAC262027BDF8A9BD758C7948EA632F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637683, "uuid": "8e938040-bdbd-40b9-913c-5a61714bcbba", "value": "3072:qHYXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGUmh:qHgE5SDvbXAyHbVt15wTQDjmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617637683, "uuid": "f4302ad5-8a56-49cd-a494-71df8b9978e4", "value": 178369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617637683, "uuid": "7f2c1835-a394-439e-8874-a4fdf0ad41fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617637683, "uuid": "acc8f17f-1531-497c-9f02-6e93b800f23d", "value": "Contract_1836733707.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6343085e-9642-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617649744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "95ecc587-9d43-4796-bb9d-d662e53b2cb3", "comment": "Malware payload (Dridex)", "value": "ed78ceb5257f655cce60d2a560f8887c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "96c011c6-8828-4c1c-bc6f-3a2e4755ee6b", "comment": "Malware payload (Dridex)", "value": "f99c98858ac7a9866afb9325d560a2c3054148b4a2b662af4ef39a2e8ce79873", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "88edba3b-8222-439f-95b7-6b466e32eb5b", "comment": "Malware payload (Dridex)", "value": "1475e669f405cfc4c93d5aebc8441d01fdce5089", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617649744, "uuid": "c23a0b3b-b68a-4d30-a879-014fb0bf90ee", "comment": "Malware payload (Dridex)", "value": "d8d237f58c4086d0ad0b67df4b4fe489583e6021c47088ea9afbdc5e6389d29e0ac2f8faaa18e3d1df15f48f4ced237f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "fd73ef40-5b68-42d3-95ac-72da015909f1", "value": "5314AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "1afed327-fff2-44b1-a455-f6e11098e0bc", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "51354a3b-e03a-45fd-aab3-302ad3236298", "value": "3072:JBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:JBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617649744, "uuid": "57b47dfc-1cd6-41e5-a5c0-f7355505f0d7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617649744, "uuid": "49b32dda-d54b-417a-9ff2-8137b0ed0180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617649744, "uuid": "a341b05e-608d-4a3a-91b0-dabc02803662", "value": "f99c98858ac7a9866afb9325d560a2c3054148b4a2b662af4ef39a2e8ce79873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39d6576-95d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617601345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601345, "uuid": "a5efbb17-4aaf-4359-becb-892151e5fb51", "comment": "Malware payload (Dridex)", "value": "a2e8fa0b021d6dc9a43ceaed7990cf46", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601345, "uuid": "bc90b93f-14c3-445e-8283-632fc2ed480c", "comment": "Malware payload (Dridex)", "value": "fa4f70be85d8ad7d6ab31a27a6fe5c45218cf53524a4ad2ccd40e28bd9e1a46d", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601345, "uuid": "a5d5a196-a3e2-4e72-bd98-9b7f5a656bed", "comment": "Malware payload (Dridex)", "value": "a0f09194566750c66acb7428263e9c6fa12b6702", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617601345, "uuid": "137bbdc6-3571-4f96-bfee-7a4308fc447f", "comment": "Malware payload (Dridex)", "value": "5b0a131f7cc4339a3701eda21654673153ead934c66c2dd88d636a2f69a084df98c83a96be1511e599c68ff31e736887", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617601345, "uuid": "8b45439e-c8e2-4a6a-82c9-9a4c58f8792a", "value": "95058B02B691C025E1B242B9CE66C6FC99397DA1DF6854CBB2C03F9F3A746D19D31623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617601345, "uuid": "433904f5-f663-4cc5-a166-73ffb21ea139", "value": "523b18dc1c7a7f2ecc8f20b6295beddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617601345, "uuid": "e187fc89-fdc6-4bed-81cd-9c1ec82ea84c", "value": "12288:HbqkjZV1Vu8MpJYosZUmc16RWdrxo8+FFcLxT8HoxmRsDJteMKT281MOU7qOkQR1:HbqkjZVqxYjxoIrwQobmMKNiOUFkK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617601345, "uuid": "f3b105eb-45d1-4e86-9667-b040a5420fda", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617601345, "uuid": "08d5dbde-47e4-4942-a838-b86f2b341415", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617601345, "uuid": "05c260c4-ad3f-4ab7-857a-8ececc89ee00", "value": "fa4f70be85d8ad7d6ab31a27a6fe5c45218cf53524a4ad2ccd40e28bd9e1a46d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631edeb0-965f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617662199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662199, "uuid": "83bfebb1-303f-4e77-8cd1-fbd601e349c5", "comment": "Malware payload", "value": "22d3501147d4aa22bde57209ea2fe6d9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662199, "uuid": "267e776f-a77a-4fbd-8766-daec7fdd7c57", "comment": "Malware payload", "value": "fb2ad9c07529b0f5c31a23de638c842d93e3c799a22a4b789e2ae46baecbd3b3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662199, "uuid": "82c46f96-b86a-493d-8e27-d2bb6582f87a", "comment": "Malware payload", "value": "e2c03c933ce470f469be474987f5091a572bdec1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617662199, "uuid": "affda9fb-275a-43d8-98c6-b4cb3394eb05", "comment": "Malware