{ "Event": { "published": true, "date": "2021-05-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-13", "timestamp": 1620950581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fa5502f9-52eb-4d0b-adb3-0d4a377a2831", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0956125-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871528, "uuid": "93b4b3f7-255c-4818-beae-59625b1b2844", "comment": "Malware payload (Dridex)", "value": "41c58b9afbff3ff94dc95757a2ebe6f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871528, "uuid": "98b79bab-26bf-4e9e-b9ca-f9fe9b096808", "comment": "Malware payload (Dridex)", "value": "000c9c332efab7b9268ab62abd4334e91e1eff29b3a8e14c4bcc5fe1593ecaae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871528, "uuid": "fdf4bc9b-8b7c-4414-ae20-3fd73991af76", "comment": "Malware payload (Dridex)", "value": "5220ac4663b27efba6f504fe1945752bad2ee3a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871528, "uuid": "57b23f17-31c2-447b-ae56-c531c2a3240d", "comment": "Malware payload (Dridex)", "value": "813ee0e2ab42a457dc6ef34e1763035ba1a63d533b61da36c743373586441da49dd8b565ef8413019b05edae2f0887f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871528, "uuid": "e201daab-c92d-422e-86e3-a6a078be5eee", "value": "F7F3D0906AABDF0ED9C13CF96AD6A879B073458C811FD9B4D0CE84CEA4B75B34227113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871528, "uuid": "49b9d3fe-5c02-4f76-95f3-3c7ecf6475e9", "value": "a86a1220a8aaf2bed0594d018b59c83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871528, "uuid": "1cc31506-aa3a-4e5e-900c-a481d59a80e6", "value": "3072:Cesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLiV:E4+VZQpt5hyPsa1ekiE9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871528, "uuid": "22e1889c-a076-4f45-a503-510a311ce29e", "value": 166856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871528, "uuid": "d6628791-cc26-4892-93ba-006fc71dd895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871528, "uuid": "075b5536-b3ba-47ec-b328-f0815e0d7b35", "value": "41c58b9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23df10b1-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873440, "uuid": "5f2d1924-2f76-4dcc-97d0-2c1e22ffb5a6", "comment": "Malware payload", "value": "e2979dceb39b3a85a973d9008022d9e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873440, "uuid": "4a14ab9d-4422-4b87-9c4d-1be763776367", "comment": "Malware payload", "value": "00330b0498f4a4ca5cc739c0ef4941b22174aca54b7cc38393b37653ce56bcca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873440, "uuid": "c137ea19-2569-460f-9c84-50dae2056f5f", "comment": "Malware payload", "value": "da68a6f72736bb59c75afe158d90d8114b1afce1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873440, "uuid": "8b7461aa-cf92-434a-a644-cd6a6cac2122", "comment": "Malware payload", "value": "eaaa8b77d84f5d97e96ab8c3168f637c84d95d785976ee9eda38be5805f2a69433d95415bddbe23110a541b53f18e154", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873440, "uuid": "a4b28f53-b3e1-4031-8d50-8dff76fa997a", "value": "363302F2E703F6FCB54341894BDC1E5B423B4120025D8CA1C55EEED6833932A0F51AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873440, "uuid": "22eb6630-6382-435c-ab69-4c2acdd1d6e4", "value": "1536:DK/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMT:WXKAXh3TCdOi+KSZ4WV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873440, "uuid": "bdc3674f-1d13-4c27-b794-44be4a157995", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873440, "uuid": "5ccbec50-adc5-45bb-9ecf-280afbb1d9ed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873440, "uuid": "39b0e67f-7eb5-4c98-946a-98974f76a3b4", "value": "statistic-2033841911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4703625a-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914301, "uuid": "760ce970-9388-4f65-a41d-eb9503a0bd45", "comment": "Malware payload", "value": "671b5c314b1d78a33d9a4304589a5d45", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914301, "uuid": "b6123381-b8b7-4478-ba84-d1c239f4df91", "comment": "Malware payload", "value": "00384d88131f9d0d823374bc777155b223527a56da2b5c460dd4f91cef01f74c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914301, "uuid": "718012b5-11e1-4454-9571-ff2c9e323e39", "comment": "Malware payload", "value": "5777a0b0f33b5a82b4505b576a8077d9b608be52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914301, "uuid": "20f2f248-63c0-45a2-9605-bb153244ae29", "comment": "Malware payload", "value": "c9a21314953852e2cc78fb548107557aacd3015fe4798c87798fa7b85fbaf3e77cb1e2742531088b44e9222bdcda3f39", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914301, "uuid": "3808bdb6-f0d4-49a4-82aa-819f4bc09220", "value": "5C33F1D332D7E23B80C505F6F92B59D616B78AC9E83090D16D9FCA1213E31766DA170E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914301, "uuid": "9d98d625-9177-45f2-9b2f-e8a1d4c3cca8", "value": "1536:6EnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwnb1:vnBrX5Eg5Enjq3axWIfkNwnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914301, "uuid": "ebd5167a-788f-4b1f-a301-870f5c86df46", "value": 51755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914301, "uuid": "d9d78870-8deb-4528-8d5a-0133f4a95059", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914301, "uuid": "a684c2e8-eca9-4f07-bbba-bcd3227cb02c", "value": "diagram-95024484.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91882775-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874053, "uuid": "0b17bc8a-0f95-4b2a-b3fe-a962eb82819d", "comment": "Malware payload", "value": "594e4fee147738350ca6690a2ea88cfa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874053, "uuid": "21f58dd2-956c-44c2-ae39-2e1eae3bfb81", "comment": "Malware payload", "value": "004f887cfa8446dd1c2a6291607634f814c6098fa22b2ab38a29270ec0e27dec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874053, "uuid": "f55303ad-7eeb-489d-8d4f-b8edcdc448fe", "comment": "Malware payload", "value": "ecbac60b9f9c1baeef7d00f07fddcd2854285e2d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874053, "uuid": "be622b4b-6171-4610-9f5c-9e4eda9706b1", "comment": "Malware payload", "value": "fec3a1e424661254c4971cd7f9f5cbb16d0e388a425ef944cdfa8f14efeab1cf78a2f8d379615b23ad09abe667d60890", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874053, "uuid": "1803e383-2429-4dac-b96f-d4060224e223", "value": "F53312F3D202B6ACB64381494E8C5F47923B817066585EF2821CEFA1D33D7170752EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874053, "uuid": "f28db14c-9fe4-4ad9-acd0-3c7eb8bcc1e1", "value": "1536:B/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBcY:BXKAXh3TCdOi+KSZ4WccY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874053, "uuid": "acf029b0-378d-4a5c-86da-39e0fa67b22a", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874053, "uuid": "d081c05b-ab86-4ab7-943e-b507aca24adc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874053, "uuid": "d6b53b89-93ff-457e-ab5b-8a4fb844ddd8", "value": "statistic-550654882.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861473e2-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870598, "uuid": "115faf8b-efe3-4931-9fba-b6df58f47bf2", "comment": "Malware payload", "value": "a7b19122c1722d457cb180300d6757b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870598, "uuid": "3534bf9b-56bf-41c7-8480-10371396b0e9", "comment": "Malware payload", "value": "0063cb1085a3979ed33c965bc083656b57283d8e5ade0b14ee31d9b6d563e154", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870598, "uuid": "d495c11e-8b53-4dd3-9637-6d89ee216e2b", "comment": "Malware payload", "value": "98192ccd1d83f64a0ebd8ad00c4305c0ac65fafa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870598, "uuid": "8d57cd59-f6a0-4baf-a49b-6d5dfbad20e5", "comment": "Malware payload", "value": "8c16fcf8cf7712039ce466ebe7a8161fe5891e7512e5857fecdf7c54011c0d3237d39f7ddb0a589bb1ce822d89394e5a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870598, "uuid": "731fabba-5717-4d5d-9258-ee47d198d8e9", "value": "9B33029673F9A910C9F1C2B0A4E27588374F3D928E7D5EDE4D8894793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870598, "uuid": "5522b7c7-cc05-4d37-8ba9-663ad4a1dcbe", "value": "768:G5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJog:G/czJJSI7r3Pwh8rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870598, "uuid": "4fe6a2c9-6f64-48c1-8d3e-4ef05478d51e", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870598, "uuid": "fcdb8f0b-85c6-48d6-ac54-556d672ffaea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870598, "uuid": "d036deaf-2529-4f8d-b17b-07385a70c21b", "value": "diagram-201492164.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de17d81c-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914984, "uuid": "f9e5bec4-e0e4-4f58-80ad-e0a3b4de636d", "comment": "Malware payload", "value": "e9647834b8212e33abe1c7f1a4393646", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914984, "uuid": "3e66588c-efca-443e-a8ec-11e1142405a6", "comment": "Malware payload", "value": "0064b3a309482511da42570e7bd8e7fc432f11ee835151a217537d0a06247fa1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914984, "uuid": "3b4571be-7410-46e1-9af4-b5bc5344d937", "comment": "Malware payload", "value": "01c0c63d390c66b4c7e2faae736c46ecb62fe784", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914984, "uuid": "d9cda283-4fe4-4d39-8780-2e35c6e82a79", "comment": "Malware payload", "value": "eb14c6a0628606f6636247eda742fd8a4a51668f788b8a0618ddd8e7875ef0f73eaf7492cb104084df6f1363e98d8c44", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914984, "uuid": "435de532-1093-4a5f-b55f-7ca825920b12", "value": "3333F2E65723F5C2CBFEDE6308452395939BD49D71283C5C552E254240FB568C4E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914984, "uuid": "402f3f24-4749-413f-9217-50935f2e0881", "value": "768:ko4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/pN:oeKCVQbp4LTaI7ZaiNQMIXvpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914984, "uuid": "1bde8b43-ae2d-4245-866a-96842996960d", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914984, "uuid": "70ad1485-0a16-4953-b604-8ff90d237163", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914984, "uuid": "e60747d2-7396-40ac-b061-e7e807b02006", "value": "statistic-1441470699.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbca5fa-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910499, "uuid": "11384bb2-8b42-4369-b463-842de6b834a7", "comment": "Malware payload", "value": "7ddf3f90107379b2083e9ebd1a66361c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910499, "uuid": "30f1ca44-690f-4f09-83e8-9fd8e7bdf8c8", "comment": "Malware payload", "value": "00694c9ffa8ae592d4c72f3312591a32db50c897edc7ce9a98e13b75756586a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910499, "uuid": "d79df87d-217b-4cbf-bcf9-613a58b55a3a", "comment": "Malware payload", "value": "482b59ce53dffa4f95a35ee68f1967618817e87e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910499, "uuid": "b787af90-97de-4dbe-99fb-84681cee97b9", "comment": "Malware payload", "value": "dac985c8bcf48e751f3055c93677fc33d76ab794e2c1820878574a3eb08aa6511fdc8f418da31517e2c1bb562bf35454", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910499, "uuid": "fb3a569c-a045-4bfd-9dcf-acb2af2d3799", "value": "CE3302EFA014BEB7C1DF93005FA65B6116FE7A18D070A254836AC2F5E9C36C3803A4D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910499, "uuid": "acc23654-2c4a-465f-ac98-dc1549526ade", "value": "768:zqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LdK4Ol:mxTuDqsF1Cnc3P57oj2+nC6uxkLdK3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910499, "uuid": "3bc29435-f396-4208-955b-b95ad718f282", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910499, "uuid": "0f0c5ca6-4e0a-4241-87f7-226ee674d909", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910499, "uuid": "7802efd1-51a3-4a22-9644-8d8477de6efc", "value": "catalog-2043858833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2361a4-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915870, "uuid": "9c8b7edc-230c-42f0-b503-7c3f0de3658a", "comment": "Malware payload", "value": "f83d8bb42f40b0bf44ab21f294f61e78", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915870, "uuid": "a2a0d3c6-11d5-42fa-8791-9d784fd40179", "comment": "Malware payload", "value": "00704693286a201ddf700366e921c7a9859fc49afb925a81055c231c3ee38907", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915870, "uuid": "e27ad318-7060-44cf-b913-c808133daadd", "comment": "Malware payload", "value": "f64822ebf17e8868901f41be9354ef1c621ce7b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915870, "uuid": "597a0799-e3a4-44e5-8e67-bd7de3986433", "comment": "Malware payload", "value": "0fd31adbed49594ca026d4f9b8c5b59929323c1e5088b13cace3c1e37d79232a7698575d75ebdd61166b732904aa8b18", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915870, "uuid": "7f666880-b42b-45d8-b4db-7126c9597c64", "value": "6933F1C55B23FAC6CAF9DEA7045623A5936BD98D31243C58193E298381FB158C4D3BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915870, "uuid": "866822dd-88f4-4f28-a3db-bdc8f4199a3d", "value": "768:Eo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SVFK83:IeKCVQbp4LTaI7ZaiNQMIXFU83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915870, "uuid": "af726c9f-bb71-4f85-a9ce-f37906209743", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915870, "uuid": "da39e867-6cd2-4be2-a5d2-2aad7f0f4ca7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915870, "uuid": "9652ceee-3dfc-460d-8248-3972aa7a0d96", "value": "statistic-211329569.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a7a594-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914649, "uuid": "0d04a759-b6a3-43dc-b61b-ca6f4cd25283", "comment": "Malware payload", "value": "c86fa3c4fc8b35d464a2e7ed707f5490", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914649, "uuid": "7becb778-2800-42aa-a089-c53cd29a2165", "comment": "Malware payload", "value": "0071c1dda2f07c2a03e216c29767c4c27486e42cf418401a0508746e96f7135a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914649, "uuid": "5fc08d4c-c624-4119-bb78-b4f961b21e25", "comment": "Malware payload", "value": "d60d859e3038766c981f47da95e79cb24e9b5fe7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914649, "uuid": "3d84472b-e746-4b75-bdc2-875dc991de87", "comment": "Malware payload", "value": "4d1a808bcb8d4a8b2d2b79994485c2989095f602197c5e40890a615dffafe30246a367b9c813300e1b14edce1172c1fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914649, "uuid": "3e437fad-f65e-438e-8b3d-2fbe31085e1f", "value": "253302D2AB13E5D38AFBDAA7085212D4936FDDDC32147C55192A298345FB168C0E37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914649, "uuid": "ca610881-2efe-43a5-8454-cc627db925d4", "value": "768:so4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6F91:AeKCVQbp4LTaI7ZaiNQMIXwFYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914649, "uuid": "e89e5e9c-0c05-4ea7-85bc-811694031704", "value": 51769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914649, "uuid": "7ac29d6d-4521-4f02-a926-d938d52cee4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914649, "uuid": "3a7f6997-3f5f-4f60-8f63-6304de3fde36", "value": "statistic-11782036.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc044beb-b3b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620885828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885828, "uuid": "9ecb8ece-5282-4e09-b395-0eead38bb2e2", "comment": "Malware payload (Dridex)", "value": "25eb9cf829252cbe1393114b32a2a70d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885828, "uuid": "cba94ef5-8e04-4162-8523-c47f76b06378", "comment": "Malware payload (Dridex)", "value": "009d98c89dc62f3632b9ba7e8f89c8063df858deb768ba122a4a201caa100de9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885828, "uuid": "c3b39867-d96a-4698-bbfa-cb05c85951c8", "comment": "Malware payload (Dridex)", "value": "1c0c721ab0faeb4fcb905f7001bf6143aa89f7ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885828, "uuid": "b12c403b-1a48-4f39-a66e-c2824f5541e2", "comment": "Malware payload (Dridex)", "value": "29ec5b308eb4836c7951ff924dd2dfbccadce7084805c70d18d0ddc4679d4b808c7f7dc4ef16bd143479a9a88247f9b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885828, "uuid": "a3b0af1e-0bad-4a67-980f-10b6cd954dd3", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885828, "uuid": "1ac766e3-d2be-41d6-a03f-46814fc3a8a6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885828, "uuid": "bf41910a-32d3-4bd8-b658-03472d806000", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620885828, "uuid": "3cb5cb6d-cbdf-4a34-9646-c29ae6b52070", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620885828, "uuid": "be8320bb-31f5-4e7f-b175-0eb653893b0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885828, "uuid": "75c84479-2f36-4795-bfec-36a6ddbce323", "value": "25eb9cf8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0655c3-b3e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620906610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906610, "uuid": "ea7311f5-3233-488a-b7a8-a62f9e7f55f2", "comment": "Malware payload (RemcosRAT)", "value": "f4c362e54b4733cb80eae925453c1f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906610, "uuid": "c41bc6ad-d4c9-4db4-b332-01508304fe7f", "comment": "Malware payload (RemcosRAT)", "value": "00a5cb1e643856765aa70a60a82b28e101044e9172216e4c7733bd1ae62bdc5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906610, "uuid": "1604d0c7-8cfb-4e9f-8830-bfa241cfe9d6", "comment": "Malware payload (RemcosRAT)", "value": "cdc2a8b068d59f51c4640a778eda3e7cfb541ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906610, "uuid": "992778f3-3b96-4920-8a30-d670655e7850", "comment": "Malware payload (RemcosRAT)", "value": "289c6e43a8365e44854b8f04f429294f8c911170f5460181b2a1c3fa2a5bda1dd34d0e3831658295eafb4ac352535f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906610, "uuid": "25987090-b8a6-4ba9-896a-bfa55a44b533", "value": "B0541258F6A1C552ECB3417021378D452AA9DE1AB2E0170B375C3F2A77B72D2958FB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906610, "uuid": "4e1b2e40-cb10-4d39-8039-b121d2ceb357", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906610, "uuid": "3413c300-5211-4429-ac04-0245c71bd302", "value": "6144:jgORakB72788gT31G1E/m1uwUDT7ElSV1EOnb7BIM:jgI7QwlG2/m1udT7ElSV1EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620906610, "uuid": "4965e30a-81bb-41f3-87c2-6e2b36f4cc15", "value": 287322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620906610, "uuid": "c51373a8-7bb7-48ae-b9ed-2ee1ad0a69d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906610, "uuid": "864bb343-021c-4201-8d6b-8b7c2b1ef658", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e96388-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911325, "uuid": "e0fce7f9-4e92-4031-9080-a68bb82e4ef0", "comment": "Malware payload", "value": "7179f0bba71944f9eee8e7b7c1eb21e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911325, "uuid": "8f46824b-9588-4cab-ba7b-5fbd4a782eff", "comment": "Malware payload", "value": "00a9540b252c13b189c7ee614d35d81f5e25d2864936da2836822826d5ee6095", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911325, "uuid": "54ce8d03-a146-4e40-b8e3-4ea5e18518d0", "comment": "Malware payload", "value": "b44c447fbb706d219eb8ecfeae46522f86e0bcca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911325, "uuid": "6c348650-f482-459f-bd6a-b450da4291ca", "comment": "Malware payload", "value": "5b9b58f7caab530d0c3f537fd063cc15623e330d3f6b3bbc56b8299c2672ef3ba2b66e03ac25adb7fdc946a5ae26ee04", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911325, "uuid": "37e60fa4-e1f8-4874-a8ba-a0733e37bb35", "value": "2533029F5044F9B3C29F96016FB59B6302FDB609E230815CD35AC6F5E9836C1806E8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911325, "uuid": "37278de6-417f-4b26-8f09-c67473cbc3f4", "value": "768:dqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNBL:4xTuDqsF1Cnc3P57oj2+nC6uxkLTNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911325, "uuid": "0a201854-a291-425a-b61a-8b10f8a06801", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911325, "uuid": "9341050e-fc98-43ef-a04e-69457c9581a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911325, "uuid": "49880938-531f-40b5-9510-1ecfcffb0f73", "value": "catalog-737319098.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be959e8-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872111, "uuid": "4a6983d6-3d2e-4d40-81be-7a6bfb6b25a7", "comment": "Malware payload", "value": "44881fa8789445d00c9090dcf932adaf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872111, "uuid": "9fde1c16-aa8d-42b3-a314-ed08626f9402", "comment": "Malware payload", "value": "00c50aa169a433c661a63d986d07183410537728b1072ecaa285044cf725fafe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872111, "uuid": "a78310ef-c0a3-4fdf-817f-5285abf2efad", "comment": "Malware payload", "value": "e4cb6e5e2892aa815528bed9ebe73ac627991ab9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872111, "uuid": "78a8d7a1-9c96-4843-b8ef-93f13ba153d6", "comment": "Malware payload", "value": "d8131720089ab1a14ed66ee881084bdab18ec3fee572c22afde783d279e9989bc2817caf4447d40be28146ff6ab07ca4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872111, "uuid": "095450a5-97b1-452f-8b14-34687a2ee3ef", "value": "5F3312B3D242B2ACB64381494E8C5A57923B817066585EB1C219EFA1D33D7170751EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872111, "uuid": "805d599e-65a1-47c9-8c80-17ce6fbf15b8", "value": "1536:a8/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeB4o:zXKAXh3TCdOi+KSZ4Wc4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872111, "uuid": "9546aad1-9e17-408f-a7f1-841cd5f87336", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872111, "uuid": "122731e8-9260-47ae-9041-9226b4a99851", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872111, "uuid": "a4e7b325-a267-43d0-b058-ef0b13e9a70f", "value": "statistic-1219231906.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a59725-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866729, "uuid": "2ca8f046-62e3-4f34-b970-e2f8ccb34b51", "comment": "Malware payload", "value": "580b89dd64cef2eb1472d6f20844cf77", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866729, "uuid": "314be090-1573-4167-beda-d8828bc98a4a", "comment": "Malware payload", "value": "00d3c00d672a08b17fea51270225e118f9ac8f1c22dc8a896183e9730b119a67", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866729, "uuid": "69defecc-a716-47a5-a4ca-d54aa0197881", "comment": "Malware payload", "value": "a3b01e5cc0b871bc7f798b2d3a2e19958c36baf6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866729, "uuid": "941ad408-d6cf-4dc5-b5ed-b5547760a569", "comment": "Malware payload", "value": "cea040b46a64b9da3cc451cd0138f30b364bfbf3eeec18e7c61e41a65ea2304e06e1f2d8c32eb85686ef1000e7c09fce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866729, "uuid": "fbcbaf5b-54b2-4f62-83c3-8b2998312959", "value": "7333F1859F5BF418CA82B37BBC882FD77EB7022461CDE19456C331DD0296E37261426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866729, "uuid": "84b1e5b2-342a-4d73-96bf-021b5054a83c", "value": "1536:pAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHid:epoAnd9gucKCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866729, "uuid": "ae007f79-c75b-48f1-91a1-4bf5f38185e5", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866729, "uuid": "97101c45-7b48-4aa3-9f4f-e101d3677826", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866729, "uuid": "e5c5efef-c84e-4fab-afd2-d9f1515ca361", "value": "catalog-1062897032.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c60460-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914804, "uuid": "bcc11258-5065-4e03-9243-cf3dbd953125", "comment": "Malware payload", "value": "67e34dd882a2b0e2709b055ec3991cc5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914804, "uuid": "059d87f1-ee71-4577-abe5-0ecd9c384ace", "comment": "Malware payload", "value": "00d926bbbe16cd214d1d527745cd62bd1930d3e11c9942a6d8bf949047663911", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914804, "uuid": "76c33007-14a3-42d8-b0a9-9c9420e175ae", "comment": "Malware payload", "value": "15d8d68148308905cae7620e2b975fc7264d117a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914804, "uuid": "f31122f2-1ff8-4721-bfab-8cde489912dd", "comment": "Malware payload", "value": "6c97146a54903bfe6b959bc5447ba2504572c7da6f7fcc71d34b37f87f6fdb50e68ae40484977506d8c2c8c5296d46f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914804, "uuid": "8fab46b5-44b8-495c-982c-dd8675a562a5", "value": "D63302E66B23F4C2CAFEDE67044523A5939BD49D72283C5C552E254240FB658C0E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914804, "uuid": "a5dd5999-88b2-48fd-8aa6-0ec76ee7efda", "value": "768:Go4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/8l:+eKCVQbp4LTaI7ZaiNQMIXv8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914804, "uuid": "fac43993-cb78-4a1d-9368-d37c7ca71e8b", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914804, "uuid": "84e053b1-8883-4d52-a54d-6176eba0e41e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914804, "uuid": "ba21f716-7a5c-432c-8783-009fbda9598e", "value": "statistic-1295174209.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b50c62b-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914281, "uuid": "03958613-25c7-46a1-b157-bd7a02c0e23b", "comment": "Malware payload", "value": "b30ffaac5d40cc9bd4bf2b1d9c7d190a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914281, "uuid": "7ff3be67-029e-49c0-bdff-2c19223ba03c", "comment": "Malware payload", "value": "00e7bbb74089b554b9c05418d72a6b6e6f55b7170b6f25c0cf27e645a8a3fd2b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914281, "uuid": "7197a555-5bd4-4106-9501-c5ac981936d6", "comment": "Malware payload", "value": "364af4090e2264111ef5ae5f4af628d0f317459f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914281, "uuid": "da8c259f-5134-4394-b60f-483ab895624a", "comment": "Malware payload", "value": "9702ecc75bae0d4bd44c030aed48a2825df5a1d0eeafb4d75759f08e7a7c89ad81484c90c819f07c69c20de1ec8e54ec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914281, "uuid": "7581e744-dcc4-456f-b5a9-60dcc947ce69", "value": "A133F1D233E3D139C0C115F2F5274DD96A978E84E930D8D02D9EDA4023E316AEDA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914281, "uuid": "364e3b99-2495-49d3-b26e-a6dbd1aa9286", "value": "1536:bEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMW:wnBrX5Eg5Enjq3axWIfkNwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914281, "uuid": "bdee76f5-7fef-4cca-8132-0f10789b554c", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914281, "uuid": "2770fb9e-6ab5-4089-9be6-14681fdeab0a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914281, "uuid": "22f3c419-59b1-49e7-b102-60392b33215e", "value": "diagram-922504516.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89afa15-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867650, "uuid": "86d1ae8e-f7e7-427c-8ced-b719fa6afbc2", "comment": "Malware payload", "value": "00d4965b2cd3feb8126c9234093acf5a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867650, "uuid": "0ee33241-f61a-4839-99a3-733c769a33ce", "comment": "Malware payload", "value": "00ea6001643752b2266d967d4d8e7ece0d23d664d1bd2b5b28bece278e97315b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867650, "uuid": "eb158142-2281-4937-8e22-72a0d1c68f59", "comment": "Malware payload", "value": "0eab8710cccd1b339ccb36f1379606669ff69361", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867650, "uuid": "3dcd908d-4d3c-4d6f-a9b7-577f22c76aaf", "comment": "Malware payload", "value": "5185b126005e965a2e14c5b3fa1f48a0028437b54990b30dfa69023e33664076c1184413b7175de88dff4d5689633979", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867650, "uuid": "71e2d87e-16c4-40ef-8a0f-8186ab6eeffe", "value": "A033F1C4EF57E468C7C373AABC842FA77FBB0264148DE1991BC2319C4196E67161826E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867650, "uuid": "59c109ef-f221-44b4-9d5f-280fa0508688", "value": "1536:NAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVRK:qpoAnd9gucKCoGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867650, "uuid": "4482c9eb-a795-497b-9efd-70267f70c0e8", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867650, "uuid": "358baf40-1565-44e3-80fb-ba67bb5cceab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867650, "uuid": "c0027d53-fe61-44f4-9320-485a5c672188", "value": "catalog-1774003859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e584724-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868491, "uuid": "5fc53467-b318-478f-8dc0-aedc52166c90", "comment": "Malware payload", "value": "ff45d5242d5703feae5d19dd6c34e7cf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868491, "uuid": "7af03ad6-4007-41ba-bbd3-98696c868fcc", "comment": "Malware payload", "value": "00f9ede66b19cb10f658a0bdb7f4a3fd61ccc526bdf8d82ae62f5c872642b5fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868491, "uuid": "c0523189-e2ee-42b8-8588-d2af1013b520", "comment": "Malware payload", "value": "69ef604be1af5bc1d05818f5a419aee1e619448d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868491, "uuid": "f1c0dcbd-0f51-464d-b6a6-13a762f1d470", "comment": "Malware payload", "value": "6de7dd3ca04ca78b873789ee7dfc9cb4df2a1e6b24e096afed5169955182ad097328c3f56de4a1391959f3918d6c462b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868491, "uuid": "eeb43ee7-9f00-42aa-bbb1-4ce6b59abb33", "value": "3333F1859F57F818CAD7737BBC482FD77EAB1224648DE0945BC331DC0296D2626242BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868491, "uuid": "0700d83d-bca6-4927-ab9d-444e857b3118", "value": "1536:5AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiIv:OpoAnd9gucKCIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868491, "uuid": "45739dbf-e9d0-443c-839c-fff0693d6bbb", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868491, "uuid": "272179bf-6b6e-4896-ae37-02a12e708164", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868491, "uuid": "71f33df5-f154-4cc7-9afc-809ff1863fa3", "value": "catalog-459041306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db26a2c8-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911973, "uuid": "2c0a9450-cbf2-4ff3-86b0-f79cc41edcbd", "comment": "Malware payload", "value": "d9e583edec791fec4dd3aaa8aca7436d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911973, "uuid": "ea711cd2-2d03-4894-856c-6765048d24d7", "comment": "Malware payload", "value": "0104d5a39e1d617d94b6f1b0405e72288fa5a3889128e0a7db9ce6feab33236f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911973, "uuid": "85b38fdf-f19a-42b8-987c-5cf6be13a8c2", "comment": "Malware payload", "value": "e1dc0c1a99392c5678c33c12f0ff2338346117f7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911973, "uuid": "ea89f3e9-ba40-4a86-9c2f-e2b9b5e9de94", "comment": "Malware payload", "value": "d6f5b48327c88568d92b3353d5af88686bba266f9469d926f93833c89939c60857d8264fb0350338950f347db177bd41", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911973, "uuid": "4d54c0fe-9288-4d67-a65d-4557f39a3e9c", "value": "7333F1D132DBC53A80C245F6F82B59DA66A78BCDE930D0D01D9FDE4112D2165AE9224F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911973, "uuid": "aa0696c3-81f0-4c4a-8105-b5b2187f8a2e", "value": "1536:/EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnJ:MnBrX5Eg5Enjq3axWIfkNwYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911973, "uuid": "35bc1080-37be-489a-b7ba-fe65ff047134", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911973, "uuid": "f45ad07f-9de0-44f6-9bbd-c12d422c513f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911973, "uuid": "9d833c1e-3155-4315-9bd0-f8c2f962d426", "value": "diagram-1226809628.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fd7f8e-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910600, "uuid": "f859d4a3-8542-4c5f-a73a-2ba34169e9df", "comment": "Malware payload", "value": "b7506b267a0f95e209ea175f36c3abdc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910600, "uuid": "77a99d96-be72-4eef-a40b-dc470090173e", "comment": "Malware payload", "value": "010ba7fc1e7761a8adb054eaf1258ac9e15d584cff7936fd01e2f14ddd4f1476", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910600, "uuid": "44fd772a-708c-48c0-af1b-10568e4336b7", "comment": "Malware payload", "value": "b2dafbf6508f5afac8ea2ccd9f0a45d1b1778a01", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910600, "uuid": "65c72a3a-0ca8-4659-8260-b255df22fe20", "comment": "Malware payload", "value": "c6ad98c5d31a6427189c4234b48040f78d5dc28033f350da812f5b687a7846a9b291712f8be95f0ceca5664e227d4e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910600, "uuid": "a76e8d5a-9ad7-4264-92e8-41948a504c42", "value": "B133029F9014EAB7C1AB67001FB997A306FCB919E130D15CD35AC5E9E6836C2817E8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910600, "uuid": "c7309663-c2f9-4e03-a906-5468c86de32b", "value": "768:1qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7vlj+:gxTuDqsF1Cnc3P57oj2+nC6uxkL7vA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910600, "uuid": "2b97b2fb-5318-42c6-a27a-6ce45e64b36f", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910600, "uuid": "71bb93e1-081b-4f0b-8027-9b46b38ab443", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910600, "uuid": "6bc23d2a-641f-4ab0-92dc-ff3f92ce6c91", "value": "catalog-2128875808.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc7133d-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912135, "uuid": "274c9b18-5610-4179-9b36-015b17a85ab7", "comment": "Malware payload", "value": "1699f8b6087bfc6a97135be2d51af0a1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912135, "uuid": "5688153a-244f-4dac-9341-8ce7318cc46e", "comment": "Malware payload", "value": "0125650fe19c7909f5f7469afb8f7d3c2d54179a601746e4678b2f0d4783d533", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912135, "uuid": "aa6b5878-b8ed-4426-9161-5dd1a65c250a", "comment": "Malware payload", "value": "cac9478dfa7d29d45da5550f24afa6722f2c0158", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912135, "uuid": "15cf96be-de0b-4ba3-85b9-50cccb7ac190", "comment": "Malware payload", "value": "1af1e84f3e8f4604c2d9188bea67990b353c037dd7b6586bc6db1c391fb74e21b37aeaecdc2028dce986cbceb1a98ff6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912135, "uuid": "fa8d916e-4d6d-40f9-ba92-379e0bc66786", "value": "0C3302D233E3D139C0C505F5F52B49DA69E78E89F530E4C05E8EDA4022E356AADA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912135, "uuid": "bd6a7dd1-a363-4c1c-b174-b843a2407822", "value": "1536:/EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwbciMx+W:MnBrX5Eg5Enjq3axWIfkNwjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912135, "uuid": "2a25cadb-5c79-497e-9bb5-c579a68f79c1", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912135, "uuid": "e7503c35-d42d-4ae3-88a3-011e71c2f062", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912135, "uuid": "564f9ecc-a344-4ae4-9ca2-8d32b84d0915", "value": "diagram-1386152683.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d35c66c-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871925, "uuid": "7f4e4801-d437-49c5-b4af-56af7c52471d", "comment": "Malware payload", "value": "c166c2df353b088f9bef29dc83d8ef89", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871925, "uuid": "ff34b68f-154f-4489-90a1-545a1f243945", "comment": "Malware payload", "value": "01317c522a4601566da8ab38aaec3cab36be53d4f2402a22da21f2d642b10a36", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871925, "uuid": "eaafe9d7-96c6-4dc5-94b9-6421f1a361eb", "comment": "Malware payload", "value": "64e8fbaa61f474ab0dd78d93ae16b5e01e86b74d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871925, "uuid": "8c57ebf6-e20b-4fbf-ad9c-8f65b6cce08a", "comment": "Malware payload", "value": "aee8de667893e491195f7ca983e2c891b00a35cab30cda1452331bd680cfc6a2c52f20fb3c298cbe68a54437fd9fd60b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871925, "uuid": "47e67cdd-4c38-4879-8b43-83ba1a97740a", "value": "5C3302E2C352A2BCB243C04989CC1E979377027026658EE2C56DFED1A33D7160B62B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871925, "uuid": "87df22d7-d6d9-480f-955b-c20abeff40ca", "value": "1536:bEi/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8L5s6V:fXKAXh3TCdOi+KSZ4WpRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871925, "uuid": "f15db8c5-3c32-455d-8d2a-f4ae5beb0759", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871925, "uuid": "90c3e52c-50f7-4c08-b351-f778e7796660", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871925, "uuid": "ebdee615-b20f-4255-bb48-24d6c626d060", "value": "statistic-1056083739.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c479d3f8-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868126, "uuid": "0bda68ce-d7cd-4dc4-bc9c-fd3f8e5661a2", "comment": "Malware payload", "value": "3eb979344f5f9ac64a40c69c4d7aed89", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868126, "uuid": "a706b4e8-2176-44b0-ac47-679d59ddd098", "comment": "Malware payload", "value": "014ac17d44080110e1465befa3736eb45814449643d5db62526cac8de42ddd7e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868126, "uuid": "a5228804-c1a2-477c-8375-d743f134c067", "comment": "Malware payload", "value": "a05c60ca69f5cd152c316ddf4b24a12b63279ada", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868126, "uuid": "d077aa83-a047-4843-97cd-a0947e86c58b", "comment": "Malware payload", "value": "5edd6607b9b57c20f388917968e371a2ef78095042b76f9ad8d7af098a5d42507f50b112184d21111bf6e9795289f998", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868126, "uuid": "9b04daf3-6285-44b1-a746-1d87059ba6f2", "value": "E933F1C9AF57F818CB83737BBC582F977EBB0254649DE1951AC2309C0292D37662036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868126, "uuid": "630794b9-9510-48cb-a397-5b4b9260b366", "value": "1536:UAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEI:HpoAnd9gucKC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868126, "uuid": "423776f1-f836-4997-b2d3-412c8b077a83", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868126, "uuid": "a128edd7-420f-4225-91ab-10040f7360e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868126, "uuid": "e025dd4e-5504-4f38-983f-55e362ad84ba", "value": "catalog-2117167223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfb9f7a-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870395, "uuid": "cf6ff578-e3da-4ae3-9382-5715b510379a", "comment": "Malware payload", "value": "8c9e0b323e97b95c65b8e0a04c6b31b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870395, "uuid": "12640e5d-1b98-4feb-9bfc-12f75a4df19a", "comment": "Malware payload", "value": "014f891946eda579191e6cdf14693e8c3b9acdc0e9b7b2324d3d616efc27dc3b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870395, "uuid": "15bc0259-b422-4450-a6dd-114b9fa271df", "comment": "Malware payload", "value": "68acfbdf6cb69c883f1124e74172d051f6103d7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870395, "uuid": "9a5de410-2036-4504-a735-5b20e24718ec", "comment": "Malware payload", "value": "da52b9063708a11b5cb721976dd5f2a3b59acfb5757f8878f473861eacf3ae5e534abe1cd997f36ea4b79c50c5fec42f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870395, "uuid": "3ede005d-6b9d-42ec-b9e0-0c004e934221", "value": "D333F19137F9A900C6F2C1F060E27699274B3D918EB95DEA0C94A5B93F931A0CBE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870395, "uuid": "3acabcdd-d173-4df8-8ba9-cbb4ec164de3", "value": "768:g5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJ52:g/czJJSI7r3Pwh8RX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870395, "uuid": "592cb09d-8622-4005-970d-f083effbb480", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870395, "uuid": "67dd0a3d-994c-42f1-ae9b-07545ff4b7cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870395, "uuid": "5a13ac4f-803a-4c1c-906f-820c90d9b10a", "value": "diagram-1875023165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3f1d3d-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916972, "uuid": "a5e7facb-b3b2-4c92-8491-39e0802c13a1", "comment": "Malware payload", "value": "b2a530280fb5508bb4392ab865dee4de", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916972, "uuid": "f9cf69ed-ee3c-4727-b82d-8f0bcf8f81a9", "comment": "Malware payload", "value": "015345d26e43ff3366797c3c01aa9cf3c7d17ddfaed3a12a76723cb3648f42d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916972, "uuid": "35401081-775b-46e5-8380-8cc4953a350b", "comment": "Malware payload", "value": "848292b0e10bf81db0f621962f5b90f39566e56c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916972, "uuid": "3f05dcc2-0bee-4be2-9be8-87e4073c810d", "comment": "Malware payload", "value": "a7dee604ae7546964a1676384df770e7d9b9dbb987ea021eab5a3421802391c3a2fc7c764180a8fec2a259485e9d703f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916972, "uuid": "a2174972-69e8-464b-af85-437cacb5b6c7", "value": "FC33F1C55B23F9C5CAF9DEA7045623A5935BD98D31243C5C193E298381FB158C4D3BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916972, "uuid": "ff5be34f-9a01-4563-ac2b-ff915560a00a", "value": "768:Jo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SVFKW9:TeKCVQbp4LTaI7ZaiNQMIXFUW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916972, "uuid": "65361b92-cbd2-4155-89f4-c808d75a0734", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916972, "uuid": "be088870-d47a-4ba1-ac7b-749112692bc9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916972, "uuid": "3a96337d-c848-4129-9fe5-46f27ad4e343", "value": "statistic-926215029.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4762ae3d-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914731, "uuid": "49791211-75cb-4cf1-816a-b2c00e512eec", "comment": "Malware payload", "value": "ea43806059dd87156fbd6a97155b4167", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914731, "uuid": "92e30221-aee5-4a88-9e5b-83dc85fd9853", "comment": "Malware payload", "value": "015aa9221f30f394777b114e1b54fedff292643f360432d2b6f9f31b463c6fc8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914731, "uuid": "ab0fe67e-6ad9-4fe2-b15b-633a56b7d586", "comment": "Malware payload", "value": "52feaa5c4aec899e88dd28141cb24b07094c0c83", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914731, "uuid": "aba93565-f648-45ed-9a24-68489cc897c7", "comment": "Malware payload", "value": "1448cc71272c77892f52b6354aee6920e947b944f28168e75f5d265aa59861f61af22a45699634a943813bf7f5e4eb7b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914731, "uuid": "52b46fda-452b-4ba4-9227-bca7b7dc2050", "value": "BD3302D56A23F5C6C7E9DB97049623A8535FD89C31643C68093E29C341EB164C4EABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914731, "uuid": "a278f610-a956-4db4-9a9e-4f9e1ebe242e", "value": "768:+o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SSRooGyo:meKCVQbp4LTaI7ZaiNQMIXCRFGyli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914731, "uuid": "83511b60-a562-4977-a957-93b6097e342e", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914731, "uuid": "9a44c601-5573-4caa-a411-c8fbff212a58", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914731, "uuid": "bcf6613e-7b92-47d0-afcd-4b26aff4b2c9", "value": "statistic-123666203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ef0c18-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911031, "uuid": "0ef8738d-1bd0-4593-a656-31a84d08cbb6", "comment": "Malware payload", "value": "4c9774e1494f20fbbe08edbdcf70c507", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911031, "uuid": "861284ae-3e1f-4855-adaa-1da8d8aa73d4", "comment": "Malware payload", "value": "015d5975ba14b3542c65243eed73149c4a2ba97b8774c85ae2c7b38e89a2cf41", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911031, "uuid": "15cfeaa9-2cda-475e-aead-add71a0f29a3", "comment": "Malware payload", "value": "dd45ca90b4f37b61ff943f522f9784bf2e27b883", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911031, "uuid": "bcd580e9-ee03-4f07-9e99-9d330ac121e6", "comment": "Malware payload", "value": "fb54119de662602d03bdd8bfcc33a62e1caa1117f59cccb8d7829fed1bfc82a8dae3804faa143d65906ff53f96da2e09", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911031, "uuid": "a4d79645-b5d3-4eb0-ad0f-21db754a9714", "value": "1433029FA404EBA7C1AF93016FB6979205FD764DE130C0689359C2F1EA872D2C17EAD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911031, "uuid": "4bc4f33a-6b35-4e25-b11e-10fe8956e0e4", "value": "768:Doqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYM5ZE:DRxTuDqsF1Cnc3P57oj2+nC6uxkLuHZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911031, "uuid": "9f505860-587c-4583-b9e0-3b92c86ede81", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911031, "uuid": "baee6eb1-bf80-47c9-b595-1f53e0d5297a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911031, "uuid": "e1be8698-c29d-4fb3-88f6-0428298d6472", "value": "catalog-530916175.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a2f4ee-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915611, "uuid": "1b9c901e-0b0d-4afb-8a14-7013f35dfbb9", "comment": "Malware payload", "value": "cfec97f0113b298acececa00d22a8ccf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915611, "uuid": "ae7756ff-32b4-49f3-a50c-c4bd6cf2e1c8", "comment": "Malware payload", "value": "015ddac96262d34377caae31bd3e66cc911abffd61a8b8c6159260d8f6392487", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915611, "uuid": "5f44723b-6df1-4ce4-a855-6586de888109", "comment": "Malware payload", "value": "f2c07ea5293c2d9a48ef3cfd0d95acec5d99ebd2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915611, "uuid": "bdf1e1bf-a72d-404f-a081-6bc172cecb18", "comment": "Malware payload", "value": "a251ae7593d2fed11bd53f95b3aa97862d6906e4337d918b970037772894557e1e0838c2d6b99994afa7fda63708f35a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915611, "uuid": "794c0b48-40c8-4c03-91c5-12bfba7fc9d8", "value": "7D3302D2AB13E8D38AFBEBA7085252D4936FDDDC32143C58192A198345FB164C0E37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915611, "uuid": "36678a8c-d3ad-4993-923e-6c2647bc4857", "value": "768:po4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ScjA6Fux:zeKCVQbp4LTaI7ZaiNQMIX4F3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915611, "uuid": "f5839840-68c5-48a0-8cfa-e96918dfd56f", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915611, "uuid": "315e7dfe-3d05-403a-9ba2-e329bdb43d27", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915611, "uuid": "f3c8ad20-c8ec-464c-be0f-5e06fa67ba7f", "value": "statistic-1932220148.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58fe702-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912768, "uuid": "e75d9290-a013-444f-adc5-ec28e994afcf", "comment": "Malware payload", "value": "09a32520753fa289f2a486b9fb492ecf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912768, "uuid": "3ff1584e-2d5c-4f78-a676-bc4051716228", "comment": "Malware payload", "value": "015fac944961757d11cc25c3d4fb10cb924d2ae7562c326d4c90c64d25fb19e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912768, "uuid": "3076d53a-ffeb-4640-933b-7721e49059af", "comment": "Malware payload", "value": "44daf23931a8b4b8156ae2f05e0d3a9ea1d5b737", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912768, "uuid": "56aa059a-7b39-41ec-bd72-e3163e917dae", "comment": "Malware payload", "value": "bbcdb8f5b50f3aac43ea68ffc096a8ca3874538e8de14f142f00e730c22f61ae4ca356c13ef7dadeeb41d113a11cff92", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912768, "uuid": "4a35c3d7-ab6b-4573-8c45-109c782c7c9e", "value": "DC3302E232E3E17AC4C509F6F43759DD66A78D88F83080C02E8EDA5122D31B96D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912768, "uuid": "9309fa5d-27b2-41d4-91af-05e181a972fb", "value": "1536:YEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHxR3:tnBrX5Eg5Enjq3axWIfkNweRR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912768, "uuid": "f1009f8b-3e49-4f45-97d8-857dfc39cba5", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912768, "uuid": "d11c885e-0d85-4e57-84a1-6f39c70a47e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912768, "uuid": "fd0242ab-101a-4aa3-bf79-1586dc694a89", "value": "diagram-1886808042.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6b4541-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911327, "uuid": "69b13803-2707-46b4-b2de-893aad0bfc62", "comment": "Malware payload", "value": "46b1fff19a5b3dafb587574e50270e8e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911327, "uuid": "3249dd12-2bf4-475f-800f-1a2af19a58b1", "comment": "Malware payload", "value": "018ab0859e3d0ac32c2a18370faf6f0ca9afc1f28feb02e4cf797a7b81081cac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911327, "uuid": "dec00c33-7605-4fb8-8953-a5e96c277cd3", "comment": "Malware payload", "value": "0f065f41bb73b3ea37b38775e3241f4fce3d3827", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911327, "uuid": "b89dffa4-3c63-4010-99d7-45b5cfd1d28b", "comment": "Malware payload", "value": "a0ae517d56500c9bd6d09419c0f6d95fe8c912bbc0424f56580dc3ad53558f181aa5b2da0809045433db4c1069dc3b07", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911327, "uuid": "6c1dbcea-7562-4230-addd-8764ec977277", "value": "2733F1EFA014BEB7C1DF93005FA65B6116FE7A19D070A254836AC6F5E9C36C3803A4D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911327, "uuid": "f7d4d4ce-0d18-4043-853e-4cc4dc46617f", "value": "768:Uqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/Ldg4Os:9xTuDqsF1Cnc3P57oj2+nC6uxkLdg3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911327, "uuid": "5214a036-e8ad-48cb-8e4d-b9e9f0da21ee", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911327, "uuid": "78975529-aa7c-42aa-8f28-57f7fb01edeb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911327, "uuid": "268931bf-f102-43c8-9dda-707ba61568c5", "value": "catalog-740556912.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4eddc8-b38b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869592, "uuid": "3e44e39c-e3dd-422c-9126-eb9ab5b2037f", "comment": "Malware payload", "value": "c1bcb2f6a792144747294449fba433ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869592, "uuid": "7761db2d-61bc-493c-b9ab-2159ab6092c1", "comment": "Malware payload", "value": "0199d6a9c97df2c9784e87e273204d51255cd789c1b301a72e32db0ef2745cab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869592, "uuid": "6730ad2b-4833-4987-9289-272e508d761d", "comment": "Malware payload", "value": "bbd663a3bcf4990c55fe09d2af2b9564279a855e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869592, "uuid": "5b461b1d-f49f-4321-abff-fefda901e656", "comment": "Malware payload", "value": "520ea8368ad745d0107ff5acb7330eda730802b542f1f4be4e7a543decb034334b00bb1ea2176bb54147c7bcfc5addf6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869592, "uuid": "f2f7038a-d9b8-425e-8201-5481c80eb8fd", "value": "A133F19637FDF910C5F281F0A4E271893B4A3D518D694EEA0894A5793F921A0CFE52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869592, "uuid": "d670082d-901b-4b78-a1b9-bc86ba5c74d9", "value": "768:K5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJrJJ41:K/czJJSI7r3Pwh8RnJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869592, "uuid": "67ac3deb-9061-4ec1-a8ac-fa4ccb9cd97a", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869592, "uuid": "40b6f498-cf4d-43fc-8381-fc291de7c5f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869592, "uuid": "f28eaf12-f53a-48c9-80c8-e102840baece", "value": "diagram-1384714636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bdd783-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868688, "uuid": "142e7197-f220-4c7d-8525-6c09ed052a37", "comment": "Malware payload", "value": "293db2eb911ee5adb235e2301cc35eff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868688, "uuid": "8d7e09f7-30da-48aa-bd5f-e28b961950e9", "comment": "Malware payload", "value": "01bffa850e1eca1893721373959be5d3affdd80e52bf0bea44e377cf0f285af7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868688, "uuid": "93480d26-d746-4bf5-b68b-720fbc402b8d", "comment": "Malware payload", "value": "c9f4dd4f4d98b83b24abe7a64dda3e34886007ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868688, "uuid": "70876017-3d86-4116-ac7c-757e42999812", "comment": "Malware payload", "value": "c9a07a9dae872f9205d37abc75c5e01549a451af193d04d1e085b877dcf180f42140ddd408e30a262b9175d7d2f06901", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868688, "uuid": "661ff2d9-168f-479f-892f-c85e23033707", "value": "D433F1C4EF5BF858CA837377BC882FD66EAB025064CEE09597C6309D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868688, "uuid": "d45b1d79-4fdd-42d5-9531-8bcad239590f", "value": "1536:DAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiHb3Q7:kpoAnd9gucKC7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868688, "uuid": "cc0bf2ad-ffd8-4f0a-852f-29046315f7eb", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868688, "uuid": "85e1f5b1-7e1a-43d1-8a5c-3236350b81f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868688, "uuid": "171e5b85-3683-402c-b0cb-22f66cf1ecff", "value": "catalog-597016087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e066d3-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909434, "uuid": "3adacd2d-1890-4edb-90d0-b8eb9c4d33cb", "comment": "Malware payload", "value": "e9ee82c7b74c8c920e0e7b1712330b82", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909434, "uuid": "48b0ad84-65ee-4426-901f-4fc6387ee356", "comment": "Malware payload", "value": "01c0a57b546510947ac888d79ef083ac3282c533dcb6fa2819cba34a0affbdfa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909434, "uuid": "3f161470-ad4d-49c2-ac51-c0347565b61f", "comment": "Malware payload", "value": "eaa8228dd75e826b773c239a11eb5f8489980554", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909434, "uuid": "b03bbfca-911b-473e-aaed-ec6bb7e798d9", "comment": "Malware payload", "value": "db46dba07204f2248d1db230e2da55baa3cfb66b17bf47f929d2bc052b6e3c98d9fb54992db90e57a28d638cd7884f1f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909434, "uuid": "c1a55e79-9221-4a54-988f-c1f4ffee9850", "value": "8F33029FA404FBA7C1AF93016FB5976205FD764DE130C0289359C2F1EA832C2817E9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909434, "uuid": "3d542213-0f89-486a-8e2f-7569ead09583", "value": "768:wqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMET:pxTuDqsF1Cnc3P57oj2+nC6uxkLuaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909434, "uuid": "9f30f6ec-bdca-401f-b908-216dece4e91b", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909434, "uuid": "d18d789e-eabc-4071-946c-89c46b1d53f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909434, "uuid": "fb80442c-1a85-4fcd-8bf8-f2c631eef960", "value": "catalog-1248310691.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf31e17-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915678, "uuid": "a67ec9ec-fd11-4f1c-9ec3-c3206d871e33", "comment": "Malware payload", "value": "820963ed7e630a72f5cdd4e8fd0fa92e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915678, "uuid": "06aedd4b-4400-426e-adbc-b1346d5d9593", "comment": "Malware payload", "value": "01c155e1d2ffe110ee638971aa098d760e6874eec188a1e36e4d2051beaf1746", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915678, "uuid": "8d26ee8c-0bfc-45e7-ba53-953492ba0deb", "comment": "Malware payload", "value": "5524995b3804613a1f4182df2a84dfee98cb8244", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915678, "uuid": "a511eb74-067a-4aa3-a844-eac162614030", "comment": "Malware payload", "value": "1c8ce66b7020a310fab0bd52806f90e79a58c2932795cf8783ddf26f44e13f91838b12c8eb2063e2b18072e6a3519d15", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915678, "uuid": "ce30c349-2388-453c-8376-ad46479fe508", "value": "6533F1C65B23F5C786EDDA97085963D8A76FC99C30143C5D682B688380BB168D0F7BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915678, "uuid": "770476c3-fa12-4806-9242-b24294861c32", "value": "768:No4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S8CIoUuL:XeKCVQbp4LTaI7ZaiNQMIX77Uu0aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915678, "uuid": "c272100b-3156-427e-883f-7a451ee48171", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915678, "uuid": "660813c5-732c-4c63-b733-17a0f2a32803", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915678, "uuid": "5b1093a4-34f0-48d7-b2a2-90fb321ce7e3", "value": "statistic-1985507215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61daa4d0-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912628, "uuid": "8a92d2fd-03a6-4c4a-81cc-b6bae7f9ddf3", "comment": "Malware payload", "value": "b38b67649c6bbc6e9142b968be7c36b8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912628, "uuid": "73061a5b-9735-40d6-8165-de4a5b141b00", "comment": "Malware payload", "value": "01c46340afd51d267863c4fce0dca6eadf57098104f07c0a0688edd9ca9514f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912628, "uuid": "1b493ad6-6455-49c5-867f-9ab646264465", "comment": "Malware payload", "value": "23e25ae151b46ea684d3a836dcdc6bea07ad16a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912628, "uuid": "f14998b0-3db3-44c8-a423-12e8bec19f0b", "comment": "Malware payload", "value": "b3175b589dd4a66ea8e2cb044f97582c4cc640caf6f305285550edd84a509c3a44c5779af95b44dbcb5a1097d523bc5c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912628, "uuid": "453d0e97-197d-415c-b90e-e37d7b406ba4", "value": "2533F1E232D6D23AC0C205F5F42B5ADA65BB8EC9F93094D01D9EDD1113E21669EF124F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912628, "uuid": "dd70601c-fb60-4f67-aeec-120d56140906", "value": "1536:vEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwtVSH:cnBrX5Eg5Enjq3axWIfkNwjSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912628, "uuid": "84ae769a-eb22-421f-9ec6-a336c8c927a4", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912628, "uuid": "557cccc1-2403-4ed1-8df0-a98820b3c1f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912628, "uuid": "6ecaf860-787c-4d26-b6f7-3d34d0b28862", "value": "diagram-1786834687.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96661235-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912716, "uuid": "5d11f5f5-250e-42df-b720-b8dec3af9b70", "comment": "Malware payload", "value": "75ccdc0c3eef8c4dbe156cae7f0ead1f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912716, "uuid": "9a4867c7-a796-41e9-aa9f-5b83fbeb18d9", "comment": "Malware payload", "value": "01cd78b2e36cc7aa2f62a56f85257d1eef2a2008e451d1715f0e0f24f60b0a56", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912716, "uuid": "5ef4d409-6406-4e37-920a-dac65e30b75a", "comment": "Malware payload", "value": "07b05a06c34879d8b14ec89ed9639e269633250c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912716, "uuid": "76564dc3-1784-498b-af56-204c1420ac4b", "comment": "Malware payload", "value": "b531851e0931c451abef610b636094453f024364077a7077cfc2b27b40e9885339f2b735842b5869ce95dd0fbbc542fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912716, "uuid": "518086c5-8ca0-4961-aed5-a63e16736195", "value": "C433F1D233E3D23AC0C505F2F5175EDD65AB4E99F820D4D01D8EDA4022D319AEDA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912716, "uuid": "720b6380-9eb3-49d0-b53a-8cace2e7c267", "value": "1536:nEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMw:EnBrX5Eg5Enjq3axWIfkNwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912716, "uuid": "66b4bcc8-667c-4a19-b3d7-6ef44125d9bc", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912716, "uuid": "31c48d95-c82e-4ba3-9cea-fccc4f5d3adf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912716, "uuid": "bcd3c588-3b82-4b0b-8d01-6a7b81cabeac", "value": "diagram-1839562183.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a413392-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910763, "uuid": "6c13d510-7d79-49d1-b2f1-c610e8fccc5f", "comment": "Malware payload", "value": "f3c594c9b65201f4545519ec7fa336d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910763, "uuid": "4d52cb71-08d5-496e-bbca-4b2682cdc0d9", "comment": "Malware payload", "value": "01e18b83c8e1d03b9991013cd01d24a728e24725af13e14ee98dc7ae31201ece", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910763, "uuid": "ce1b995e-6e36-49b9-9972-b81da02c1cf7", "comment": "Malware payload", "value": "7413012c4f1fc0ab92eac278d54a2c56369b85fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910763, "uuid": "a3ba461f-23b1-46f4-8e6c-3cfe0b009e02", "comment": "Malware payload", "value": "4d1a5d0a6aee1ca0078ce558c997b4217c0d8a5d798d13da757b88adc34af45e1cf1634b651d71156fd9c80861119694", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910763, "uuid": "a90d87ff-9045-4f10-9e8c-edece97a1c0b", "value": "9433019FA048EAA3C19B93015FF2CA9303FD795DD170D658C369C6FAE5836C5C02A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910763, "uuid": "47f7493d-a538-411f-ae5c-b55494a0a55b", "value": "768:3qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0BCu/n7:6xTuDqsF1Cnc3P57oj2+nC6uxkL0BCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910763, "uuid": "f72c923f-d666-4a35-acda-4319ea85d980", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910763, "uuid": "ddf45f5f-ffdf-4a1e-b64b-719bee728708", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910763, "uuid": "e7869931-87a1-46ab-93da-79734d21f6ec", "value": "catalog-318762026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190b6e28-b3b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620888454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620888454, "uuid": "52c5d021-5f2f-4ea3-bcf7-36e53dcb8f0e", "comment": "Malware payload (TrickBot)", "value": "0565d0498becf85051e0d80b65f87a54", "object_relation": "md5", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620888454, "uuid": "2a2e127a-a8ee-43f8-9234-845cf75d17d3", "comment": "Malware payload (TrickBot)", "value": "01fe11c86a69bca1d91f1d6f3aa776bd7871c57973e6f98915f60dd514ddd913", "object_relation": "sha256", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620888454, "uuid": "1f60c816-b776-437c-b116-1564497aa04b", "comment": "Malware payload (TrickBot)", "value": "db53dda3a6954348adb45009c97ade36a1ff3de3", "object_relation": "sha1", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620888454, "uuid": "0f2dc445-85ab-432f-a8a6-f38149363159", "comment": "Malware payload (TrickBot)", "value": "a11083f668ba8e1b8c02d0a655bd1818ed38873a908d97964146675d8b28abce2a49eae63aec2e37d357b78dd3ab42fa", "object_relation": "sha3-384", "Tag": [ { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620888454, "uuid": "2b6a921d-2b0d-4955-8fb6-e47cba7b8248", "value": "6644AC07DD04EB43D529A7FD6A034EBA4B5E2F6994426BEB10721D4F3A352621ECF10D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620888454, "uuid": "ab751d76-bb0e-4fac-bffe-0209cffe6c50", "value": "6144:XOmedxG/54Jtts5VOFTDEhd81Wh07eERPwb1QXjNqA4Hw+:XOm0xG/GJtu5kFTDEgoNb0p4Hw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620888454, "uuid": "69ca147a-9db9-42c3-b5ee-b07aa3b4a6a3", "value": 275810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620888454, "uuid": "9b45bc9a-1ec5-491f-a0b6-ab3fc1120d5f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620888454, "uuid": "a6948642-4f5e-48c4-8b0f-98472385a759", "value": "subscription_1618608166.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6c5fe0-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871929, "uuid": "72d5e00c-f187-4392-bfb2-df7898905397", "comment": "Malware payload", "value": "1d7335246034077e46d63163f993867c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871929, "uuid": "5e2dc4cb-7f58-4d4f-801d-604a6a637f08", "comment": "Malware payload", "value": "01fef6f66330cd7bd3499603510f5798aec8a586eab3e562e320d4ca1f45cf51", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871929, "uuid": "a9f6a954-c81c-414d-be72-ea3a405cf018", "comment": "Malware payload", "value": "7d310ad590428365741e10eefa9ed79d6eef15c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871929, "uuid": "9f93b948-5591-4028-9beb-fc231e97bb79", "comment": "Malware payload", "value": "b8c6bf3ca95a7277b9046c2ce7cab1afab76027d8f844412d86f55c3c03fb6c581a870848a2e27829bb8f2910465e8ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871929, "uuid": "4676dd71-ebfc-4c8e-acc0-97173846f8df", "value": "C13302F2E642B6BCF542C1C54ACC5E1B523F82706A294DB1815CEDD3933D71E0B5169B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871929, "uuid": "ea6bd1c9-82f4-4e58-94e9-66846ee8b48e", "value": "1536:7L/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Weii:XXKAXh3TCdOi+KSZ4Wzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871929, "uuid": "b8774966-a302-4797-9f00-84e68f013466", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871929, "uuid": "a62e7da0-d190-4fdd-b6cb-c3dc1c545eae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871929, "uuid": "66556805-a8d7-41ce-8a7b-321d39514375", "value": "statistic-1059846646.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f856c9d9-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870360, "uuid": "c44ebf45-f112-443a-b02e-e5048074ee25", "comment": "Malware payload", "value": "322ff93072ff8f60386f76aef6b6b413", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870360, "uuid": "c7dbb8a5-c403-4e82-a372-8330184ab267", "comment": "Malware payload", "value": "020781a2792304e8edf04a65b40b5b2564503d5b52f2eb321121f6cef7f2da3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870360, "uuid": "90888f26-9eac-4ec6-adc0-7e0fc5116243", "comment": "Malware payload", "value": "1c02628c402fe7e34ce632208300603761bee875", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870360, "uuid": "6f299e48-0adf-4d8f-a2d6-1e6cb7ae83de", "comment": "Malware payload", "value": "27cba2ebb0b45fc0edd62156af18b9fb5c90887a59b549a9749017c14814fb9357ea1867bed6af4c137f85fdff267217", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870360, "uuid": "284efd68-cdc7-47b7-80ea-7289db0781bc", "value": "7F33F19537FDF910C6F281F0A4E27189374B3D518D694EEA08D4A57A3F921A0CFD52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870360, "uuid": "00eeead7-b166-4c40-9e96-8d348173e1cf", "value": "768:m5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJQJJ46:m/czJJSI7r3Pwh8RiJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870360, "uuid": "0b00acc9-2e05-4e37-8b2f-ba833e6a0304", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870360, "uuid": "2881a6c5-09bf-44de-944d-5a534af06766", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870360, "uuid": "92c6f896-8408-4d0a-b155-c641b1b76780", "value": "diagram-1846488643.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d17f23-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868615, "uuid": "4df8bd9f-9b4d-4a23-96ed-ec9bfcd6bcac", "comment": "Malware payload", "value": "99cced4b57bab581c1f7724dd02f9cc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868615, "uuid": "70ec1c56-db98-41fe-8820-c2f35736d29c", "comment": "Malware payload", "value": "020a25d9aef02ef1cec152a6afd0133c1671e538c11a1a7b9e4c64e7f14a878e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868615, "uuid": "e7b13d9d-a217-4f16-8e47-90e77c22b342", "comment": "Malware payload", "value": "3a08dd1157f968f47c0d1e2a2e88f185e3865076", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868615, "uuid": "51694450-7e0f-450b-ae6e-819d82e3e25d", "comment": "Malware payload", "value": "61266da1a822016597df860f80f749c4549da0b539302fb5b323a339a17047171149b82c631f9135ff34eb4bb01ff3ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868615, "uuid": "9a494d25-cc8b-4f1e-8b33-44eb3d97e219", "value": "B333E1C8EF5BF418C79373BB7C892F976EBB0224658ED19857C3309C1292E62661027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868615, "uuid": "634bd21e-a1bd-4d17-b42b-cce3c3fcdf1a", "value": "1536:lAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrfPs:CpoAnd9gucKCf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868615, "uuid": "280e831c-21cb-4aa1-88ed-9cbdb98dabaf", "value": 51569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868615, "uuid": "de7a1d77-0867-4437-80d9-949a5ff8b7d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868615, "uuid": "8982f61d-4cf7-488d-93f2-d44518723952", "value": "catalog-55500773.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb23d013-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866849, "uuid": "9805cdf9-ad68-4864-bf16-b4d20a2c2e84", "comment": "Malware payload", "value": "21ee057509e7d08536d49cd5ee9a5272", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866849, "uuid": "3f167839-c6fc-4368-bb25-37794e89973d", "comment": "Malware payload", "value": "0210dfdce67f79078428ccea54d911819a66b330265fb66caa12edef1798657f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866849, "uuid": "1c5a91d2-e9b5-48b5-b86d-d9b1d4ef6a56", "comment": "Malware payload", "value": "651d391605820c3e6f6f088e2f953bd4d43bf673", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866849, "uuid": "368ec111-c87f-4b0d-b1e8-8fa8b33b3af2", "comment": "Malware payload", "value": "ed135db1a9f699bc3361a48666116d68195ebb70fa946a0dd5548353381ffc7bfc2162a9ed948d0b263a650bf91ba1c0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866849, "uuid": "0e11508c-dda6-4c8b-a0ec-c814a4983c89", "value": "A933E1C9EF5BF418D793737BBC882F976EAB0224658ED19857C3309C0292E66661027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866849, "uuid": "c78e22b1-ab88-4675-8543-629d54fb6fea", "value": "1536:8AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrJPD:vpoAnd9gucKCfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866849, "uuid": "350262ca-1471-4712-9a8e-53b714d87133", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866849, "uuid": "57354e70-11a0-47ef-ac4b-3cbb9e5e2c13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866849, "uuid": "1e80758e-02c9-43f4-bd92-5f1324a64b6b", "value": "catalog-1137429554.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd586ac-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874341, "uuid": "3db4d7e4-52e2-443d-ab81-1ef73342e835", "comment": "Malware payload", "value": "29b5af083d12f34d81c52434b045c90e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874341, "uuid": "1b1bd299-1a70-4a87-a39f-9ef36a661cef", "comment": "Malware payload", "value": "021474a943235ebf04a6367dfd9aa7f4da7c0ac9d9d99b045d764f6f24a2c4a8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874341, "uuid": "547ade6f-8dde-4c64-8088-e91620115f06", "comment": "Malware payload", "value": "25d45316f51db06bc86a845ef0c8b87ff12478c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874341, "uuid": "be6b9a57-77f7-4ee7-90c5-6e15822e2700", "comment": "Malware payload", "value": "21e31716cc1e6ecd8d1d6b9ff8a37c4b84b3a3c70ad2a2765bbd817c5e3bac8a03d41233b2f6bd7a45976a96bad20191", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874341, "uuid": "a9721734-1067-40cb-a6ac-88f3475922e7", "value": "273302A2D312A2BCB643C04989CC1E979377427066658EF2C56DFED1A33D7120B61B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874341, "uuid": "f5c1665f-6949-403a-833b-bd30d6e6f70c", "value": "1536:9/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8LuA+:VXKAXh3TCdOi+KSZ4WBRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874341, "uuid": "72741eaf-60c3-4c9f-9221-50536753faa5", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874341, "uuid": "cda995e7-9c76-428c-92c9-297ab853a56e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874341, "uuid": "d490e21e-c2f1-4e57-92ea-0b0625b34eba", "value": "statistic-802110008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d081fa48-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912384, "uuid": "bf05999a-0063-4bfa-856c-43223d069c76", "comment": "Malware payload", "value": "9f824bb55aebdde374169bb9bc9dc4b9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912384, "uuid": "a7044f24-407b-42ce-9f56-d720c3f0e786", "comment": "Malware payload", "value": "0223281a34cede3eb442fec58c210d9380798b21e191448ed0b96736fa13c506", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912384, "uuid": "007557cf-db76-4d67-8f4c-4414850da6b8", "comment": "Malware payload", "value": "ca3e103bddfb20680ff8a684fcbef206ca8f785f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912384, "uuid": "80f9072e-79ae-481e-bda5-38f8c6968f43", "comment": "Malware payload", "value": "2ec681410082dcf20be7cf13268723d6e0dab0419110af265cf03a1cd1d7bfdf945140cc6a64d1808674a9b3c6ec87ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912384, "uuid": "2d9cccc2-f7b3-4e35-843b-fbf9a3a3e162", "value": "5A3302E232E3E17AC4C509F6F43799DD56A78D88F93080D02E8EDA5122D31B96D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912384, "uuid": "1054f1e4-9f6b-48e7-9c1a-0ce52b64c6f4", "value": "1536:REnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHFRn:enBrX5Eg5Enjq3axWIfkNwelRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912384, "uuid": "488ba8f1-4e1a-454f-b787-7e52ecb55639", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912384, "uuid": "e0631875-2d59-4ec4-9986-4b91c3ead802", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912384, "uuid": "799b7263-fee6-4d28-b1a4-25845d055b1c", "value": "diagram-1578542252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be2e824-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915222, "uuid": "1cdc2c42-a95d-45a8-bb72-7ea6ee568d95", "comment": "Malware payload", "value": "ab386dce51c43ec3ff16052f19570253", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915222, "uuid": "598581b3-f953-4a7c-8ebf-9b2cc69ec51d", "comment": "Malware payload", "value": "022c3d210c65523a93ba5d2104ff1bf63bfd268c761800e587f9cb134f8d1b29", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915222, "uuid": "bdd799c5-7a34-4f59-8559-2ddc37d468ec", "comment": "Malware payload", "value": "07db0d2ff0851efcac4bfacb2a04c2ce1277868c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915222, "uuid": "6e45f1b6-0dc3-487b-9663-83f91cec0850", "comment": "Malware payload", "value": "2ff2f9ef1b1b96417392c9d772d9f2490c6f08aa804650b2eab0e746848fc2020f44a9bc8e98fbcdfe5e06b0866f4be9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915222, "uuid": "b1dbe820-f768-417e-a7f8-79f65fe23a04", "value": "763302C55613F9828AF9EEA7044663D4A79FD9DC31283C580D2B758281BF198C4E7BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915222, "uuid": "d562a6b1-6e5c-40a3-8720-a48a3be93a07", "value": "768:Mo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Shs276U:geKCVQbp4LTaI7ZaiNQMIX96U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915222, "uuid": "883addc9-1fbc-4c19-b29a-e2e716569b61", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915222, "uuid": "74ac0ecc-3bc5-4c98-9162-2a0457310e87", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915222, "uuid": "3b35cdd2-dba1-4127-b1c8-ec97f526133d", "value": "statistic-1610739641.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd9923-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870131, "uuid": "7affa811-7d2c-44ab-87ea-899e00a62e09", "comment": "Malware payload", "value": "79dfb2d595116294deaf69824f93cd9b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870131, "uuid": "8189504b-99ac-4d6b-b4d3-69c14708dee9", "comment": "Malware payload", "value": "023859e3b59b2e2c626ca82b43ba4f1764d9a501f610685d5afabd95323824d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870131, "uuid": "a7b73960-cb2f-4886-8d95-0bfc514263eb", "comment": "Malware payload", "value": "40dbeba4fa1787f53d09487218148981a8ef2b22", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870131, "uuid": "1f703f48-cc51-4f20-834a-b235733ffd9e", "comment": "Malware payload", "value": "be14a940cc7ff975e3d802b4973648dd2e2fcbd921839b8cd4c479933a0eec3627ede704bbb565204fe5671040af0c64", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870131, "uuid": "df3b16fa-1230-442a-b142-aef3b517cefa", "value": "3133F19537FDF910CAF281F0A4E27189374A3D618D694EEA0CD5A5793F921A0CFD62C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870131, "uuid": "b222a78d-fe56-4a68-ac7a-808a6b25476f", "value": "768:h5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJSJJ4m:h/czJJSI7r3Pwh8RgJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870131, "uuid": "76507054-afa2-4849-b826-09001e5bb4d0", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870131, "uuid": "51a1729a-f09e-406b-a487-1d7b030dc31e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870131, "uuid": "bcd8e1a2-94e5-4b6e-be59-5d93ff8ebea0", "value": "diagram-1680862422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207d348f-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915525, "uuid": "4d048b9b-04ba-45d0-bd34-4d63bad3b380", "comment": "Malware payload", "value": "60905de7b80808e6ed9b8da8bcfb4c58", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915525, "uuid": "c573e0d9-a5b8-4c95-9d64-c08906c493c0", "comment": "Malware payload", "value": "023bd649dc86d341a3d0b3dd32379b3890abda6fc27098644949b7720952cec3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915525, "uuid": "fbbfe289-bbf8-4bfa-838e-88f37738096f", "comment": "Malware payload", "value": "19539d7622891f4e04749f205ead77e8271caffd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915525, "uuid": "ba5a554e-6c7b-4035-bcb3-84e5a9a47b80", "comment": "Malware payload", "value": "b615e46b199a66b3deaffce2b226d14a72e02842500914074b677676e56d098541b99ef3128502055b4d6cf4260ce052", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915525, "uuid": "86c9f269-d5f0-47bb-a6f9-42b2c00b6372", "value": "9633F2C26613F5C68AFADE63044522E9635F988D32283C695D3E759241FB168C4E27CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915525, "uuid": "85827b1c-226a-4da9-bd57-1e897a9373f9", "value": "768:Qo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkPb:0eKCVQbp4LTaI7ZaiNQMIXUPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915525, "uuid": "050f1ffc-e48f-418e-9b58-d0d44f5aefe6", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915525, "uuid": "9fc1544d-95ab-4562-bc52-c3206d8120f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915525, "uuid": "62c38034-7371-48c4-a1d0-112eb114d076", "value": "statistic-1852541993.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b63cd5b-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866983, "uuid": "8f2a3a4b-6949-4b51-8591-4a769242ea20", "comment": "Malware payload", "value": "185f9ebde3663061be9cbeee89564239", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866983, "uuid": "45558305-a997-4d53-b07e-237dced2be48", "comment": "Malware payload", "value": "02519d681c1e7ad314eb36d6f886717ff0247933c291358d41cff2d87253b773", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866983, "uuid": "e80fdd04-9e43-4f79-a2ae-8f34dc2a9872", "comment": "Malware payload", "value": "d43eba4e8b5d7c28e35decb946e2a03a9f88a081", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866983, "uuid": "3afe91b0-2a9f-4ddd-b0e8-70b410c63112", "comment": "Malware payload", "value": "ffee4ccba71b584faefcfc396a30a2c0d90a53aeb17717e5945f3dd4743f3aa25c06a0eb7b90682c276173316441d904", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866983, "uuid": "c1c522b3-30e9-4b4b-85f4-36b4896f8c38", "value": "9E33E1C9EF5BF418C793737B7C882F976EAB022465CED19857C3309C0292E6666102BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866983, "uuid": "0f945a32-2fc2-4e94-8f09-43085292abb6", "value": "1536:qAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrlPo:5poAnd9gucKCfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866983, "uuid": "f5089b23-607d-4798-bfec-8ee2ebcfe8b2", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866983, "uuid": "8a8ab2e5-f935-4644-928b-6cd84aa5f218", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866983, "uuid": "b6757f5b-6eba-482f-a968-2c0dc3496149", "value": "catalog-1224457079.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c696b52-b37e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620864059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864059, "uuid": "306d3e96-86d2-427a-bd8b-044207b2776b", "comment": "Malware payload (Dridex)", "value": "3b05354a52964bdda23c7bca20317845", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864059, "uuid": "44d847d9-74cf-46a8-9930-dfb76335fc6c", "comment": "Malware payload (Dridex)", "value": "02557ce69f0306b7c9d3603ee1c3c27aee5d7806f27d95035188e8db3f019814", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864059, "uuid": "a6435f78-2201-4ece-b915-f8b8c8cc4d20", "comment": "Malware payload (Dridex)", "value": "dd11d15f6955e64936107329dd5a349813b85a2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864059, "uuid": "8b9f5c64-5512-4f10-b6fc-3b99a2acac13", "comment": "Malware payload (Dridex)", "value": "a0f4a396340acbe40971dedc3cb816119553d4e0fa684d6a6f861efe0025c8940566d3438793c73f07ac0b3f09bd5e2b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864059, "uuid": "959d6437-d177-4904-b1f0-52783cc305e2", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864059, "uuid": "863213d5-3e17-457a-9f19-e04e871a1e8d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864059, "uuid": "7f449121-5c62-4528-add2-2f9aad52c3f7", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620864059, "uuid": "71acc48a-b744-4e33-b646-5b326d7ecb58", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620864059, "uuid": "fd04d297-a8c2-44b5-9237-026960362df2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864059, "uuid": "b23c126e-a62c-4a89-b67a-ed1ae2a5f3a2", "value": "3b05354a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ad7de8-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871985, "uuid": "ee512519-48a1-4d61-ae5e-de308e5ec398", "comment": "Malware payload", "value": "7318f507808fa56d3c5d2770b7429402", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871985, "uuid": "bf84cc8f-6d9c-4a4b-a90a-a6bab77fa079", "comment": "Malware payload", "value": "025b04f6cc407a96ddd1d8f7c820deeefc04fab8bc51033984b3e64b4700c262", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871985, "uuid": "b6ad9102-2e91-48d7-8309-6a647322840b", "comment": "Malware payload", "value": "575980c91182dc81acc9c624eb7d1a6136969bc2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871985, "uuid": "c8b766fa-1536-416d-9c7e-6ef78d09997d", "comment": "Malware payload", "value": "02c7357562003ad388a0b600c19746035ccfbd77ef45db03147ae00d73963e69dce537bbf1db20747595f65781c3d632", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871985, "uuid": "3ee1a876-eabb-427f-bee2-4e5db89cc15a", "value": "343302F2E682B67CF542C1854ACC5A1B523F83706A2D4DA2819DFDD3933C71E0B5169B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871985, "uuid": "de1588f0-bbcc-4770-bfca-975a42f7b50b", "value": "1536:53/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wei3:xXKAXh3TCdOi+KSZ4Wz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871985, "uuid": "82d22fe4-6d9b-45fb-8a99-d833e365223e", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871985, "uuid": "fe83d9f1-96a6-420a-8f74-5c2d6ff7cefa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871985, "uuid": "55691646-a91d-462c-8589-a3ff687ba134", "value": "statistic-1118016359.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f603f29-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910906, "uuid": "5dfc9f16-2a80-4815-983d-f974e21d1c6e", "comment": "Malware payload", "value": "019892415946a9058146b6c073be0a02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910906, "uuid": "7baa9a51-a0b8-44ce-aabb-662805236ced", "comment": "Malware payload", "value": "025e5be18dfa4e7c793ddafd2357babad66874feb14b622068f87a71c943ba6d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910906, "uuid": "23bfd1dd-e70f-420c-b12f-17be2fd3a386", "comment": "Malware payload", "value": "3a4eb703abe39174f6419c5cb7aa29b2c4b76c23", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910906, "uuid": "31a95630-7a9e-44a3-b033-537cea591255", "comment": "Malware payload", "value": "169bd7053fba14be6c0bdb36ac0e2142ab76b86e3cde13a47970a5aa6387fba415d67fce8c13c3936cc89c8c969cf9d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910906, "uuid": "69fd856d-ac26-4757-a48f-1e0c2c8c09d2", "value": "1033029F9404FBA3C1AB93016FB5979205FD765DE130C0289359C2F1EA832D3817EAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910906, "uuid": "aea27913-c2b7-488b-af31-57180bab1538", "value": "768:lqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMTj:QxTuDqsF1Cnc3P57oj2+nC6uxkLuJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910906, "uuid": "13755a21-8c7d-4d24-9712-662281937e28", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910906, "uuid": "264d86e7-f976-4db5-a7fd-b701bb9f57a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910906, "uuid": "bfb60f07-5560-48aa-9a97-325e11d974d2", "value": "catalog-428044077.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99f4517-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911487, "uuid": "9466d54f-038c-483a-a769-d074995ac7a9", "comment": "Malware payload", "value": "29b65064716cfc5b8351fb161b7480d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911487, "uuid": "78a322bc-00e2-4d01-9346-d3568d7804eb", "comment": "Malware payload", "value": "025eed70a68382c7af1afd995c18dc4cf1c209a6d3a135756415f2e720ae67c6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911487, "uuid": "ba9e525e-c4ae-466c-b4cf-07774f3baf59", "comment": "Malware payload", "value": "7bdffc103f0043c00f410f55799fb8533a19d719", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911487, "uuid": "9e2bacea-cfff-4583-9d0d-a10b29396def", "comment": "Malware payload", "value": "d934e2b79e9dd8d9f84dcd9b7c36281f44571c2f974d8e78a54bb4f1e801a08d256189c3015cf81dfb375094a5f56010", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911487, "uuid": "96dd2643-565c-4ab4-8746-01d29a12715b", "value": "F033019FA008EAA3C19B93015FB2CA9306FD795DD1709658C369C6FAE5836C1C03A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911487, "uuid": "476187a4-341a-45dc-a5ca-85c84febb68e", "value": "768:Iqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0BCu/Hr:xxTuDqsF1Cnc3P57oj2+nC6uxkL0BCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911487, "uuid": "24f10dc1-5fa7-40fa-a6cf-7333d9b99f34", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911487, "uuid": "ace1521b-b153-42f4-969a-289534076afb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911487, "uuid": "3cbc834a-3f7b-4a29-bf44-d650cab8e24e", "value": "catalog-865813021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463a7b80-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909575, "uuid": "91330f2c-9dfe-4ef7-8b8a-71d34e16f4a3", "comment": "Malware payload", "value": "67de943c693d024972d8543c033baa1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909575, "uuid": "284e6a04-1101-4e17-bbdf-5fe342400a4c", "comment": "Malware payload", "value": "0263192f97279c7a90f6477e50dd48e309d5c885b06ca0b32d05045b6d88281e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909575, "uuid": "bcf1123b-0ef8-496f-8c85-ef5cd7068985", "comment": "Malware payload", "value": "ce6e67a4e0f89a05db99ed24a6f7ec217c2b8fc3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909575, "uuid": "0bcf1ced-c46d-4a32-85a5-ed78db1cf67d", "comment": "Malware payload", "value": "7f4233ec105f5126112562aef77ed8cadc50d9fc5e185ca9d87428ae6abc8cb01fc17921c902eb64962862718555c439", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909575, "uuid": "f7a2f2b6-60e1-4a7d-a2b5-9571131e8ce7", "value": "983302DFE014A9A7C39B53020FA5A6A206FD760CE23092649359C6F9DA835D3C539CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909575, "uuid": "1d3f645f-a0ea-452b-b5ab-45497b238f10", "value": "1536:GxTuDqsF1Cnc3P57oj2+nC6uxkL4yx2C5v:GxTqqsF41j2Pxm45CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909575, "uuid": "8748aa65-ba87-4445-bdef-9020967ff3c7", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909575, "uuid": "2eeb258a-8899-455a-8575-9ad46f95dd65", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909575, "uuid": "734857f3-7d34-4fcd-aae1-bc8fb76ee4c8", "value": "catalog-1335464196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2882c924-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870441, "uuid": "bbcf0a36-0e14-4fdc-a68a-0154acd655a0", "comment": "Malware payload", "value": "5ff41a8401f968d605f0ea9d7e787245", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870441, "uuid": "28dd9523-5ba6-403d-8633-13a3893c575d", "comment": "Malware payload", "value": "02661bdf9f96d4c69083126ce1fe65ec26896f343c4f155b4bc33a859d415b8e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870441, "uuid": "9fcdcf3f-ccc2-4bbe-82ff-0585e6a73a6a", "comment": "Malware payload", "value": "30e959b1b8ea3034e267a1cc9ef6ead908173766", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870441, "uuid": "32eb645b-dda3-4f6c-ad0b-8719adc36e55", "comment": "Malware payload", "value": "3215a2434750efcb3c598cda4502e0626b84fe042db88647dcac5bc714a98689166fea0ac0a5cd4b70c65f9c5781cf8e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870441, "uuid": "918f104e-e73d-4907-9b44-92e0f29f6a4c", "value": "3633029673FAA910C5F1C2B0A4E27588374F3D928E7D6EDE4D8890793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870441, "uuid": "dbb8fb88-585f-45dc-9a68-cd6df2b73100", "value": "768:05G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcQf:0/czJJSI7r3Pwh8fQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870441, "uuid": "dbb06111-9bf2-4e21-8be2-72fa8c10f07c", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870441, "uuid": "6306f658-b388-43d4-b0c8-aff5f6028cc4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870441, "uuid": "7adafeec-5f51-48ca-a723-cc3aed2a9f7b", "value": "diagram-1908174985.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f338ad7d-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868204, "uuid": "e6433974-c7cd-4652-b499-f368a2ca22fc", "comment": "Malware payload", "value": "bea66b4d6cbbf1e6da04fe98a4cc5bc1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868204, "uuid": "b7bb1009-0f4c-4052-ad61-51e596b7d2a4", "comment": "Malware payload", "value": "02752a602584971e96a7bb86ced0e710b5946bc2eafa5508f093e9009a118514", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868204, "uuid": "16c9de44-c6ad-4a22-947c-2f2c79f9b598", "comment": "Malware payload", "value": "261c337a0f342fe36791e25fd19640c6501ee320", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868204, "uuid": "d90b6fb2-520f-4d07-8caa-de3302998821", "comment": "Malware payload", "value": "c0a5cf428268062714bc9db5427541eaa7fa8ebc4307d069f9bea88caceef1e5a2ac20e6bf06378cdaf9ef9a9bab1fc7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868204, "uuid": "1309e78c-83d9-4296-91a3-c91da9371c87", "value": "6433F1C4EF1BF858CA837377BC482FD66EAB126424CEE09597C6309D0296E36631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868204, "uuid": "bfcf9aa2-8b04-4506-b126-b06120c48392", "value": "1536:PAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3bD:IpoAnd9gucKCQa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868204, "uuid": "c3bec3d0-5641-475b-9fb7-eebf32a76ed0", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868204, "uuid": "0e5b94ed-e3d5-424a-a6ff-e7f8622e15b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868204, "uuid": "8f8f435a-5b1a-4956-bb08-8f62c8b7ded0", "value": "catalog-230559435.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe07363-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874507, "uuid": "1472cc92-278c-48a5-9a82-360691a1902d", "comment": "Malware payload", "value": "51e7947c0a42cf9b149926498ffe4c8f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874507, "uuid": "8e19f648-edc7-4eb5-8670-b1cad36a5c4c", "comment": "Malware payload", "value": "02767d70c4425a80ca7ad93f861bad9bb426b355864e06e4b6e9de918f063d4a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874507, "uuid": "b60aeba5-45e6-4530-81ef-a09226673c53", "comment": "Malware payload", "value": "3d4612bdb90e4aae68ddbdd807914c987915de20", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874507, "uuid": "b60cece8-3567-47ba-a179-5dc2c571fd6a", "comment": "Malware payload", "value": "8b58d9bf11ea4465997f3c42a38a8496d4c131a5d77a285023129471304ab008e484c8721a9ea0eb3e3a6778f806375f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874507, "uuid": "27a1b269-6814-4f62-a048-5c0f2ebcd76d", "value": "DB3302F1D603B6ACB903518D4EDC5E2B523742709A598DB1C58DEFC2D23971A0F90AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874507, "uuid": "8fde1744-79f7-4f09-8d0e-da238e767bd7", "value": "1536:R/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedML:RXKAXh3TCdOi+KSZ4WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874507, "uuid": "8660ac16-86c6-4c7e-a37d-6cf772e3fc5a", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874507, "uuid": "4ceb17b6-7b1f-4172-8c80-f841e5c84666", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874507, "uuid": "2c15c40e-0c74-4744-b85e-6d9be3ad18e5", "value": "statistic-926426203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0715319a-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911187, "uuid": "9cd146c5-f7af-4c91-83d7-70f3556c62e7", "comment": "Malware payload", "value": "86a9d52ca74d16e4c9682c4a5c8074b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911187, "uuid": "06de875f-813b-403c-b086-53f2e214538c", "comment": "Malware payload", "value": "02809d4570bd5b953a5ee0af51de2a96b5941be080bb1d539d6566d21fca0f48", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911187, "uuid": "cd27033f-ffab-4d8b-a6d2-c5ff55a5850f", "comment": "Malware payload", "value": "e34f05cdc67a4697703b0ffe3516e28fb077dca9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911187, "uuid": "4cc72070-4d2d-4230-9364-61c4b97d9774", "comment": "Malware payload", "value": "93c19b3f5fec8af33197928682134cc7100a9572f32d0ebd26fe257d042221cb41bc54250057cb9c3f188d6c387c7345", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911187, "uuid": "59765197-ea17-44bc-9e9d-a5d6d776c94b", "value": "C73302DF9410FAB7C19B67015FB997A302FD7919E130E158C35AC5E5E5832C2817E8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911187, "uuid": "5c4cd35c-2360-4fee-a53a-793b3c1b0613", "value": "768:tqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7XL3:IxTuDqsF1Cnc3P57oj2+nC6uxkL773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911187, "uuid": "660ecb80-6783-4fb7-a4ed-2244bd24ce04", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911187, "uuid": "8b5412be-3891-4d27-8459-16ae9ad950f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911187, "uuid": "d41962b8-7aa0-45b3-afa5-0d32dd503488", "value": "catalog-660727439.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa85465-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872010, "uuid": "bab60011-7d34-4c63-8004-2b5314db567f", "comment": "Malware payload", "value": "5b739eba11b3dcc1aa4d9da26925146b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872010, "uuid": "792c677c-b0ab-46af-b4be-f97a5b67a087", "comment": "Malware payload", "value": "02882434bd5b34f544fef70e98aa4605f748325bed04984a2156b3fea9bf0141", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872010, "uuid": "7d0d4456-2a45-4afa-8543-9a9f1cbb328e", "comment": "Malware payload", "value": "9989f383c7ab8e7c9c54a60b33b580d11efa8b7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872010, "uuid": "6541d753-e2aa-41d6-b3b8-c79de10a55a5", "comment": "Malware payload", "value": "0d65dd431b8425a9e1d0bb523f32f9387e228043a911809bb69c3bcf72b2cc62154f8bc542dd5247a6d65f6b9688330f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872010, "uuid": "5f26f4fb-0cd8-40cd-95e7-42bf0554be12", "value": "B53302F7EA41B6BCB543C0C94ACC6E6A127B8170556C8D71C12DEED6633D30A0B61A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872010, "uuid": "b90522d3-4719-4d80-be0f-57beecb2d58d", "value": "1536:zE/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeUuJ3:gXKAXh3TCdOi+KSZ4W/q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872010, "uuid": "4627c507-f0fc-433b-9c71-92e21ce68796", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872010, "uuid": "36ef02fc-d68f-4f7c-9e08-af000842ce49", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872010, "uuid": "04f49924-00d9-4455-a1cc-0bd5beb32f8a", "value": "statistic-1143452512.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b7481c-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910963, "uuid": "7e9d9554-ffc0-4eb9-845e-162bce2323ee", "comment": "Malware payload", "value": "849b3b49bcfdffdca6cdc32ed47d0607", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910963, "uuid": "03b5f977-ad21-4fc2-8232-8f61861a7ae8", "comment": "Malware payload", "value": "0295a9032d185596b6dddedb2c1e8d133bcc9a04a2673413e1c3374e6f5dda61", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910963, "uuid": "727b3d76-f1b2-4055-af62-3e3e4fb8d18e", "comment": "Malware payload", "value": "e685edb74cac51842c68f3da6c1ab531967e3ea6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910963, "uuid": "cd546f90-d4a5-4d52-82f7-4fbe6c7a897f", "comment": "Malware payload", "value": "b287b87e0b069594e9bacb2d5196e4f24d8f983c4604392116ec6df396e720dbb3b16b5b1809e909b6ab5e78b7b7d913", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910963, "uuid": "92d1f655-697d-4cae-8672-fbe2fcdd1d85", "value": "BA3301EFA014BEB7C1DF93005FA65B6116FE7A19D070A158836AC6F5E9836C3803A4D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910963, "uuid": "27f987d1-5db9-4822-96e5-7b2fa11c82bb", "value": "768:hqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LdL4OA:cxTuDqsF1Cnc3P57oj2+nC6uxkLdL3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910963, "uuid": "63715c17-7c7e-4558-8a32-a80119a5a90b", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910963, "uuid": "f967b9a3-164f-434d-9b1e-a46013dbc905", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910963, "uuid": "69b466e8-4342-401c-8062-b2a6353eedc8", "value": "catalog-496734822.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e91392-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867851, "uuid": "6a96440e-91d7-4686-9aa7-537f2ae87d28", "comment": "Malware payload", "value": "cd23b1e5a124c512109d46ee9c225fcd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867851, "uuid": "eab4cdb0-2cf3-4511-8011-aef5016640c6", "comment": "Malware payload", "value": "029640a2a58b11f6b7d1216a5df48fd5e455f1716df910650dd0133d28c3247f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867851, "uuid": "3c4ff51a-4587-4887-b12e-d9f9aafcd2e2", "comment": "Malware payload", "value": "6cb62311f3acdde8ae990500b2803495d64425ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867851, "uuid": "81664f83-cd05-44ef-8d5e-9c20b501eb5d", "comment": "Malware payload", "value": "37131ffc384bfa27ab9d996fbeb5dc8c835eb37561e3025324bba1388e75794a1b840406754bc542b12ebe4d3a04ff52", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867851, "uuid": "4249eb65-ddd2-4f27-a4ad-727548fcf314", "value": "1633E1C9EF5BF418C793B3BB7C892F576EBB0224658ED59857C3309C0292E62661027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867851, "uuid": "978ed1fd-8b3e-4b5f-8ede-5ddecc849f45", "value": "1536:SAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YroPi:hpoAnd9gucKCf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867851, "uuid": "39f33715-46d4-42b3-809f-3775e4d8c71f", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867851, "uuid": "26ee15fd-1292-4787-8ee2-01cd0383958a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867851, "uuid": "39c3a394-be9c-4b43-99dc-f476404c45a9", "value": "catalog-1923474058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cbc1c0-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913687, "uuid": "8e2531f8-77b6-4229-9c1d-bcd48d636eff", "comment": "Malware payload", "value": "839f0116e7ad5037156aba75e6415c37", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913687, "uuid": "1d6db42c-f743-4ac5-ae74-ed34a7e86c33", "comment": "Malware payload", "value": "02965c05a81ce67520c00e450e4807b3743b578dae30a07d9d42edee997e4999", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913687, "uuid": "5ffac733-abc7-43fe-bcd8-7039750afe90", "comment": "Malware payload", "value": "5c1d57b3aa69c1bccb5137233574b8afe40213cb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913687, "uuid": "2c039f2b-dd01-47f9-8178-9410b554665c", "comment": "Malware payload", "value": "5a9a8b2bcde9b793c19b0f4c4f7ab0a7bcfdb3df5e62c59055d624ccf3a34471f40f254fde8ad85d4c769bbf0d295e63", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913687, "uuid": "39fdf7af-d664-4fdb-b50f-66548f12de22", "value": "2833F1D132E6C23AC0C105F5F92769DAA6678ECCE530D0D06D8FDE0123E3165AE9260F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913687, "uuid": "829e0990-7d3f-4cbc-af10-f7e6125992f6", "value": "1536:gEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwsn94:FnBrX5Eg5Enjq3axWIfkNws94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913687, "uuid": "ad9b7af3-9eb6-47df-945f-1fe10812a2a3", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913687, "uuid": "c56ac210-79ae-47fc-9b7f-82e9f2b5140f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913687, "uuid": "7acac2b3-c1f8-45ea-9478-138b9eeb32cd", "value": "diagram-483952974.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ac44e5-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916050, "uuid": "c1500e83-f581-4803-985c-c25154d21679", "comment": "Malware payload", "value": "3e6d6422aead1ed75de41ac0aebbbd85", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916050, "uuid": "93a0945c-e15b-4a8c-b185-36039d99121b", "comment": "Malware payload", "value": "02a1251ad5c4b84a7cc30af668312f9172143891e9de3982ea023130039f0d93", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916050, "uuid": "0bd69ad8-43fc-4db9-8a44-d5c4690c1350", "comment": "Malware payload", "value": "c6e2bf237c24483db6c8d936da184f8411796429", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916050, "uuid": "cdfa1f29-e845-40d2-b082-802c0c6a8b91", "comment": "Malware payload", "value": "48a8eac1b419252e4732638e05f1bb4e2f60d54ef24968a6591d38e6e94523d974fc2a09e30571e2267f1e0bec0f4935", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916050, "uuid": "af0de45e-3a7a-46ad-b00e-45d4349a4491", "value": "AF3302C55B13F9C6CAF9DE67045623E5936BD98D31243C98193E298380FB568C4D3BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916050, "uuid": "c17a21dd-6ab8-4df0-89cd-141ec13d8d8e", "value": "768:/o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SVFKPi:FeKCVQbp4LTaI7ZaiNQMIXFUPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916050, "uuid": "eab6cfd6-b923-499d-b254-aeef384f2e6e", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916050, "uuid": "498aa780-50ac-4f24-a9fd-84cc27300a45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916050, "uuid": "0c6778b5-1746-410f-aa90-4f93a47fed64", "value": "statistic-324111544.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1db81b3-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872900, "uuid": "4dda495d-92bc-4221-84cb-71678f11ff03", "comment": "Malware payload", "value": "1a9f7404e408af5cda09ee12f5fa2c58", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872900, "uuid": "68cf6872-138c-471b-88ec-2ac5488d429e", "comment": "Malware payload", "value": "02a785d3630260e9571436c75862fb28a17148ab2cbc631e67572ecbed32e665", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872900, "uuid": "038d5829-fba6-4c11-b3f0-d24a6bee4168", "comment": "Malware payload", "value": "a86a4e8a01e8386b5eb03c718a6ab7d608564282", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872900, "uuid": "9d33b56c-bbd1-4835-905b-5eb7b2406034", "comment": "Malware payload", "value": "c1f43f14422123cfdea2eda1e0ffbdbb106c99a297e58ec8558bed44c1ecfd39dca7529553fb9e89ac3014902f27f573", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872900, "uuid": "c8593042-2d26-4b55-bbea-612db1489165", "value": "8B3312B3D202B1ACB64381495E8C5E47923B817066595EB1C219EFA1E33D7170B51EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872900, "uuid": "5027d6f2-cdff-40f3-870e-803fb3183630", "value": "1536:R/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBXm:RXKAXh3TCdOi+KSZ4WcXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872900, "uuid": "7ea3d1f3-7b03-4d3b-902a-3deca911d21f", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872900, "uuid": "28137b51-5332-41c9-9048-04f6a5ecd847", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872900, "uuid": "de6dee82-bc74-4fcb-97bf-b13095bddd60", "value": "statistic-178548075.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c96e69f-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620911304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911304, "uuid": "6fd0d74a-16e1-44fc-9940-9fd792040172", "comment": "Malware payload (Dridex)", "value": "3a4a7694fa24cb4eb186e828d499a86f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911304, "uuid": "7ce72998-a381-404f-ba3c-f67d8d4520d4", "comment": "Malware payload (Dridex)", "value": "02b50eba8d243e3e6e177b38b6ea450651cf2007c1f4346b64e823d52d7e87c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911304, "uuid": "a5a87a71-19bc-40ca-922c-ec7bfb27a795", "comment": "Malware payload (Dridex)", "value": "0b405d574ec364696a16a74e0d4383a3a4b2b11f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911304, "uuid": "c8decf1f-ed16-4ceb-b89f-904621e97c62", "comment": "Malware payload (Dridex)", "value": "b18193a1af3aea7a966b832ddc35057b326685ddec18519a76ad8a2dc07cbe516d387ff7d68ce50f362650dab6af2450", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911304, "uuid": "81d04b57-3970-4785-b57f-b4fcb5d421f4", "value": "73F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911304, "uuid": "d0370c19-97e0-4cee-842b-800248fa7039", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911304, "uuid": "9963d5b8-2149-40fc-9081-7e8b6149dbe6", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911304, "uuid": "779d9518-7ee1-471f-9174-6760f0f5abdb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911304, "uuid": "a15bba11-229d-4025-85f3-1c70bfdfb934", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911304, "uuid": "63d027bd-bd7e-4678-a38a-2eae90638242", "value": "3a4a7694_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d278ca11-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916253, "uuid": "b4406fc4-5a78-4857-ba5e-a7efec7f0243", "comment": "Malware payload", "value": "c6871a20b412c496cf9c6ac8200b235d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916253, "uuid": "0d43674e-b7ea-4cff-a730-6eed1cf06ec1", "comment": "Malware payload", "value": "02d0eba0e8cf7807a9634d9a256dcade91e21a02a9b66a264afd34af5413a488", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916253, "uuid": "aa912fdf-7053-4ddf-b337-1c89f273676b", "comment": "Malware payload", "value": "3e3a60208fc88019e843b9b4dffdf6307e6b6cc8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916253, "uuid": "7fa4ec13-7caf-4480-b3af-6d8ab988d1fb", "comment": "Malware payload", "value": "42afd871b59953c312298f8dc76a0e458e28fc577bd2c84c6da04d2e2fdd1aeb74300e0aa5b4c355b1c8eca4663b0796", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916253, "uuid": "c91d1f32-4c8f-4ed6-93d9-f277efcc8cb7", "value": "1D33F2E66B23F5C2CAFEDE63044623A5939BD49D71283C5C552F254240FB568C4E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916253, "uuid": "9e2f18e2-b485-423e-853e-af033264ac0f", "value": "768:Xo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/4A:teKCVQbp4LTaI7ZaiNQMIXv4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916253, "uuid": "386991f3-e757-4ce7-9c46-d63ea456634e", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916253, "uuid": "a4fe72be-91a3-4fa7-9619-7c5b950c880a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916253, "uuid": "0866d2b9-2499-43f2-ab45-f0922c12832a", "value": "statistic-493375657.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9926dd-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915976, "uuid": "c1f13144-2983-4427-9883-0d54902cf794", "comment": "Malware payload", "value": "903d74c9615cc9ca97fc435657bcf312", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915976, "uuid": "6df483e1-8bc7-4395-ab7a-7fa24e27622d", "comment": "Malware payload", "value": "02df9552217e3d13d87f3f29f07aa78096b961e55556c3101f6a9e5989247c85", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915976, "uuid": "aa22a3d8-dce8-4a97-8099-8669447ccd99", "comment": "Malware payload", "value": "051d1532f0b6f199ec2971c8a8acbbc972a9c5c7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915976, "uuid": "0947eefe-b335-43be-ad35-0c7327c96c4a", "comment": "Malware payload", "value": "9d52952d5fd0c9a61a92ef3696300de67176c108b88a3b7c980e4acc8944fbca7c5527636b314357347045f9629ef17b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915976, "uuid": "ce316e5c-a18d-4dac-bbe9-7d4121bb7ca9", "value": "883302D69B23E9C28AFADB670C5522E4936FD89C31143C59092A699384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915976, "uuid": "2e8dbad9-0dd1-401c-86af-9fcacb37b32e", "value": "768:go4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6FzY:keKCVQbp4LTaI7ZaiNQMIXwFEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915976, "uuid": "c25e4d4c-edac-4445-94df-773d78c47881", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915976, "uuid": "90df0f82-3911-46dc-bbb8-7c2400784c98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915976, "uuid": "7dd47fc4-0f51-482c-b82d-52033a7803be", "value": "statistic-262433444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c267702c-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910643, "uuid": "b1096a98-d01f-4c59-b63f-91e0d32003a2", "comment": "Malware payload", "value": "504a2ee8ff1ad1ffe170b01ced12bc1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910643, "uuid": "b3f18a33-6c17-4617-8bf7-756271db1498", "comment": "Malware payload", "value": "02f1bb09eff0e5fce078db68f72a22a17f7f8941b25f7c940ab06ee69db67bb9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910643, "uuid": "41e12559-e859-40d9-8b6f-e7c165797ea4", "comment": "Malware payload", "value": "0544fe35e42e981da08e40d79b9730f68140f58f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910643, "uuid": "ae60942d-d55f-416a-8cb3-af5da225b9f5", "comment": "Malware payload", "value": "1b516d92e31cc26bd8764df0159349e21bc34c7055edc1e945d36a6ececcf86fea6d6e141f5b46125d32d3c3b15ba3c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910643, "uuid": "5038764b-c5eb-4034-981a-b5a72fbfde4f", "value": "4B3301DFD009EAB7C38B53014FA5AB6202FD754CF130A6689355C2FAD6832C2C5799E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910643, "uuid": "da167639-c1da-48c4-aca8-4ef8d037f16b", "value": "1536:3xTuDqsF1Cnc3P57oj2+nC6uxkLlyx2ig:3xTqqsF41j2Pxml5ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910643, "uuid": "9b0890b2-ac5a-4fbd-a530-48a3f1154617", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910643, "uuid": "eef2684d-488d-4ae7-a951-bfe9f718dc80", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910643, "uuid": "54295726-9955-4877-a4ec-6e3836696b78", "value": "catalog-239708874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61156533-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871825, "uuid": "c8991f42-9c13-4b8f-90dc-02098a41d04b", "comment": "Malware payload", "value": "311ae5e82ff8e4f77b704bd5377dffe0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871825, "uuid": "5f4f613f-7314-4d46-8bed-ff535af97629", "comment": "Malware payload", "value": "02f6d804e7089e7c841ca8d1c7b05b38304c4ae16d6011d4a45f75de218b54ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871825, "uuid": "95c68a71-e093-47de-aa9c-f0f018749571", "comment": "Malware payload", "value": "cc63e275e4a8a6324fe420ec3f4a086df1b8941d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871825, "uuid": "de7814e6-ff37-44bf-9824-cdf35b4bfd6f", "comment": "Malware payload", "value": "bae6eaab334fde44fdc2b2cb009386ac875e935892cb748843543318fade9fcfcaaa3a3011007f2f15be6b6829b38fc3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871825, "uuid": "cffae6fa-43a7-42b0-ad79-587f6193b0a9", "value": "6C33029673FAA910C5F1C2B0A4E27188374F3D918E7D6DEE4D88A4793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871825, "uuid": "17600674-ae09-4983-b287-f6672ec8038d", "value": "768:h5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoo:h/czJJSI7r3Pwh8ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871825, "uuid": "7a39896b-69eb-4ad0-966a-e8182c5a8b08", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871825, "uuid": "862c3ce3-b8a7-4db0-8c97-ff70631482b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871825, "uuid": "a301a802-7507-4928-8c34-5d25c5f45077", "value": "diagram-976628852.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bdfa6a-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871477, "uuid": "0c78e4e0-bddc-4324-b893-9f931991445f", "comment": "Malware payload", "value": "68520d427ba93b597a7f77e8a242a2a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871477, "uuid": "c67d6470-236c-495d-9e2c-1d82149611f3", "comment": "Malware payload", "value": "02faa0c9487e8eb1f59e3561f3825a878db0aa965601b6953c0e34810011572f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871477, "uuid": "fb096c0c-89c0-4366-b47e-d8d7e854a737", "comment": "Malware payload", "value": "2334c1caed53ae3d7ff905ba5ef1947d98608ee2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871477, "uuid": "e85b4532-9e9a-4edf-8026-b5cdc3521274", "comment": "Malware payload", "value": "5f87dd142c44987d335e8df572009b40ede52334856b1cd81ffec4e1a6d5b904e49057bd7fdc0dae7718e201193ed57f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871477, "uuid": "d6c5465a-36f7-4c5a-b9f3-6f819ff955b7", "value": "EF33F19473F9D510DAB2C2F05092B6892B4B3C918D7D99FA4C98A4A93F531A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871477, "uuid": "7e282398-e635-4afb-b5a4-fb51af1c9c0a", "value": "768:05G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8X:0/czJJSI7r3Pwh8tv8x8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871477, "uuid": "e72d51ea-9775-4f66-89b4-32fad32be6e6", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871477, "uuid": "5e42056d-e5bd-4242-81a0-95ee6a71758e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871477, "uuid": "1dd1cec8-b397-4a9a-8331-21fe64fe97f0", "value": "diagram-698263614.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23555a60-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870862, "uuid": "bcca707a-9472-4671-948d-ca7eac63e3f1", "comment": "Malware payload", "value": "dcc96e160cf1d783454c8e392e4f130e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870862, "uuid": "f8a08f36-81a5-4f36-8a7c-9cf1d920d266", "comment": "Malware payload", "value": "030adce0afb181e2cfc4a1503a04dbc78334aa6485542a7e2bc646d2da1556a5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870862, "uuid": "d7ceb2c3-ed03-4e9e-be8e-90fa1d775684", "comment": "Malware payload", "value": "43543ece156b21a6c38abb8143fb945cdd4f1ef6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870862, "uuid": "0070be31-ee6b-41ac-b1f3-ad180c37bbbd", "comment": "Malware payload", "value": "769f6a0e8c3d53eefbf68889aa55d11d3ee0ce98e531321dc42c6b95d6c32e41c46df212c63f7f235ea5729d4466a1b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870862, "uuid": "687bace9-cc19-42f8-86d8-e226baa2c5b7", "value": "3C33029673FAA900C9F1C2B0A4E27588374F3D928E7D5DDE4D88A0793B921A4CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870862, "uuid": "c4fb0362-b48c-4beb-bbe8-f7887edf10c8", "value": "768:B5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwZ:B/czJJSI7r3Pwh8TZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870862, "uuid": "1bc01a5a-97ae-4296-a3bc-73655164f0f3", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870862, "uuid": "d039a868-57d1-4a92-b5b1-f90ec64a3968", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870862, "uuid": "1acf8126-6342-4521-82dc-3f67778c6dcb", "value": "diagram-266595233.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbd8992-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914015, "uuid": "a764eb63-630a-4b7a-a517-05048a3d8866", "comment": "Malware payload", "value": "d08adecb3b9c40e7300cd34d9849c1cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914015, "uuid": "f8991292-70c2-468d-b7da-611eeea78570", "comment": "Malware payload", "value": "0313470dea46ebfb22b24f685be2909a0494d211685fbdcc8fabe6fac8762171", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914015, "uuid": "3f3849c3-6e6b-4bdb-9590-95275047308b", "comment": "Malware payload", "value": "7583c143abba27ce7f1fca8e53ef94949ca5c19f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914015, "uuid": "8943a0ed-72e7-47c0-ac21-dda6ecdd7934", "comment": "Malware payload", "value": "fadb997ded8fc402fdc9b597a0ed042ca705d8c7fc95066e1b7a5d8fe2fd6bccda3f596156cb69724a5d9d26faf85251", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914015, "uuid": "05ec0e3c-14c1-42cb-91be-c353a2ca75eb", "value": "133302E232D7E23F80C645F7F51B9ADA16B78A98E83090C12E9ECD5113E31656DA134F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914015, "uuid": "36102c3c-da7f-4845-b59e-20fbe30fee4f", "value": "1536:VEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnU:KnBrX5Eg5Enjq3axWIfkNwnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914015, "uuid": "7c4d6e99-0748-4a0f-bffa-d9b34ea5c7bd", "value": 51756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914015, "uuid": "5b3d9350-b21f-4a35-91ec-c7a464a5a205", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914015, "uuid": "a02e7f2e-baf5-4a35-88f1-2a6da78bb6a0", "value": "diagram-727471590.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff095c9b-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912033, "uuid": "e8083140-e428-46cf-a029-bc8fa6532c36", "comment": "Malware payload", "value": "7d4678155e14d19fb322bfe93897d421", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912033, "uuid": "58d8c839-e120-488c-ad69-d3059506bc4b", "comment": "Malware payload", "value": "03165442e9a2147d57268152cc499572a4b779aff6355da97e427016919c9145", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912033, "uuid": "3d54b909-1fcf-45b1-a736-76f479dd1870", "comment": "Malware payload", "value": "e9e23c46c55b3bac39e5dd7809f4260447ad0cf1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912033, "uuid": "2e718646-167c-4920-b063-c71005f01eb1", "comment": "Malware payload", "value": "35860500b2668b89ab822db2892d037ef68223ce226b7f1f2568694ee9467aa1eb926a4412c2b1b042f8987c63ef3f6f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912033, "uuid": "2019682f-34bc-4ca0-95c3-073939345c5d", "value": "BE33F2D233E3D13AC4C604F1E4271EDD69978ED8F820D4D02D9EEA4022E31A5AEA174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912033, "uuid": "6f79ecd9-3268-4e69-a485-ad27fe323c47", "value": "1536:CEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMJX:HnBrX5Eg5Enjq3axWIfkNwIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912033, "uuid": "e74ed4e3-1036-4278-a75b-d8bd633212ea", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912033, "uuid": "3990d308-48e1-4bfe-913a-39d93ad03bd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912033, "uuid": "a6fdd97d-e297-40f2-9d9f-4b719c0ea37d", "value": "diagram-127093106.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311a168a-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914694, "uuid": "ef66a535-c4f4-4383-b959-010f608bc06d", "comment": "Malware payload", "value": "232c3cee8c15be6d4a18a784e620b510", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914694, "uuid": "87a2ec2d-aac9-46a5-bce4-f2b401d45c94", "comment": "Malware payload", "value": "031e180de08a21d560a99c8f8780fa2ac5b7098ad68792db085a45a7afb2f3b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914694, "uuid": "23c46b74-03e4-4a93-81a0-55305c6d2699", "comment": "Malware payload", "value": "54ca2c618166d07246fe232face05ca0379aac6a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914694, "uuid": "c707e637-bb26-41e2-94e4-787914a5f9bc", "comment": "Malware payload", "value": "49fa7844dd24b4dd0ad5313dd6b124baccfb3a8e7e3e23a065c6d437eb25c514f4321a938f3a00559bf6b401695f3030", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914694, "uuid": "964e7f44-917e-46e6-94aa-3819369f9127", "value": "1A3302D69B23E9C28AFADB670C5512E4936FDC9C31143C59092A699384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914694, "uuid": "86991d60-1fd4-43fc-999a-2398167a4567", "value": "768:ro4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6Fms:heKCVQbp4LTaI7ZaiNQMIXAF7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914694, "uuid": "d681a080-ad5f-4630-a96a-1782d8eb94e0", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914694, "uuid": "4ce83bf2-2a7c-4008-b8e7-42aed48db83d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914694, "uuid": "386814b7-6431-45c1-8e67-68eed152344d", "value": "statistic-120796195.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d76ade-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916844, "uuid": "4edec9da-6f08-4f6e-9704-2cdc67ccdcf7", "comment": "Malware payload", "value": "bafc5feafa060bf08138a860f9432e39", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916844, "uuid": "dd223d5f-459c-4b5b-838c-c27be709d234", "comment": "Malware payload", "value": "03305392ae9dcaa3b031a368061b778e2a314b71c038100c57d42c4985b2276a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916844, "uuid": "0b359ff4-ae51-4fca-abbb-de94f6e25467", "comment": "Malware payload", "value": "1075e8e3be5500e73cc532fd6a8202ec4b5d2781", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916844, "uuid": "8ac1f148-3b01-4d94-9f3b-65544637c36e", "comment": "Malware payload", "value": "a762e615120de55ec7400aaf5711e32f54259a7be38a210be62c0463d0ec0c8c122c612f5806d4946b2d22b3f0b6a2c5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916844, "uuid": "5ce311de-9d61-40b7-bf54-ece4780712d0", "value": "0D3302D69B23E9C28AFADBA70C5513D4936FD89C31143C59092A299384FF158C0E7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916844, "uuid": "9c929576-946b-4899-b7a2-5d036efb5a19", "value": "768:Ho4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6FjP:9eKCVQbp4LTaI7ZaiNQMIXwFUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916844, "uuid": "6f6de489-a22b-4333-b79b-2e017cab65d8", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916844, "uuid": "d797ebfd-214c-4f09-b211-59eaec7c25be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916844, "uuid": "35b8cc7d-df8f-4fe7-85ea-ed8b9526403e", "value": "statistic-834839497.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5fc0c9-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913129, "uuid": "66e0a413-d2e8-4b72-86d4-bdac08871a44", "comment": "Malware payload", "value": "7469b65494e346341e071411e614d8dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913129, "uuid": "9c4dcdca-bc74-4428-8a5c-3d465acf9768", "comment": "Malware payload", "value": "0339c76f4cc5fd6c1afbb9bebf4ee9f1a95d88950277a0cb96f8c03f2b7889e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913129, "uuid": "d10b627e-cc81-4a51-b5f4-18b3f9efa31c", "comment": "Malware payload", "value": "48079e782d50788fbc99a7359406532beca0323b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913129, "uuid": "61c25311-e7f3-453e-a3b0-9ed745d32e98", "comment": "Malware payload", "value": "bd587c062d4d06ff80fac85d0f8582795eb1fd2a6e3184afb4c6d76473d8c19a1cd6c0b4d6dc4fd3e4f3e0f45bc4bac9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913129, "uuid": "d0286648-87d0-4c2c-9801-b54297afc79c", "value": "2633F1D232E7823AC0C505F1F52B6AC666A78ECCF130A0C05E5FCE4112E2166ADE274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913129, "uuid": "ae647b99-2f33-4256-b02f-220b72513c5e", "value": "1536:iEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRN:nnBrX5Eg5Enjq3axWIfkNwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913129, "uuid": "29b5bdd1-150e-4158-9228-3ab3b292863e", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913129, "uuid": "b9590397-4782-481c-acfc-8cf88db124de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913129, "uuid": "d58ba80c-a1b7-4c43-bea9-e41588c13380", "value": "diagram-2028805685.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bde0c1b-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871064, "uuid": "90d98970-dc6f-4a5b-8544-c17632ad1b74", "comment": "Malware payload", "value": "834070bf3029eaa28dd89f0876a3db0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871064, "uuid": "2dd6df56-19ad-4605-99cc-1b8486c8b211", "comment": "Malware payload", "value": "034f26c7a0757bda313f6b7ac474064f789e827dba254f84c2a51c3ce23f15ce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871064, "uuid": "ab1a5e82-b8ff-40c1-b2e5-e5a0d2f95ffc", "comment": "Malware payload", "value": "3fe7fb926c5b6a683a8e78f99ea312a69de0f3f3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871064, "uuid": "c2049fcc-170e-4150-82cb-eee0fe38ed25", "comment": "Malware payload", "value": "af739e3cc2c478c25c8aeaf83782b1197fd4666f324bd775313b6b524910ba15c34ac017aa0cd5bddb7c3a1091502250", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871064, "uuid": "436a5889-d12c-4841-ac85-9141039ab8bb", "value": "DA33F19537FDF910C6F281F0A4E275893B4B3D518D694EEA08D4A5793F921A0CFD62C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871064, "uuid": "eb23edce-c808-44df-9c5b-dfe904f90483", "value": "768:o5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJbJJ4J:o/czJJSI7r3Pwh8RnJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871064, "uuid": "86b356c2-b4ff-427d-bf93-63ea854a2639", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871064, "uuid": "4db2d8c7-29a4-4eaa-8d0f-a77236659777", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871064, "uuid": "123e6a64-5f71-4f5d-a74b-fc4b2ca9ddde", "value": "diagram-419038578.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2a8bbb-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873075, "uuid": "cfa967c7-cbfe-45cb-8377-4aad5307a9ee", "comment": "Malware payload", "value": "0f55b6a28847c116f7485b685088fe38", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873075, "uuid": "7797004f-146e-47cf-b958-1fa900d980ba", "comment": "Malware payload", "value": "03633a4f58a3a9b38f1a4765853b1cc708a9a1de7778de06c10f4dabb79ac243", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873075, "uuid": "f38e8097-0a89-41f1-a9f8-ceefc06d53ed", "comment": "Malware payload", "value": "1d20b7bc0659a247384f7060793a3edcd98ae274", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873075, "uuid": "2dbaf96d-020a-4322-9719-8e173c6731dc", "comment": "Malware payload", "value": "482abde57d4482344ff1e52f4e9bf863a9ea66e6f09dd016a69dd537850391c06528cb06f78d71b28b4a7d706d515fac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873075, "uuid": "9180d9f0-0c25-4c59-adf2-5031535e4fd1", "value": "1B3302E3E653B2BCB203D4C985CC4A5B123F4220156D8DB1C11EEED6A33D31E0B91AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873075, "uuid": "62cbaea3-d265-4c10-9345-fae33e7290e0", "value": "1536:2G/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wetd:xXKAXh3TCdOi+KSZ4Wod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873075, "uuid": "7ace7ab9-63cc-4d82-bd74-c8fa97562d9d", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873075, "uuid": "b3d9e368-5315-43aa-957b-fc596861dd7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873075, "uuid": "924f12ce-4747-4881-9f92-a2adfaef4145", "value": "statistic-1886522950.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36026f46-b3a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620882490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882490, "uuid": "3ca7bb27-e33a-4945-a243-81b77c686099", "comment": "Malware payload (Dridex)", "value": "cba320cd7bd847d2bb12e691e8519182", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882490, "uuid": "3c2744ee-2a14-4cf8-a6c1-76ac66d37e24", "comment": "Malware payload (Dridex)", "value": "03666e853a37f6ffe04fbecd018e9f6af21f75b40dd44cd3d3428de4e89fdc40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882490, "uuid": "8d8e2528-a3e7-4e32-86d9-ca761c9bab71", "comment": "Malware payload (Dridex)", "value": "f2ea030fbc8991678f02527aa8e07cbba86d8d44", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882490, "uuid": "501e0238-64a1-4ce2-9942-0c8f6a95d1d1", "comment": "Malware payload (Dridex)", "value": "9c9a50110ade1de80060b571f5a0a508be685fcb01c8618d0e466e4d7b5d1dab7c9246cadb00b6b7534caffa65e2c8c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882490, "uuid": "fb037b04-78be-4f5a-8931-6061d833b802", "value": "C3F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE2576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882490, "uuid": "9d8bb367-f752-45c8-b814-c7733da432e4", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882490, "uuid": "c661a586-f874-405c-8f27-364672cd25fc", "value": "3072:2ar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:ws4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620882490, "uuid": "23d6f0fe-5edf-446d-a2e5-60af5ba10336", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620882490, "uuid": "8225e32c-ef8a-436a-b694-c9921923edf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882490, "uuid": "e4deb67a-2f12-4f98-bf9e-34bf1db0f341", "value": "cba320cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e90c5b-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871772, "uuid": "cd38c6f7-1508-4982-a84f-ab95b10ac300", "comment": "Malware payload (Dridex)", "value": "d16fad3e4e12dc82c9e12b0d99d5d2e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871772, "uuid": "7d8e8146-365f-448b-88c4-2136a9ce47b6", "comment": "Malware payload (Dridex)", "value": "036a3d71cfdc4eab7df1fecd192a33d02f54c430bdb0e4e27f35b5fd67b83576", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871772, "uuid": "8895c770-0cbb-4f41-82dc-440b0c9336e9", "comment": "Malware payload (Dridex)", "value": "c562dd412ac8fa8de7d40415c607fb37e28fc5a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871772, "uuid": "54d60d67-6a3f-4cd6-a08d-4a5df98b825c", "comment": "Malware payload (Dridex)", "value": "fb1eb77574800ef1566f9e8d100f14075b7f1bb4ab444d070736f5ac0ba8107d6c31f1e14aae64bf583140b26d464cee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871772, "uuid": "c1195f36-0651-478a-bc3e-b33fa1580b17", "value": "DDF3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871772, "uuid": "9d59312a-f9ea-4f21-bd27-955ccfbc9f61", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871772, "uuid": "5b9f55f8-e719-4a57-8404-a6b8cfac5197", "value": "3072:sar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Os4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871772, "uuid": "8ee36871-3788-4212-950f-e52fff56d312", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871772, "uuid": "c5086a70-5a92-4693-86fb-f207b16eaebb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871772, "uuid": "2e95f2c8-bb65-4d01-b6ab-a8ebddbba5be", "value": "d16fad3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7318b96f-b43f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620947017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947017, "uuid": "05cb54fb-1e46-4f63-b8fe-8a075cb7ab2d", "comment": "Malware payload", "value": "743240b7cb38efce7a09b848c2746998", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947017, "uuid": "60b63df2-371a-461c-bcfd-7ee5ba1d0276", "comment": "Malware payload", "value": "036b4b2f35022a83d25e00a40f70161e01e78c6305ec4a34624f0681e673997e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947017, "uuid": "1b5630fa-f2bf-4a0d-9a01-c75ad5a1c858", "comment": "Malware payload", "value": "817d880c213987f86db810cacb64f3efb284c08b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947017, "uuid": "0f5b4e2a-6a97-42f9-a5c4-64b1dc5d2425", "comment": "Malware payload", "value": "6f23ac45b2d03ff46277434cd534ff353411e938a823d6b2fac1662889217a379050cc83fd597b5c101ce4d7f5508064", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947017, "uuid": "6e8a4a9d-2a5a-4f70-9cc8-6a9365254e82", "value": "B2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947017, "uuid": "3684d0ed-c3cc-4933-8a99-bf7d3245396c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947017, "uuid": "7e18d0df-cc37-41f0-92c1-124172b9ef7d", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620947017, "uuid": "3ec51c19-9385-493e-a4ad-856bc8419961", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620947017, "uuid": "b3ab2195-0b08-4b99-8c62-2ffc4cb55cf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947017, "uuid": "f33c37eb-2b27-4bb9-b00c-f8845648b70b", "value": "743240b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbc97d6-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872005, "uuid": "55ff93e0-e7b8-4a81-ab2a-dec035b52876", "comment": "Malware payload", "value": "62b324bbc6eaf3a544d31acb4b6d0612", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872005, "uuid": "d0d4cff0-d3ec-4a03-b176-2bba16f274fc", "comment": "Malware payload", "value": "036c45ed3adcc66b66c4f0bb5328e8c532651386b1acf423dd41ac5434a5d097", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872005, "uuid": "78343ee2-8f85-45b3-8bc8-907936abb5cf", "comment": "Malware payload", "value": "08c0eeb3d4701d4b8273be2e056125c3b8ec46bf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872005, "uuid": "09a51764-bc48-4b12-adbc-f15d9b90016e", "comment": "Malware payload", "value": "3f4a376446926e372a4ebcd20b6a659df7bf24bb9a40fa89e05bd3b4d92e355413082fdf6c1433d687157974ac666e56", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872005, "uuid": "aacff297-2b80-4b42-9934-b4f5b7582666", "value": "1E3302A3C352A2BCB643C049C9CC1E979377427026658EA2C56DFED1A33D7160B61BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872005, "uuid": "5ad4ded0-d411-42d5-9247-426a502868b9", "value": "1536:mv/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8LCpm:UXKAXh3TCdOi+KSZ4WpR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872005, "uuid": "97f69bb8-d233-4af1-8d81-c000cbef715b", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872005, "uuid": "2d779c41-3a5d-46cd-b824-a1fddbbfda60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872005, "uuid": "6952844e-5788-4885-a204-24b6358ac6d1", "value": "statistic-1142941065.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0740c677-b3fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620918489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918489, "uuid": "d5aa81f6-dde5-4d28-a3dc-550dbb4829b5", "comment": "Malware payload (Dridex)", "value": "cbccbde866d55445f3c2aee9062ae011", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918489, "uuid": "a11ac368-1e2b-4503-b611-2c0a25e95ef8", "comment": "Malware payload (Dridex)", "value": "036fd2cd7279fb0857d5eb6b8293efeae97a85758bc03ed6cc30e6736736a741", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918489, "uuid": "84f0cf28-9e47-4343-804f-38b19124bfd4", "comment": "Malware payload (Dridex)", "value": "4ff431af5ae1ad591714dc9b53a513666821d951", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918489, "uuid": "f2b3752f-f307-47c9-8153-60ca9cc9130f", "comment": "Malware payload (Dridex)", "value": "3d8485228c88b7785738f6dd9af1eb091d8b9721e99138ddd78442d05bb98873bda61ebf019f52c5fcabb5205f45009d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918489, "uuid": "5769fe40-043e-44d7-b849-cbc7fb9418e0", "value": "61F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918489, "uuid": "85753f00-97d0-4500-87dc-6fb0e98d6bce", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918489, "uuid": "30c05644-0ae5-492f-960d-42d75dbb063f", "value": "3072:fWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:f42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620918489, "uuid": "f725ba9d-f175-484e-a6f3-a3d4b99445e5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620918489, "uuid": "57d77dc5-5ce2-49c9-a959-3549dce8971f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918489, "uuid": "751f9b83-9bb4-497c-b89a-bd94a9b574cf", "value": "cbccbde8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af9c99a-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871734, "uuid": "dad0bf68-771f-427c-91e0-5c6b0184abb0", "comment": "Malware payload (Dridex)", "value": "dd9d35c43f6c9db4bc0a60d1236ef296", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871734, "uuid": "9a1de9b7-0dc1-43b0-b7cd-8466be0214ac", "comment": "Malware payload (Dridex)", "value": "03735f3b2b4102cbc199936e339c5c6fbc7f1ce3f23c2c88defc739d9499dc47", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871734, "uuid": "1b65cc11-4ee2-46cd-8b82-765b35aabb1e", "comment": "Malware payload (Dridex)", "value": "8946b6d308f4a1b152ad6eb457d078cc8ce205d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871734, "uuid": "f1200d0f-7208-4979-884a-dc12cceb571c", "comment": "Malware payload (Dridex)", "value": "485ea217b5e5c97e4ce85620f945caaa44016df779729e5f9982ea5e66a986ee7b87ba4437b4411ef1394d2bab31f342", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871734, "uuid": "58a4dc1c-ef49-4156-a4d0-4d16deea6e40", "value": "98F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576A08879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871734, "uuid": "9e2e227d-fc79-4f23-b97a-5f72a10031a4", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871734, "uuid": "e5df5d3a-22d9-451d-86a9-bcc2c080ea6d", "value": "3072:Mar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:us4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871734, "uuid": "bf8ef028-974b-49db-8def-dfd8570aefd3", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871734, "uuid": "0b196de8-2cd0-4451-81a4-b78c9f137abb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871734, "uuid": "e44ef598-bfa1-46d1-99a6-a9f5ecc99c3e", "value": "dd9d35c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3cee19-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909077, "uuid": "b610a674-3a82-4597-a82c-0486a9135cdb", "comment": "Malware payload", "value": "5c4575e42a1888e99cf405b363844eb7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909077, "uuid": "5bfecaee-f613-46b2-81fc-c97e6265ae35", "comment": "Malware payload", "value": "037fa49e873dbfbd02999df216317be7fd6851f8a6d20ed40535235c5275653e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909077, "uuid": "9f0d4ae3-23ca-44f9-af1d-c900b79159fc", "comment": "Malware payload", "value": "4975ac4c6c8eda93cab67c2a980f139256608db1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909077, "uuid": "f39355b0-4223-420a-9a29-4b3527667031", "comment": "Malware payload", "value": "000caa95f814e72d24c6d18397ab866c2193ed763cc6f8cf34eefcb7b166d8a392788354ad461d1d439b80cb60d15d1f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909077, "uuid": "a85cdeed-a7b6-4622-85c7-4de4fb58991a", "value": "743301CFE015AA63C29F97015FA997B306FCBA5DE07081588359C6F9EA835C2C43E5D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909077, "uuid": "394f9b6d-7314-4b99-8883-06f91130ae98", "value": "768:uqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0CxfBx:fxTuDqsF1Cnc3P57oj2+nC6uxkLlff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909077, "uuid": "ebcc92b3-db68-4534-be83-507b44636433", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909077, "uuid": "a73e670b-3444-442e-ab2d-fbf50de2654e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909077, "uuid": "a45c9207-f91d-4612-8e51-73f1281d114a", "value": "catalog-1105348050.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203a5970-b38b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869568, "uuid": "bc51fbbf-f7b5-4857-bd6e-fa53003fdd98", "comment": "Malware payload", "value": "783ece0a673a6b40eeb22c6769f64488", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869568, "uuid": "3be77913-30ba-4fbb-aec9-d167139d2f0a", "comment": "Malware payload", "value": "03842a20125fb063f580c23cc7e72fa78b94b7f6a0483479c9838a649394ded8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869568, "uuid": "6dd2c313-c12a-4054-91ce-4f9b993d1003", "comment": "Malware payload", "value": "e553524b02157802a86102ca7b0645ddd2d0a11b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869568, "uuid": "763ee10e-2e1a-4e8e-b72c-7ccdb1dd834d", "comment": "Malware payload", "value": "fa079b010a48b8212dc2ad4933e602d3bd1e4a3b8be2d151001b42e29f17d7616d4dacf4e95b88bf1c5f8dee19a904d8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869568, "uuid": "3dd0acb3-9ac4-47fa-844e-09a217e22f84", "value": "A333F19133FDE510C9B2C2F1A0E27689375B3C618DBD99EA09D865653FC21B4CED62C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869568, "uuid": "53629ec6-5e6b-4080-9137-a75d993b4fe9", "value": "768:35G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ4tbHD:3/czJJSI7r3Pwh81tbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869568, "uuid": "60406492-2e1a-4aa4-9a05-35301737d985", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869568, "uuid": "0c44eec9-50b0-484b-be87-1ef3895144c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869568, "uuid": "d0b3aec8-6363-43ae-ab42-ce583dca7666", "value": "diagram-137306488.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b525fa-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869275, "uuid": "f3aa492a-e2ff-4a62-b883-4fff679ac39d", "comment": "Malware payload", "value": "f9e275107e3a264863cec338e640f0f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869275, "uuid": "9aa1048d-71a7-43a5-899c-51e1317d2b3c", "comment": "Malware payload", "value": "038649b6ac78c7c607cd6c5d365cc33862d6a8307878727718ab82dbcdd120a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869275, "uuid": "e4b97a02-d274-4449-8957-6c2e9173751a", "comment": "Malware payload", "value": "c8a96d2e81bbbedc4fecb53aae1ea9695ccd3c11", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869275, "uuid": "0717aa4c-0b5e-438f-b63e-b9f07481888c", "comment": "Malware payload", "value": "bfe0a52c80ab15c747c2d9c5ebbab98130b960b2305ca45c278365071862cfb9832dd6091f65f68a7bfbc45e86c23d5a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869275, "uuid": "48db5dc7-7578-4922-9157-5d1a9865ac21", "value": "1033F19433FEE910E6B2C2B090D275863B4A3D91493D9DEA0DD4A5B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869275, "uuid": "2e82632b-254a-433c-b762-e783cb543dcb", "value": "768:35G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccj5b:3/czJJSI7r3Pwh8+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869275, "uuid": "756f0e82-30ea-42ba-9650-a145ab980783", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869275, "uuid": "570bf6f7-fdc7-4fd2-8fb7-d553ed7e04c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869275, "uuid": "522d3c23-96f9-4dff-b8e1-7aeff2b8ba8a", "value": "diagram-1103059340.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c18101-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867729, "uuid": "63f2e1a2-e79d-4a1e-8ae8-8218bcf73771", "comment": "Malware payload", "value": "454861b707cad4dff20b5c021419b861", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867729, "uuid": "7f01a13f-3eb1-4884-897a-965766c7d4e6", "comment": "Malware payload", "value": "03880019fb9edcdf6f1da6e672ac2f91481aa9978edf2bd1e1f34d0f1b5150ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867729, "uuid": "c0646467-c1b4-4319-82d3-2bc70eb445bb", "comment": "Malware payload", "value": "61d83d37a87f6f73772aebeb0f862f4a13c07710", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867729, "uuid": "bb26fd58-6805-42a7-afe3-eb34d45120cb", "comment": "Malware payload", "value": "e17dab3b03aa42b1589eaaaf5a77ee1989fbdfd5148c3dfa455d85879336c07be44fba567b7291369fcbb9a377b5b87b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867729, "uuid": "446fc400-eef9-4eec-b85e-e9244842b6ef", "value": "EB33F1C4AF57F814CA93B3ABBC882F976EA7026474CDE1955BC3319C0296D3316143AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867729, "uuid": "95f84b7d-5759-4654-b973-0ca3746bb00f", "value": "1536:CAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHi+d:xpoAnd9gucKCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867729, "uuid": "b8f63ef1-34c1-4f34-8c71-4da47b32b745", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867729, "uuid": "4adeef59-dfcc-48ff-92d3-07a60732623e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867729, "uuid": "d18d51d9-e66f-445b-8aa0-9321f52d8617", "value": "catalog-182772762.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d44772-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869177, "uuid": "94fa06f6-c280-424c-9e53-82eccbfad59f", "comment": "Malware payload", "value": "cf9345248874769c02502d5e04a9beae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869177, "uuid": "89a6445d-899b-469d-9b41-bc29e17b2445", "comment": "Malware payload", "value": "0398c0a8b8331c9550e967aea9c2e95eca4ef5d59a4bd7551c0b0b8455ed0fb9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869177, "uuid": "e5b35276-e2ec-4466-8ff5-da2d81e1e302", "comment": "Malware payload", "value": "332e5abfbe47e1c33d5ef8096a25ed21b2947e58", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869177, "uuid": "95df5972-5037-413f-9f55-9ca905e65a15", "comment": "Malware payload", "value": "5913aa2697c4e0b525fa7df9bf25b291ffb8615bd5aa641112b13e211c7c2447d747ac23b9ef6fe2180f8571e38e0c84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869177, "uuid": "7060d561-ee13-483a-9598-a7da1f7ae084", "value": "3B33029673F9A900C5F1C2F0A4E27589374F3D928E7D5DEE4D88A4793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869177, "uuid": "9d080217-450c-4e03-a0df-c18b54603dbd", "value": "768:b5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwr:b/czJJSI7r3Pwh8Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869177, "uuid": "9dc77f69-436c-46d2-9510-e1556ce8a5ec", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869177, "uuid": "579c9235-6dd0-4f25-b1be-cf3eb606102c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869177, "uuid": "2de0edac-0faf-4951-af93-228e86ae6bf1", "value": "diagram-1016375614.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bfd9e9-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914374, "uuid": "2dbf5e54-2c38-41aa-8d2c-f2011663b650", "comment": "Malware payload", "value": "e56a651bf59c425f02fa0edb6b67b89e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914374, "uuid": "788cc0be-9109-40d2-b7f0-e52e296331db", "comment": "Malware payload", "value": "039b0932ebe702a3c83434aef2e542f2bfd66703ae16aef82b2c4b04598cc264", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914374, "uuid": "4b57d756-4ef8-488d-9f43-da298bfece1b", "comment": "Malware payload", "value": "8b96e5f616a4f615eab583e66d2d44055d1ba867", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914374, "uuid": "d72183de-3367-42bf-b04d-d6e622921001", "comment": "Malware payload", "value": "005397473cbb46a94b40347858f44ec34149557bfe330561f583541b9c0f206a81a43cbf9f61ef52723ae840843ea4e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914374, "uuid": "8142dfab-290c-4255-850e-ec6f68d17df8", "value": "453302D2AB13E4D38AFBEAA7085512D4936FDDDC31143C59153A298345FB168C0E37C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914374, "uuid": "75ec97fa-380e-4f7c-a1db-cd6e9e095906", "value": "768:Jo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ScjA6FUo:TeKCVQbp4LTaI7ZaiNQMIX4Fp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914374, "uuid": "92839df7-ab43-405f-8da2-85f4d32f6224", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914374, "uuid": "9b19e6d0-b93a-4fbc-964e-cc43e1a35132", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914374, "uuid": "108a6467-2705-419e-8a33-834169ef1b32", "value": "statistic-100063141.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5766fb83-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911751, "uuid": "7b4db574-a0e1-4544-96d0-061c792e764f", "comment": "Malware payload", "value": "a728ff6128f91daf66c5d384db89363d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911751, "uuid": "0d21b14b-d903-4f71-9246-248a80e1b771", "comment": "Malware payload", "value": "03a1f2a4be2d847443122b3a2e0b87ec1c1f5f693385e65d3d1cd5b938f29e35", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911751, "uuid": "cfa8940b-479f-4632-bd73-16cda485457f", "comment": "Malware payload", "value": "7c9c0b41430f2fe14063dc64c4bd93783ffc8189", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911751, "uuid": "1be1f160-585b-4cdd-aa71-9948a15aa8e7", "comment": "Malware payload", "value": "b2d191d14c4d0383dabe5714d423be86d5c6776f2f09ca9028b09677226f0ca7ad464a534a8d98bcecded3523bbc8644", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911751, "uuid": "3ce0908a-727a-437a-8e4c-6f3c44654abb", "value": "153301D132D7C53A80C245F6F92B6DDA66A74BCCE930D0D02D9FDE4112D2165AE9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911751, "uuid": "3e65c958-0d55-4210-8e9f-37b6cf66e772", "value": "1536:hEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYn6:OnBrX5Eg5Enjq3axWIfkNwY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911751, "uuid": "b5cd42ee-cca1-4d9a-a7a6-6790d03e7770", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911751, "uuid": "2c25e536-2ec7-4877-8bb0-2a5366803099", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911751, "uuid": "8d956b28-0b28-4415-a9bd-18a9cda3e71a", "value": "diagram-1044186597.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7789246-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913711, "uuid": "18d8b96d-67cf-4f22-8cc0-07ac55e8173d", "comment": "Malware payload", "value": "beb19b86522edaf5353de8da8699748b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913711, "uuid": "e56842f6-9a67-421f-b19d-76dce7eda7a1", "comment": "Malware payload", "value": "03a7cca328640f9b43cb69e1cc9ac01a01cb7a250ff1f26fc5c5fbb53bcaada1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913711, "uuid": "307fadf0-06b6-4f02-8d1a-4a574ff3cc4d", "comment": "Malware payload", "value": "25adab37b590c70d8512601f0331bdfa405dd52b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913711, "uuid": "3c0ac96c-92c0-4f25-964c-6d8ce546adf7", "comment": "Malware payload", "value": "e51608f0a9586f3faf09f3a79700fe1df76879ca8cc0edba21067fca5881d4657f8ddea775b24ed1d64e8b6b5c399fd9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913711, "uuid": "1a4c5ff4-06d5-4217-9df9-10f5b1ff406e", "value": "9433F1D232E7C23AC0D504F1F5276AD952779E88F43490D01E9FDE4122E31B5ADA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913711, "uuid": "5b30bc76-5691-4242-8a09-25ee7868b123", "value": "1536:6EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRtK:vnBrX5Eg5Enjq3axWIfkNwRtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913711, "uuid": "b0e541be-4d4d-40be-821e-e2b971e977a2", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913711, "uuid": "ce14335f-fc49-4494-bf6a-f5cea8aef011", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913711, "uuid": "6e9ebc08-69bb-4e42-999f-46b414ae390a", "value": "diagram-502447077.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde62644-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872866, "uuid": "3897e669-98e2-47fe-a9b3-c2512d8741ae", "comment": "Malware payload", "value": "e1481e566d69930f4166b95577be2e30", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872866, "uuid": "ce09e9e3-185d-4fe5-b553-d59b99f36359", "comment": "Malware payload", "value": "03ab02c8a51e4e736e09ceced1c495d2e2ae24a583a6969adcf1ac3887706e9e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872866, "uuid": "a0474a2c-7ac6-44e5-8dcd-9deda726f389", "comment": "Malware payload", "value": "f5fa3701f9185b791ab866266827f1924d395c63", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872866, "uuid": "ddee543f-7805-4ae3-87ee-2f72d79e0668", "comment": "Malware payload", "value": "f3f5dbacc18d9663635642887aadafe037682485828fb543027277e9bfc56b71c6353c3457a7d1057f112d380e001ec7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872866, "uuid": "783bc457-553b-4c03-a6b4-f293d3fd0f3a", "value": "533302F2E682B6BCB542C1854ACC9A1B523F82706A2D4DB2815CFDD3D33C71E0B5069B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872866, "uuid": "42608716-ecc0-488e-a3f9-10a355a641f8", "value": "1536:Al/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Weiq:YXKAXh3TCdOi+KSZ4Wzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872866, "uuid": "0894d868-329e-409d-8527-ae8f917cd21b", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872866, "uuid": "dcf7185a-b70a-4a2f-ae11-fd192a93cb04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872866, "uuid": "a63ea84b-72cc-40f8-8333-68390cbbdec6", "value": "statistic-1758594776.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e459e109-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871615, "uuid": "1decf371-1488-417e-ba41-d8ea37ffdafd", "comment": "Malware payload (Dridex)", "value": "37e4c62a3ea0eb5b292006a126d06cf1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871615, "uuid": "e0a4ef3a-3abb-48d2-8d9d-2ba8ba22893f", "comment": "Malware payload (Dridex)", "value": "03b9a57807b9498b605ee5f469050b5c663920d22fca6c43e09657786811c51f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871615, "uuid": "5f4fb3e6-042d-435a-a329-c5cdd3361e66", "comment": "Malware payload (Dridex)", "value": "a813e01bf0db72f00807afe1b57df975d79bf2f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871615, "uuid": "abd941b5-be99-4f36-9221-e5f989736e46", "comment": "Malware payload (Dridex)", "value": "b15b62221aa1c4bd26cd029751eaea5ba18b96b724c32397c4f58c9b2a38de7fc379e139d77311fa05a58074f225c0eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871615, "uuid": "ff74bf8b-29e9-40cf-bebb-e8ec61ae471d", "value": "BCF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871615, "uuid": "42e7fa67-c728-4fba-857a-c1512714c20a", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871615, "uuid": "c4322a46-4349-451f-b98f-78bbd5ae065d", "value": "3072:p9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:p9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871615, "uuid": "5c4b0eef-dbf9-41a1-918c-d021bd86429e", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871615, "uuid": "d2a4f9f9-9a6a-4b8a-b905-9c1a2365cdff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871615, "uuid": "140092ff-85c2-427a-ba46-a0ebee150702", "value": "37e4c62a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc377e3-b3c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620893405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893405, "uuid": "f1038b4c-674f-4835-9b38-29239267fa68", "comment": "Malware payload (Dridex)", "value": "5d413cb331af54f7470aafc213914fd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893405, "uuid": "cbb9b663-fa60-44d6-a68e-8d756653baa8", "comment": "Malware payload (Dridex)", "value": "03c4bd10163bf61b8f46d631256628ae1fe7b273c0f37708dde1805f75b2c7ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893405, "uuid": "f05f148d-65a3-4d62-811f-0477767afae0", "comment": "Malware payload (Dridex)", "value": "bf2ccbc55d275671362a3c062d069d40586c9830", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893405, "uuid": "1bf4fbaa-0f5a-4162-bc63-91caf464e58f", "comment": "Malware payload (Dridex)", "value": "717e37b757e3e2c14bd592d84595852282a92d533fd937f50095d39120ce5657c4bf7e96319070a52bce5b44f6604f48", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893405, "uuid": "1576af91-3c5b-4c65-a356-05d8b108f727", "value": "46F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893405, "uuid": "6c2ebb0e-494b-4b69-8283-a4921fe57e2f", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893405, "uuid": "575ba7ef-aeb3-45b2-9f48-72daf8d296fd", "value": "3072:79F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:79F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620893405, "uuid": "8275598c-a652-41a8-a332-310f5993b98d", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620893405, "uuid": "e0d1f085-0f4a-4e51-a92b-06a6da90a1c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893405, "uuid": "0a751c4e-5725-400f-807c-ef89d55bf103", "value": "5d413cb3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ef2bc8-b3c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1620892371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892371, "uuid": "5695f99b-ad96-498a-9695-e6b931c61661", "comment": "Malware payload (SilentBuilder)", "value": "18e2b17ae5d1477a66c25064ed6a7037", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892371, "uuid": "2af82aa1-4316-41af-8151-3667fefa3637", "comment": "Malware payload (SilentBuilder)", "value": "03ca6c01d24b708744cc4be4c04cac9f8d913075c6abc49324d2696c1320816c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892371, "uuid": "d483a899-59eb-4da8-8493-9b0c1132787b", "comment": "Malware payload (SilentBuilder)", "value": "86fdc0a6bfab14e8e38749979703de64e38fd0bc", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892371, "uuid": "11089bba-4a27-4d2f-95b1-1f2f3bac0f04", "comment": "Malware payload (SilentBuilder)", "value": "f5a8864e1a6d7ed70846048ba8ebed64bf600c8384ba8fcefa056c13c344639244e18a0866ca068cb508edc8840bef37", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892371, "uuid": "50f2014a-a282-4d67-a10d-ede3db692164", "value": "468442857526483AE7160F73F0EE4DA85BB6ED10964F5A8B3F4AF30C9F71340A913686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892371, "uuid": "1e5345cb-7886-437e-91dc-2389271f3b23", "value": "3072:Q8USKE+Y6t/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/I/T/2zfOTfFG4l+s2/7nU5BLC:vUSIt6Uqa5DPdG9uS9QLA4l+sBTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620892371, "uuid": "4fb8cbec-b4d4-44d1-9eb8-b033e95ec98c", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620892371, "uuid": "2c782581-104e-44f2-a361-23478d03a7bc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892371, "uuid": "44dbc43f-6520-402f-bd46-1f8d0f6a6bcc", "value": "doc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85fc086-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913256, "uuid": "43972450-b7ef-43fd-8b68-5084afac38e8", "comment": "Malware payload", "value": "b9946d7f0a7b8cac5170c82c391ffb3f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913256, "uuid": "7614a498-0baf-43b6-8a8a-22177cb1af45", "comment": "Malware payload", "value": "03e3f1536863f60ba76093ef223205d06ae7b5e57628949d7c093fc181e55034", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913256, "uuid": "3f1d36e9-3100-44ec-86aa-1bf8b92f07e5", "comment": "Malware payload", "value": "bb524922c9c3e1d59a0ad43ceaed2b68f0b0be6b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913256, "uuid": "5be739fc-cc06-42a3-9c1b-c7623dfe06d8", "comment": "Malware payload", "value": "3b22377b5b3aaabb4c0a636f02c5c692dd998f0a2ff417db32bd8975b3216a2ec2aeb230324a7ae2eb0c8db60c240071", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913256, "uuid": "375ac20d-4583-4747-b072-36dbae81f1c8", "value": "1E33F1D133E7D63AC4C101F6F42B5EDA6AA78F89E920D4D05D4FDE0022D3169ADA264F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913256, "uuid": "701b1dab-87c7-4199-9bd9-42e64a75854a", "value": "1536:tEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwbciMmSWLb:SnBrX5Eg5Enjq3axWIfkNwlSWLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913256, "uuid": "a38931f9-b5e1-4cb4-8ed8-ce34d610fd39", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913256, "uuid": "02f7e860-004e-4e78-8a1f-f53c49c01420", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913256, "uuid": "d6cbac60-8074-4aa9-8036-6a4ce9ef4e52", "value": "diagram-2120292673.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d6250d-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866836, "uuid": "9f75ba0d-8f55-478a-934c-fb8d04c59aec", "comment": "Malware payload", "value": "17a5053a7472fe5ce94b37ee0460f7e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866836, "uuid": "2d230614-3372-431d-80b1-5a1ed2c44b19", "comment": "Malware payload", "value": "03f06486a641ed0d9a001916e5047c9d9ad30a42e06377e9666be6e092ca1f39", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866836, "uuid": "4579fd47-60ca-4d8a-908f-852bfb533291", "comment": "Malware payload", "value": "b13b109fe49c54e971434d0155cf5812c9bc304c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866836, "uuid": "972ab4d1-0504-499f-bfb6-4361b5405c51", "comment": "Malware payload", "value": "88c768d6e59f5a9da35e5ea593706c02033439623f747d6c8d17321f2f259191411bd0a40beabf181f62948f895bd80b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866836, "uuid": "dc486469-b01d-4106-bdb5-7e03eb00209c", "value": "CC33F1C9AF57F818CB83737BBC582F977EBB0254649DE5A55AC2309C0292D33661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866836, "uuid": "fff111ef-3b25-4fd6-9065-32891c9ed221", "value": "1536:RAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQib:GpoAnd9gucKCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866836, "uuid": "fd6c6619-dd9b-4c3e-9303-c9e75b11e2b0", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866836, "uuid": "9fa8539c-7bee-4a57-82f9-be1c1da98310", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866836, "uuid": "dc72c737-9ec8-4c46-aa92-44240293f0b4", "value": "catalog-1127370692.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e908f8-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914672, "uuid": "fc402500-db3a-4a1b-8546-7eae363a1729", "comment": "Malware payload", "value": "0a5bc349081cccbeb11e4a8aa3a7d174", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914672, "uuid": "f81e3a72-bf4d-46fe-a62d-5ab87e0d95d2", "comment": "Malware payload", "value": "03f0670aa37c740cdc6e49cd4f058c47edd6e0bc7316b44258abbeeb05b8a702", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914672, "uuid": "521277b2-6c76-4bb8-b826-df70dddcd1fb", "comment": "Malware payload", "value": "8398007a496101ba64597d343ac386776d2c3aa6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914672, "uuid": "7183f4a9-473b-4976-a5d6-7f16ac891f9d", "comment": "Malware payload", "value": "587a11715752ec50ed097c5c6946ac6fdcc2b7607a2a699c80cf10f939237cfa86d3e56e834d42d05ac58a7a866d76b8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914672, "uuid": "a18bc4c6-fcec-4102-9018-610853f5d138", "value": "F93302C59613FA8286F9EEA7144A52D4A79FD9DC31283C184D2F748281BF198C4E7BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914672, "uuid": "6ecd1e74-6e4f-4e73-bde8-d95780d88d11", "value": "768:xo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Shs2768:LeKCVQbp4LTaI7ZaiNQMIX968", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914672, "uuid": "ee7228be-d1ca-4c41-8b37-2a36e4a727d1", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914672, "uuid": "5f4e0a35-9575-48ec-93eb-c2eb5eb09dc6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914672, "uuid": "50b8b7fe-8147-4bca-8b74-2d185b4722ae", "value": "statistic-1188761337.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c976d303-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870282, "uuid": "64e4e3b4-7dc9-4304-a5a6-7193f553fff4", "comment": "Malware payload", "value": "a87e0ff1c9942807936ee457d7698f60", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870282, "uuid": "da92637a-d13f-4df1-b96e-8674de0056a7", "comment": "Malware payload", "value": "03f212a6d7e3a009f1eef678c8ac581a71e38c0cd65f809bd67d905fcfda6b88", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870282, "uuid": "2b4686f3-c61b-4ed9-95c1-6aae1c4b28aa", "comment": "Malware payload", "value": "815dcfff9cb844f15783d14c7d5766c9b4e30ac4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870282, "uuid": "f4e24df9-2da0-4a01-8da6-700f8f34e7e2", "comment": "Malware payload", "value": "bc2a00d98163b3bd2decc2c99b0e7cc95077bef3ec7cbc65c0905d9a632bbc539bd6cafd1f255aa6208f03b718a180ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870282, "uuid": "80bc371b-21db-4470-a909-aac144b73cfa", "value": "9933029673F9A900C5F1C2F0A4E27188374F3D928E7D6EDE4D8894793B921A5CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870282, "uuid": "3a7f5e21-680d-4ec8-b1ff-58b3fbc240b3", "value": "768:h5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcC:h/czJJSI7r3Pwh8fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870282, "uuid": "9682cf7b-5e57-474e-a1ac-ee0ba7294324", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870282, "uuid": "2b0dc1fd-5693-49fb-945b-ba7e96ae5adb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870282, "uuid": "339e7165-bf9f-4cf4-a6fa-abbe40d402ac", "value": "diagram-1799535275.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ffd35b-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896663, "uuid": "f9e71927-72dd-4443-9eb3-9c52d41de1eb", "comment": "Malware payload (Dridex)", "value": "b002b690bef5dd1a45f786fc844d56a4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896663, "uuid": "0b0a4382-d9a7-4f1c-871a-516e53b899c0", "comment": "Malware payload (Dridex)", "value": "0400a00f30adc8f7ee96c335038f5832c045695182973447d43176793f8d0d2e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896663, "uuid": "570b1a5c-d5c3-4035-a40f-5ebc68caf230", "comment": "Malware payload (Dridex)", "value": "d6e418ce548c49b8be64828a594f75e99ffe02f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896663, "uuid": "6617abfe-ff29-485d-9a55-d05a36671fb9", "comment": "Malware payload (Dridex)", "value": "45fdf550b37e1f98e6b67a9339bcb1de4e540afcd3955d06cb4e30d9f7129a69b7d02d4b0bca94d8ec130cd5c316e3f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896663, "uuid": "ed5d3d09-568a-4d46-9e6b-22250421c0f6", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896663, "uuid": "929931b9-71cc-4492-925b-8114d86d6869", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896663, "uuid": "3fcc6b87-4bd3-40d1-a26c-f92ebdafd2e7", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896663, "uuid": "b48d2899-7347-4f1c-8325-429804cb2c0c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896663, "uuid": "85323211-b26b-42ad-8b19-4fd34809808e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896663, "uuid": "a81ea8f5-3199-4d54-abd6-724c272978bb", "value": "b002b690_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866e9bcc-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915266, "uuid": "68d2d55c-05c3-4438-873d-df66d595d1d3", "comment": "Malware payload", "value": "405078a22fc78ddfa787c0cb470c4123", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915266, "uuid": "3d656cb5-d57a-42d2-b680-3744888e8560", "comment": "Malware payload", "value": "0405b4ba4107577535c8cf8c0d5abc551097333e3d066b4a39f7b58acbadd2f0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915266, "uuid": "527b7864-bf8e-4a44-ace0-ec9a579daa32", "comment": "Malware payload", "value": "8578a91f14ee75f7029d04446beda6ea371f0414", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915266, "uuid": "7a904b4b-96cf-41cd-b903-6f26db4bb0bc", "comment": "Malware payload", "value": "8631f09cb7065b80c686afbb37b04879c70846f6f3447ec87cfd9e258bc7cdbcb666a970307db1210284cce10b163772", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915266, "uuid": "0600e17f-41ae-4854-ad2a-703766ad7f94", "value": "113302D5AA13F4D7CAFDEE93089923E4636ED49D35143C995C3B398184BB1A880D37C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915266, "uuid": "331c02b2-55d0-4035-860e-7e4fee867cfe", "value": "768:Lo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SXAjMxyf:BeKCVQbp4LTaI7ZaiNQMIXAo8hCTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915266, "uuid": "13b8e911-8ebf-40ab-be58-48a6b7a4294b", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915266, "uuid": "36642b17-6f22-45bf-b1e7-c2ad184a5267", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915266, "uuid": "42fce312-533e-4dee-83fd-4ffa5d6c2f07", "value": "statistic-1660220227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ef2b3a-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868021, "uuid": "33d26025-8055-4d8e-975b-6729747f3060", "comment": "Malware payload", "value": "1d57da6613cb60e2e99bd6925ac41cfd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868021, "uuid": "f4a36079-0e1e-47fc-b983-10dd1310f701", "comment": "Malware payload", "value": "04060e23e3b8cc336eae3fcebd0097d4612a3b90c107a07c655dfbce453239fd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868021, "uuid": "e17800bd-e3a6-4c77-ad4f-77d09f5bded0", "comment": "Malware payload", "value": "3e6d15513d4fc2d475dc03db1aca3e1211c0f56e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868021, "uuid": "4bac3038-1888-47b2-9a50-acbb8058855e", "comment": "Malware payload", "value": "f249ca24aba63996a4abcc68b14cb560f8e49b11c4493f98b90d41c1a8570396835b5a991ffc3ad5c9ff93871ba57d6c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868021, "uuid": "af5470dc-5737-43e9-a9cb-7bbd0574e045", "value": "4733F1849F9AE418CBC373BABC882F976FBB116454CEE49466C7318D0297E27561026E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868021, "uuid": "e1ce16ed-3ede-44b5-b4e2-44ae8ac36e8a", "value": "1536:ZAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHijk8KYU+:upoAnd9gucKCg89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868021, "uuid": "3a98e3ad-53ab-4896-a9f1-9141b128e207", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868021, "uuid": "02d57f37-88c4-487c-8db1-0204855e980a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868021, "uuid": "74b8c961-32e2-4fec-b30c-8c1cef7b3843", "value": "catalog-2055828247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68130828-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914786, "uuid": "ceec69bf-aeac-4f98-8d91-8ec50e41c8f5", "comment": "Malware payload", "value": "aa09dd0f7b16fed1d6240c66a1f58f46", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914786, "uuid": "238ce830-18e1-465b-b408-5e2f29b1fe52", "comment": "Malware payload", "value": "0407409465271b073f79d682ff85f4089d689229429f84d5a305d2e7a9ed135f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914786, "uuid": "7a6977b9-329a-4e8a-b5c0-3d172b3e0ffd", "comment": "Malware payload", "value": "7d1789cfd62fdfc0153cd20f826d039b557e5788", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914786, "uuid": "a4ed681d-b85f-489e-8af5-d1e43f31b3b5", "comment": "Malware payload", "value": "30f9dd0cb4f806758da637a797563d7b209a5311be3fb9bc38c1d37e180f0b4bc368b26f5ad747553e791800b6cb8832", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914786, "uuid": "1e349b7c-de96-4352-8d36-b94f67315b5a", "value": "65F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576A08879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914786, "uuid": "e3fd0816-c808-44f0-85c2-7e4cea802878", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914786, "uuid": "07e2d35b-c8eb-4245-a32e-4285a4993fb8", "value": "3072:+ar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Is4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914786, "uuid": "45cd4eba-fc28-452d-a53b-fbb967f07843", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914786, "uuid": "9e83a56a-b804-4dca-b141-7ee5d305ae0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914786, "uuid": "36d243ac-9a6f-423c-8a83-18c92cf23068", "value": "aa09dd0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9c16ed-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911492, "uuid": "6a825b91-2b56-47b8-bfb6-f08d5882e524", "comment": "Malware payload", "value": "e6a08d1beed62a031ba9ea07957b8857", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911492, "uuid": "1afc03af-d55e-467d-9869-baede3deb7d7", "comment": "Malware payload", "value": "04162168209357d11a099ecb7de6d52e4ede70abcca4b8acb80071f1474031e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911492, "uuid": "361a5d2e-ae1d-4cf9-b654-25d75cbacff2", "comment": "Malware payload", "value": "2d11244ea74d15659bb309b2a6d4b929535a752a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911492, "uuid": "8cb5f774-5672-4c84-84f3-c0de8f8aa962", "comment": "Malware payload", "value": "8d607827080651e5df6aa39db644004c109e7e5be7afe0cb3c268da436fbb67c4123334fb0cbec1ad9289f1ee409a24a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911492, "uuid": "304a789b-a5b5-460b-9423-3b46d0e1e29f", "value": "213302EF9410FAB7C19B67015FA997A302FD7819E130E198C35AC5E5E5831C2817E8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911492, "uuid": "023731d4-b8d1-4a9e-927b-e2a0038332e0", "value": "768:mqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7gL3:nxTuDqsF1Cnc3P57oj2+nC6uxkL7m3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911492, "uuid": "78a880c7-59b0-4be2-b7c4-699b11e9d982", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911492, "uuid": "2a733219-7327-4837-a2b1-c4d01dbdd012", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911492, "uuid": "3524b6c0-657c-4360-af48-4c2612b002d5", "value": "catalog-869685961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01d3a82-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868092, "uuid": "d7254888-718e-400c-8ad1-d9a245cb0e19", "comment": "Malware payload", "value": "e674181e292157b2b77fc87aaed0589c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868092, "uuid": "487dcf0b-79d0-46cd-8637-2c8b4fb8ab08", "comment": "Malware payload", "value": "043074101649b27b56f519a24ad25a29c68133e955a19567299930abbbe4c9ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868092, "uuid": "0bba6730-1a90-4eae-acfa-c2def3272be0", "comment": "Malware payload", "value": "b076f944961b286f0bbbee5b0ca6877aa892ba7c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868092, "uuid": "2c09d794-e09a-4fea-ae53-211cd17964fd", "comment": "Malware payload", "value": "b18e481f4f8ac94aa88ad4bd838a9cfaa182a66562d2717b946c5ab152a6c8770df5d831639edddcaed062450a872e27", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868092, "uuid": "dbceff86-cc6e-4a44-9359-18a0cbc637d0", "value": "0C33F1C8AF97F818CB83737BBC582F977EBB0254649DE1955AC2309C4252D33661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868092, "uuid": "85279851-3817-4586-b655-478f0dc282af", "value": "1536:rAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQU+:spoAnd9gucKCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868092, "uuid": "fa0c63d8-0989-4301-9894-7c3a6eaea170", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868092, "uuid": "17eda731-ee0b-4b95-ad28-b8aaa33ffd5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868092, "uuid": "a59c941b-004f-4fef-9a33-57fb31691988", "value": "catalog-209241095.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbc0149-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868541, "uuid": "0d61936b-a822-4191-ba71-8b16b3f6d9d0", "comment": "Malware payload", "value": "f2b744e4e3c9b05feb36be0e9d32ccf6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868541, "uuid": "ba453f78-f62d-4b9e-a37c-11a99b07cc87", "comment": "Malware payload", "value": "043568c1d329accc2f969af46d632b9093bee0133817e057799b7634f206c34b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868541, "uuid": "755490a5-50ef-4d1e-a12d-611cd89078f0", "comment": "Malware payload", "value": "bae84f7f0475a5db742863251c6e72df7a1104c3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868541, "uuid": "9036b901-a73a-4ad9-9fab-46b2b224039b", "comment": "Malware payload", "value": "47e4b87d2c249ee542851fca40387a935d7293100020fdeb790460be4c336acd22b8147bc7078d4a08aae7c768098a72", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868541, "uuid": "b0875922-57e0-47e2-bb69-7fd2909707e9", "value": "D633F188AF57F418CB8373BBAC882F976EBB0354649DE0955AC7319C4296D33561036F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868541, "uuid": "c6df5737-835f-4d8f-bac5-207ee939c568", "value": "1536:ZAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHid//:upoAnd9gucKCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868541, "uuid": "103593d2-8480-43bc-ba14-db181d13337b", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868541, "uuid": "f86349aa-6bf9-4970-91a9-13ba05f655db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868541, "uuid": "15544ff8-988a-4da6-b103-03f4ba34b469", "value": "catalog-496183070.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1b2975-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913345, "uuid": "8c0aac3a-f127-4170-8e6c-18d515ebf709", "comment": "Malware payload", "value": "72d6b58724e5288f6c9734d038fb4e88", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913345, "uuid": "96f3d9c9-d96f-4d04-bd87-fc0338fc18a8", "comment": "Malware payload", "value": "04408a37cd195ea6d52a46d5a1017d9bfdd0ff8cfbb47c33e20821f7be0445fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913345, "uuid": "5d5dbc61-4fc7-4dee-b7a6-763f02d7a888", "comment": "Malware payload", "value": "05ed445936bab3ea0b4ca7c9cf3cba88d18ffcaa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913345, "uuid": "a3dc5dcc-eee0-4d7c-b803-2b457f7d4236", "comment": "Malware payload", "value": "91f6b1a9ff6b41cd67c2da1e9962cb1cb00544b0eaa7284842db181c5920cff205892ebabf1b7084b11933740a43aa7b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913345, "uuid": "0af49dcb-c043-427e-bed8-4b534360e380", "value": "B733F2D233E6C179C4C505F5F52B5AD956B78E88F53090D01D8FCA1112E31B6ADA278F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913345, "uuid": "bfeb97e4-5c08-45a1-a569-3ddf260ba06c", "value": "1536:+0EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRoN:QnBrX5Eg5Enjq3axWIfkNwRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913345, "uuid": "de207bd1-7aa6-4671-a3c7-0d18a3a00e63", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913345, "uuid": "b2491704-8447-4d38-af9b-0d2f26d698e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913345, "uuid": "edf1d310-a0aa-4064-bd88-2ad2a8cbb487", "value": "diagram-259966913.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3634c5f-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871077, "uuid": "34d3fd61-8511-4263-b11c-29a6db01adc1", "comment": "Malware payload", "value": "fbcb4b7ad49860eef6ee4587e6b9fdbc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871077, "uuid": "13482487-2685-40c7-bc0a-6dab61609383", "comment": "Malware payload", "value": "0443b20e283510c9c31bec9844c24bef26954708f3e050c2c8ddee81a822c68a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871077, "uuid": "84dd9d67-be0a-42a7-9937-8b70300035e2", "comment": "Malware payload", "value": "81f186ba56d34f0eefe649f44e7737792957454f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871077, "uuid": "fcf6143a-2f14-4c7b-b6b6-43ef0954e0af", "comment": "Malware payload", "value": "5b61b34f8b8436efc2fc641654c18b85c132f534351a7b8a95eecb4e84c70c5e45392ce3bdd713bc821159f2f6d41656", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871077, "uuid": "7ca2ba4a-a2bb-47ed-abc8-8e863f5f0849", "value": "9133F19537FAF51086F182B060E1B689274F3D618A695EFA0CC4B6793F931A0CFE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871077, "uuid": "2588d2e9-f4dd-4ee7-a9ee-1003744b8b76", "value": "768:p5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJn2R:p/czJJSI7r3Pwh8Rd2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871077, "uuid": "bd3f9902-c708-4562-9697-833a19cbdd26", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871077, "uuid": "80d56f99-deab-4893-82fc-7535d1ac2007", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871077, "uuid": "5cca2f12-ce67-45f7-bee6-896f953b6da6", "value": "diagram-424996312.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e369528-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868813, "uuid": "72666000-e18c-4e91-8025-cafa4ab9cd78", "comment": "Malware payload", "value": "8057eefc01c15d6de2799b6ff94a5b1a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868813, "uuid": "9779ce99-8443-4ffa-b1c2-40c78e3ef7ea", "comment": "Malware payload", "value": "04470c1d9306cc4913290bca42eb1cfedd1921951643c903c92d54d85fa31337", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868813, "uuid": "cc25637a-0562-45e2-90a9-e9719aafae59", "comment": "Malware payload", "value": "ccfcda88258e1dc77a568bba7b14870c0dc366a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868813, "uuid": "60bd8bb9-2117-4d1a-b464-ca41eb3428a4", "comment": "Malware payload", "value": "8aa99355bbe3dc1fba599cef65c1e8cf49799188fea034715c69204cf1aa565099e3a11236f71ae5e3457bf8a4bba5ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868813, "uuid": "f5574a4a-4fde-4448-b964-5a3e0ddd083d", "value": "E033E188EF57F518CB8273BB7C882ED7AFAB026454DDE0995BC3319D0286E32561026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868813, "uuid": "047c0497-8bc5-4499-9b62-3a1d640cb0b5", "value": "1536:iAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqZ:RpoAnd9gucKCIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868813, "uuid": "3db9e8f2-7f32-4281-ac21-be391fb5e4df", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868813, "uuid": "19d33a36-1482-4194-86c8-2acc46020077", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868813, "uuid": "cdd0bc73-4b6d-4b33-9dd7-7119e2e7ead4", "value": "catalog-702012212.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662cd4ea-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911347, "uuid": "6f34b6fa-1300-49f2-904b-96564ca4915c", "comment": "Malware payload", "value": "a848212f230ebb9267f0e772abc4ccd3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911347, "uuid": "425143d5-0ab5-4346-a371-f354de23f77e", "comment": "Malware payload", "value": "0456066fcfdc6b54623dbb975821390cd65c078e39e1df7cfb2fc30a3a60f383", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911347, "uuid": "b86de010-6a4d-4844-b61c-4e62f1a69877", "comment": "Malware payload", "value": "72ea8bbd355c6b86184a33264a6d3fbf85a871cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911347, "uuid": "ec945019-6993-4d79-a157-3cd4bc3c13b2", "comment": "Malware payload", "value": "ae85473ab6c673c079aefd33c241b206e9cb40e432e4bba6f5534657dc9cf4cefc4309f8eaf70817e9245a154ca70443", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911347, "uuid": "c0298c54-f45a-4430-9b07-6a19c06ae646", "value": "B433029FA008AAB3C19F57016FB6DE720AFD765CE03091648369C6F6EEC36C280795D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911347, "uuid": "4f3dca17-8f3f-4fce-ad87-47cbc0da540d", "value": "768:pqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LO2vk:0xTuDqsF1Cnc3P57oj2+nC6uxkLO2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911347, "uuid": "0d3eaeeb-309b-4501-9ee6-81ad52e337fc", "value": 51711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911347, "uuid": "767711bb-39a2-4d33-a455-8f0fc426cf9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911347, "uuid": "c9281514-4cf1-44f2-9221-a47c89ef019c", "value": "catalog-751978164.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdabd912-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911091, "uuid": "bd425e38-d083-4ba8-9589-3b8c6cc98f54", "comment": "Malware payload", "value": "dfd8e24c7462c652c1376de965285acd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911091, "uuid": "a5b0a47d-8f86-48c9-8107-abaac5383c92", "comment": "Malware payload", "value": "04576b0df77b0dcef1b16f5945ca979a27262344ee9569edd8a6135dbfb571b7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911091, "uuid": "9634f2cc-2dc1-48f5-a3d8-d3a3d86357de", "comment": "Malware payload", "value": "b0b8df40196d47df5356902c8e46ad0355bf1db9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911091, "uuid": "2735251a-33bd-4b18-8a27-2da4661227de", "comment": "Malware payload", "value": "ba5b4386b4c55babc8b602fe9f5961454226593a30b4f9809fd2cf53b23ef793a41f9790dcf80536d3b0719e351603c0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911091, "uuid": "a600bada-b253-4929-844c-bfab61e66195", "value": "833302DFE414A5A7C38B53021FB5A6A206FD760CE23091A49359C2F5DA836D3852ECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911091, "uuid": "ecf19989-3ad4-42dd-bac1-6c16a5ecdd36", "value": "1536:kxTuDqsF1Cnc3P57oj2+nC6uxkL4yx2p5Y:kxTqqsF41j2Pxm45pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911091, "uuid": "a0b233a2-37c3-42a6-a1c1-bd27151acd18", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911091, "uuid": "9ba4e97f-7095-4a4c-9393-69636617eea8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911091, "uuid": "98f4b36c-d3bc-4ca0-abec-ea45d3dfda51", "value": "catalog-557822720.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edeaf31d-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869054, "uuid": "47c03a97-97bd-4d58-99d1-11b933c32f24", "comment": "Malware payload", "value": "2c2fde95ba3e9f8dfa0e5743f8363fb1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869054, "uuid": "2ebec626-616d-43ed-980d-80aea01c6db6", "comment": "Malware payload", "value": "04617292fbcb967be3079892d8ba4fff734a0fd9a0bb7a871024044ea0fb315f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869054, "uuid": "52f37737-4dc4-4d50-be08-e2b37e489014", "comment": "Malware payload", "value": "44ee9116d9debb737f38dde95b6e5dcbc1c9e3e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869054, "uuid": "812594d0-ff5c-4852-ba2f-c2e44f699dcc", "comment": "Malware payload", "value": "ae2f390b7c8701c79b7cadaa7c5aa242ecfa12ce6b36c722cbdc0454a7a67c4e3d9fa5556c95a03e0ad48890cf8745ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869054, "uuid": "864dfc0e-e102-45b8-aa06-2e551651d708", "value": "7233F288AF57F418CB8373BB6C882F936EBB0354649DE0955AC7319C0296D37561036F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869054, "uuid": "cc0f0037-1c3b-4c99-8715-60a5bd63baf2", "value": "1536:FAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHidJb:ipoAnd9gucKCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869054, "uuid": "623f2146-f85e-4609-bb2b-eb06990bf76b", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869054, "uuid": "8434766a-5252-4513-b3a1-a98ecd58bde3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869054, "uuid": "48b1cbde-b868-4e0e-933e-3024c93355b3", "value": "catalog-924818055.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb895e9e-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914523, "uuid": "ea36b241-f710-4e39-9938-294e4208142c", "comment": "Malware payload", "value": "2f348c3c57bd8d936a58d92d9371cd9d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914523, "uuid": "71083526-cda9-41c4-a430-65e8ad72c9d7", "comment": "Malware payload", "value": "046c9f2f5d25727b34567e9c1aa326b94faa616497e98761066c30eddbe0a208", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914523, "uuid": "7e4b1370-0022-42aa-8381-4cf33ecd1210", "comment": "Malware payload", "value": "5daff75982a10d71b2dfdca989b5cf0e4aa6d915", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914523, "uuid": "004b85f7-86e4-4b40-9117-5b4de4f6ab36", "comment": "Malware payload", "value": "888fcfdf75346b7b3c2426b2ac3f72e8e603d91d7178e193ec52f441f33e32d95c084f2229947fe8bccb7d5d84921535", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914523, "uuid": "bf704662-aca5-47ad-bf3a-6de81e459902", "value": "5333F2E65B23F5C2CAFEDE63044523A5939BD49D72283C5C552F254240FB668C4E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914523, "uuid": "bf6b7c17-4f37-48c4-8f58-ecb1bc95dc73", "value": "768:co4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/k8:QeKCVQbp4LTaI7ZaiNQMIXvk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914523, "uuid": "dcb4da12-947a-47c4-ab47-effc0abe26db", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914523, "uuid": "92272cca-498a-4a07-a0b3-074b1ff35cd3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914523, "uuid": "50b69ce2-2ab8-42d1-9388-fb6f0f152784", "value": "statistic-1108197051.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f10780-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868075, "uuid": "80e5dd6d-a941-4bb9-b6b8-def0b4515652", "comment": "Malware payload", "value": "31ccede80c18d907e8c781acb00c9da6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868075, "uuid": "43f7400e-ae15-49bd-9fd6-930af3fc6431", "comment": "Malware payload", "value": "047335679b08459b3dcf95b85e37ed0cf6d591c81141971969ff6b10ef68d9f3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868075, "uuid": "8986be77-7ad2-4161-bcb4-03e1ddb1c2a2", "comment": "Malware payload", "value": "e3a7a61f8e7121f598be280841d7da42c7ac85e8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868075, "uuid": "ddeede5a-3f54-44e5-b74a-7d94c3dd005f", "comment": "Malware payload", "value": "445d0a783bfe8e3217742a733a9320b00b9d658a5d17de13ccc6e855424c965375ef5621590d7f2588d7c6f32305da82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868075, "uuid": "3f77c088-d588-407e-83c5-ceacdf746a42", "value": "D133F1C8AF57F418CB9373BBAC882F976EBB0354649DE0951AC7319C4292D27661036F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868075, "uuid": "39966ea6-cd2d-4a61-9b95-c3bc3a430e9f", "value": "1536:kAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHidZ9:3poAnd9gucKCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868075, "uuid": "8e83e8d9-7ec9-4520-a012-207591300989", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868075, "uuid": "e55a79a9-67b8-4d84-a1a8-54b7c2706ba1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868075, "uuid": "dd6dae11-43e0-4fb4-9d40-2bf88fce0da9", "value": "catalog-2083286923.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bb4c02-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872322, "uuid": "9cc45311-8ddc-471a-852b-919c81646de0", "comment": "Malware payload", "value": "07bf0be50b8a5e0c2084a7ab8e9b1971", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872322, "uuid": "f24e70fe-f5da-4471-acb1-9ccb484d1683", "comment": "Malware payload", "value": "047cf6a630a39655a4139c0a9a5a21155f41939e0ecf2204723418370d6277e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872322, "uuid": "177eb38d-6ed2-4006-8431-2afb539595c7", "comment": "Malware payload", "value": "c6382146e3c48fe834822ff430fdd577f20fe1a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872322, "uuid": "da24cd23-f9b5-464f-baff-111651152496", "comment": "Malware payload", "value": "fa13e14f9063b84d127f8452d71914a3e664b66e70dc24ee622b755b126704f1b02e011a50f4e7d47bb01300ccc47be6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872322, "uuid": "b8eecb70-a8c7-4618-87eb-24d1e23e107a", "value": "133302E2D312A2BCB643C04589CC1E979377427026658EB2C56DFED1A33D7160B61BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872322, "uuid": "6e29f84d-14d6-4dd9-aa45-15cd27ce3bf5", "value": "1536:sy/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8Lj6l:jXKAXh3TCdOi+KSZ4WBRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872322, "uuid": "ee5aa586-9339-4c48-af55-3714f2181b18", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872322, "uuid": "6b8e6591-6906-44de-a46f-1676893e888b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872322, "uuid": "65269fac-faa5-4773-af7b-17c106ba921b", "value": "statistic-1380531681.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3992116-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870648, "uuid": "583a5e14-e363-4101-a08c-7a9a9ea22951", "comment": "Malware payload", "value": "e916a4945c65ac7399ecd4149f060c43", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870648, "uuid": "bbc4e969-a737-4883-b683-dd94aacac147", "comment": "Malware payload", "value": "048985d55a74445945e98935bcffc671c042c04117fa06c8248a61c8a221c252", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870648, "uuid": "1e4eceaa-23b2-4223-a0e7-b4da4f52105b", "comment": "Malware payload", "value": "11ccc066e04ff1f3f1bec5c80afb231376156b5a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870648, "uuid": "131bd85f-d00e-4157-93c5-d1b14d03ede8", "comment": "Malware payload", "value": "05275604ca055e53669b308ae69421e1e59061a91e27538d6de30021038d8452daf88c6ce3b5ac18ff53f52fa8d73d36", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870648, "uuid": "84b12692-b6e0-4ace-a216-8d36f0b11f9d", "value": "2F33029673FAA910C9F1C2B0A4E27188374F3D928E7D5DDE4D8894793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870648, "uuid": "4ba59efb-a768-4952-82e6-c406255b6724", "value": "768:U5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwD:U/czJJSI7r3Pwh8TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870648, "uuid": "8329232e-a559-4f71-a280-e47bc40da7ca", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870648, "uuid": "a00813c7-a516-4f35-80ba-36eb42729ef2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870648, "uuid": "408efd38-629d-473f-88ce-302452502ec6", "value": "diagram-2047617694.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4d36fd-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871551, "uuid": "1374323f-c186-4498-8e4e-660aa8a068d7", "comment": "Malware payload (Dridex)", "value": "6333f266f73fb35f0f098cefda1514d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871551, "uuid": "efb56061-7207-4651-935b-33d291fc9528", "comment": "Malware payload (Dridex)", "value": "048a26a219a696a17a164d66928c5231f8a798c8a07340c44df4c3721eca9d60", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871551, "uuid": "79f1711c-f1a1-42d2-a6f1-2df3baaa79bd", "comment": "Malware payload (Dridex)", "value": "4d686c7da1834c361d0e85cb0926c1d2f44ff446", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871551, "uuid": "1b6664f6-6c00-47c9-a40d-57babb02bbb2", "comment": "Malware payload (Dridex)", "value": "89dfcc9865e410474ef6abc9bba99a0003a59b296ffafa151b019fa46dd7b018496feb9a643be379bda9ffb1c8a0dc8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871551, "uuid": "5816e4ca-7a59-4e5e-a5cf-a887d43bbb37", "value": "97F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871551, "uuid": "819659bd-908c-4bcf-8c6e-74959cfcb1ef", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871551, "uuid": "7197f44b-fec9-4f9a-b8c1-dc8c5a38a262", "value": "3072:iar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Us4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871551, "uuid": "bafca419-0a6a-410b-986d-aa2405697e05", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871551, "uuid": "361a2b3e-fe60-4e38-b9f9-ccf1e2f9331d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871551, "uuid": "09a28a0c-e89a-4fa3-8f2e-15a3c7d990f6", "value": "6333f266_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21ae1a2-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871638, "uuid": "05719892-26fd-427a-9dff-9d6c57e2bb58", "comment": "Malware payload", "value": "44accd4e232af7b5a43b28117c05b86a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871638, "uuid": "10796123-9cf4-4002-bbee-b11822c3d55d", "comment": "Malware payload", "value": "0490bc54d0fe7d929a765929e1f8f88574ca0fd52bfe0045b289bf0df583e356", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871638, "uuid": "5e1ae2ee-b39d-4499-a138-144d28ca4a71", "comment": "Malware payload", "value": "efa7a9970fcde1b67e256a07fbb481ccdd62fb0e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871638, "uuid": "4acb6dcb-b01e-4d1b-bd10-1666364e7980", "comment": "Malware payload", "value": "54cf4e21db1ee319b0283fd3c571ae62cb36a2263d2b3f5cb172bbf5ef98db2251eeb9839daa1a95b3e2074702e255c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871638, "uuid": "b4439e56-b403-4103-b708-b28063fcf4bf", "value": "C933F2A473FED510C6B1C2B0A4E2A589364B3D91897DADEA0CD464693F931A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871638, "uuid": "ff6a0c48-9d3f-4e97-b53e-65afaa88f36a", "value": "768:q5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx84EVIWgG:q/czJJSI7r3Pwh8tv8x8H2nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871638, "uuid": "ef75dd85-65e7-41fb-a703-a87fba866806", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871638, "uuid": "44457323-6409-49b6-ad56-cf70431274df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871638, "uuid": "b01a17d7-f786-492b-a214-610024cbcd03", "value": "diagram-849680460.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caa130c-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909989, "uuid": "3f6501d9-483a-4aa7-9b31-34dfc75119b3", "comment": "Malware payload", "value": "a857b810ea6c39bd86b4a89823e5a5f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909989, "uuid": "e86acc98-6acb-4dca-8007-b99ef13a054e", "comment": "Malware payload", "value": "0496968cc97601ff0ee17e92967cabe6a58a5b86f635449c98ae561cc28282a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909989, "uuid": "3bf4faeb-2f6e-4ba2-bd46-b1be1deac643", "comment": "Malware payload", "value": "67305632159a2b8c94b03305786f1459b2213ce9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909989, "uuid": "214da5b0-ba98-4230-989b-1a3c252f5fd4", "comment": "Malware payload", "value": "d0cb07e9d532eb640757c10abda98bd78331149c82c3aac6853261a65368dde626cae540652d7f510cf7bcbdce23da47", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909989, "uuid": "29ef3a8b-5a16-4452-85d5-838433cac62d", "value": "F13302DFA008AAB7C19F57016FA6DE720AFC765CE03091648369C6F6EEC36C280795D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909989, "uuid": "03d06ecf-9cb8-4bf2-b7f8-6defb05d3d73", "value": "768:Pqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOTvE:CxTuDqsF1Cnc3P57oj2+nC6uxkLOT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909989, "uuid": "6d4f419b-2eb7-424a-b245-69b99044c55b", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909989, "uuid": "979dd295-43a5-4399-b51c-ad0076eec674", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909989, "uuid": "25d6531c-8f90-4fe8-82c0-f1291d03585e", "value": "catalog-1660229669.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5807a40d-b3c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620893284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893284, "uuid": "054b7fa5-6fc9-4757-a8dc-abaa3b5e6b2c", "comment": "Malware payload (Dridex)", "value": "a85451629c7fd7bbe53f661070b782b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893284, "uuid": "e08a9a5c-1925-431c-be22-f860c0d8e4ad", "comment": "Malware payload (Dridex)", "value": "049bb9942d50db3ebe05fb2668c745524a21f5259de3c899961cac161c4ca728", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893284, "uuid": "ddc063ce-8a05-46c9-80a0-4496f6f9e203", "comment": "Malware payload (Dridex)", "value": "b36e3d4941eaa98170c0d22a8319f6564d948953", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893284, "uuid": "86666788-0520-4955-9cd7-8fc62735dc27", "comment": "Malware payload (Dridex)", "value": "68593e95603f8ef407fb8cbf274440ce085529b7ccf6d99aecb8fd6c06e5aae7e4695b82cfff7cfe11787e2095e62b44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893284, "uuid": "f431185b-5503-4557-adbe-5cabbec60f40", "value": "44F3D0D3E21FD1A4F223063450F4F46ABA7C24C786349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893284, "uuid": "8a0edec7-6673-498a-9750-209190a93d54", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893284, "uuid": "89adc674-923a-4dec-9c27-bed5a269ccbd", "value": "3072:89F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:89F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620893284, "uuid": "03c4af8b-24aa-475b-8d03-9c35bd753833", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620893284, "uuid": "515d2bca-c679-453c-a48e-10070561e95f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893284, "uuid": "ccb03b4e-842b-4451-a801-33212515f2b5", "value": "a8545162_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3127bed8-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871744, "uuid": "26c30dc1-c82d-43e3-81cb-c1522a3021de", "comment": "Malware payload (Dridex)", "value": "27e9ef611ef03a2e36a0591bd6721bf8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871744, "uuid": "c335f208-7d1d-4e0a-a5b9-ddb8751c126f", "comment": "Malware payload (Dridex)", "value": "049fdf3cb759037a091e6daf801425c5a30eedfb67f34c47c09b1c66e9926bbc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871744, "uuid": "18f8af06-4213-4e3a-a8ca-bc8c04a04889", "comment": "Malware payload (Dridex)", "value": "a3d586b475cef8ba7c5f9a17732642337ff2c5d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871744, "uuid": "2def3743-0aca-4534-a04d-eb9279744bbd", "comment": "Malware payload (Dridex)", "value": "8ea52e49284e2b842e5e189374005c69f2d82021b411dd4465358fd23a8b42cb26d0da753a656e0a7821460849ccff08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871744, "uuid": "4db603c8-ca94-4df4-87c4-a30ac514f215", "value": "C8F3D0D3E21FD1A4F223063450F4F46ABA7C24C786349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871744, "uuid": "9a84d587-f656-40d9-938d-eb2f8922de29", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871744, "uuid": "de5fb69e-8b39-490b-a84b-7003da309364", "value": "3072:Y9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:Y9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871744, "uuid": "dd168b8a-7a37-4387-b20c-222ff87f1373", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871744, "uuid": "303e78d1-4ae0-4a2c-9e1d-4408a51d40cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871744, "uuid": "8c4c899b-af54-488c-896f-e1e71da2d732", "value": "27e9ef61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fcf48f-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915076, "uuid