payload", "value": "7a343f1e765d02f34353b7ab103191d3fc6a9c03cbea4a90efad8657c35f37f823ed65bfef0b566c68c46ce78b66dcc2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662199, "uuid": "8ef0e422-5410-490e-a44a-50bfb88d366b", "value": "7914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662199, "uuid": "451e8d84-8e71-44fe-b9d9-7e03b6d04f03", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662199, "uuid": "f52df67a-2c50-4724-83da-0e38a6b72a30", "value": "3072:rBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:rBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617662199, "uuid": "0d73ac33-81a8-4899-bc97-d02678eefaf0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617662199, "uuid": "5111f8c5-1062-40c8-90b9-8db4348cac1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617662199, "uuid": "b27d449f-3aa5-4288-8c9d-143e1125963c", "value": "fb2ad9c07529b0f5c31a23de638c842d93e3c799a22a4b789e2ae46baecbd3b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccc7e3c-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646485, "uuid": "749c058f-9ca8-4493-bb9a-cd10efbc9394", "comment": "Malware payload (Dridex)", "value": "72a069131ae5ac695597b34f9dd6e5a5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646485, "uuid": "8505c045-3fa5-4a52-84f9-6ea2e3f6e41f", "comment": "Malware payload (Dridex)", "value": "fb8a0cae1a72efd0d8b490dd15b0c923f5533e631168ccbf365837d765bbf373", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646485, "uuid": "5fb65e4e-1dd0-4fdb-afbe-e37fc5b9d595", "comment": "Malware payload (Dridex)", "value": "e9218201a689f1e3148c3d367fea90a247c289c1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646485, "uuid": "a8a509f4-4afd-48a6-a584-3023dc391058", "comment": "Malware payload (Dridex)", "value": "9573de44d7d3ccea4490b824d4dc96cc1c99acac900905fb022d6e3f827e69f1282e55e645c4135fc164b644bec39fc9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646485, "uuid": "ae5aba42-3c28-4990-92a0-f251f107c6bc", "value": "21149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646485, "uuid": "a0b5af3a-0e68-480b-bee1-562aaf6e72d6", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646485, "uuid": "36d438a9-c4ff-4835-b722-1fed96fa9f02", "value": "3072:L6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:LZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646485, "uuid": "bb596933-e25e-4e7a-9953-227ccb89a92d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646485, "uuid": "d427925c-9d3a-4846-afc5-e7189427f17b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646485, "uuid": "519c44e1-c635-458f-b7ee-df3e114162b2", "value": "fb8a0cae1a72efd0d8b490dd15b0c923f5533e631168ccbf365837d765bbf373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b687013e-963a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617646447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646447, "uuid": "6ff6e257-0bb1-4d49-a3f0-19e664ff9cff", "comment": "Malware payload (Dridex)", "value": "d46c60037d70ec769bb6be02f131968b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646447, "uuid": "98105707-277e-4449-b612-ad4ff362b876", "comment": "Malware payload (Dridex)", "value": "fb9582d7f70af7bb83d7e3e2145230b95a6d8ee0060db2621be7ae81f2c98152", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646447, "uuid": "a13e2c6d-c2f2-4e61-82b5-e532c712451a", "comment": "Malware payload (Dridex)", "value": "1a68a8b461b2203007829a118fa61378f31abb4b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617646447, "uuid": "c1ecf0c4-55ae-4c7c-9c66-56bb0505e26a", "comment": "Malware payload (Dridex)", "value": "1c6a217079b10319979ef047415562590bb8a156234c9429a06d2d29cf2a119146dea4e8c3c360e0220a042ccfd9c6af", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646447, "uuid": "0e7b60e9-93bc-4dff-ad72-bc46e8c9edde", "value": "C4149C0CC367D281FFF3DAF2501A76759A339C81856F861AEAD0263F8ABF84D054616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646447, "uuid": "448449fa-82a7-4ea6-a4f1-be7d6c2400b7", "value": "cb5482a0fad978688db5ffd0e59e43ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646447, "uuid": "94501b5f-dd74-4217-a8c9-8ed9d3000308", "value": "3072:c6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:cZuX6pEaeEDheWa+Jc9bhorfTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617646447, "uuid": "d6cab9bb-c439-4504-9ab9-6aa41ea6df32", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617646447, "uuid": "31f1fe23-9cce-4671-80c0-41365e01493b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617646447, "uuid": "4c3ab74b-df12-439a-a8e0-bae933b015f3", "value": "fb9582d7f70af7bb83d7e3e2145230b95a6d8ee0060db2621be7ae81f2c98152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4267d4e1-964c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617653984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653984, "uuid": "27514f4c-f87b-4f9c-a390-39876a2e4caf", "comment": "Malware payload (Dridex)", "value": "f1e3c8a6815ac82f850c5320fbb1ab6a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653984, "uuid": "f20a6f2e-c755-4928-baee-fffaf0d686c5", "comment": "Malware payload (Dridex)", "value": "fc2e81b3c10e2b88e824df9ec55f66f80024ce28143a789e4940444ce8f212da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653984, "uuid": "a1d2a0e2-3ed9-46a4-9d4b-f022de41549d", "comment": "Malware payload (Dridex)", "value": "869b46125e3fd34323c08b05a44a35f2c51c83f2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617653984, "uuid": "ed83137f-a467-443a-b65a-b282abc76148", "comment": "Malware payload (Dridex)", "value": "294a24555dd7166225d27319680e8234d1d3801b04cfaa23a1ebd885be20d5efe1a642c9f1d55350dc6f7b24b3dd4ab9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653984, "uuid": "3aa0d476-9786-41eb-91c8-a4903970dbe6", "value": "BF14AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653984, "uuid": "60e16621-9e1b-4907-aa65-71347a86b9f5", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653984, "uuid": "627729b1-126d-4a38-8a41-583892ab137d", "value": "3072:xBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:xBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617653984, "uuid": "751c3bc2-3415-4bf8-b3a5-d7534cfac22f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617653984, "uuid": "2ec29488-5407-41ea-a407-e4917b6ed114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617653984, "uuid": "66dda50c-1c0d-4eca-b64d-5d69f882830c", "value": "fc2e81b3c10e2b88e824df9ec55f66f80024ce28143a789e4940444ce8f212da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a862b89-9636-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617644602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644602, "uuid": "55eb38f1-8807-4f3d-b723-0c4e7de497b6", "comment": "Malware payload (Dridex)", "value": "406b87fa11e278df29a94457154255e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644602, "uuid": "2daf628b-f508-4b4c-a961-12b40427ac0e", "comment": "Malware payload (Dridex)", "value": "fcc3a79d98f11174959ab93ccaaafa448656a95acfcbe7ed6bd8940dff449ccb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644602, "uuid": "541f2088-1859-4e3f-822e-99381381dfa2", "comment": "Malware payload (Dridex)", "value": "c9cfc278288ecfef4dc092cb89bc95903a658a7b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617644602, "uuid": "37fb5426-a803-4b5e-a628-53e482cfcfa3", "comment": "Malware payload (Dridex)", "value": "8d96c2ac59a64679f49b73436378027eb47305c64bb8a1fa495db84cc442c7f2785382773baf1f61341cc6733d855eed", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644602, "uuid": "0dd7e42e-d8b4-4656-9e4a-ee4a4db91f8c", "value": "9914AD5ED77BD182FBF3EAF26040621512372E43014EAA19F6D5B9BF887FA0D05A058D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644602, "uuid": "d182bae9-4fa7-4a5e-8c99-37ccc4a4d947", "value": "2715a19d1d4a50604e0ace50d5e16153", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644602, "uuid": "a1c064ab-a783-41c0-9e6f-0b5e9e2f1836", "value": "3072:UBHfDmTQoHJhc+1aImpJRxSmR7bVsSazalcBfc7Ivu5IMlZ:UBHLSc+wLJRHFVsSaGluUs25Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617644602, "uuid": "abc7098d-6512-47fc-a285-9041144af72b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617644602, "uuid": "a86e7324-0160-493b-971b-2d3350e81618", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617644602, "uuid": "2cb13f88-b0df-49c2-91d7-0a4e91d637a5", "value": "fcc3a79d98f11174959ab93ccaaafa448656a95acfcbe7ed6bd8940dff449ccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200effcc-95d9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617604534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604534, "uuid": "d65cbf6f-0889-4d48-97f0-1e04ab7a40eb", "comment": "Malware payload", "value": "c11d152b1b654aa552b9f248046975f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604534, "uuid": "4b4a2f0b-3743-48f6-8b71-be707bafa436", "comment": "Malware payload", "value": "ff27bafd0fef0eceecc6eff2e1a8b011b1615ddf645f49b3574c4d237d7075c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604534, "uuid": "2d499619-4081-416e-b6d2-ed7e0d0e0ade", "comment": "Malware payload", "value": "2b2572ca2b908413cf2930908ad5172642dac253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617604534, "uuid": "6e34266f-abb4-4ae0-bdc5-683c40930e80", "comment": "Malware payload", "value": "54ac1daab2bd982d0535dcd8889a8957fb212856da47e3f2dda45dc77ed98d2ae31596de66b7a62aa5912d5110205bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604534, "uuid": "32903ca9-f80c-4bfc-baf1-2d9463571045", "value": "1F35F01176805204E8AA2F341827C67503B3FE46BD2DE65D6CCDBD4F7F33A968712692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604534, "uuid": "812e709d-38bd-4d26-acbc-228eabe7f61a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604534, "uuid": "85d3ef86-26e0-40eb-aca1-067284d19f14", "value": "24576:3D5VlK6t1HbIYBfRdtKYRVbDPeMNJrXSYenxnJ:z5VlK65bIyRdUYnG8rX2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617604534, "uuid": "e794cc50-222d-4e7f-91f2-e7706af96023", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617604534, "uuid": "a621e0ce-11cc-4e6b-afdb-85280b7fc945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617604534, "uuid": "bd127108-b92d-4e3e-b8c7-a096bccc72c9", "value": "KUWAIT NATIONAL PETROLEUM COMPANY (KNPC).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }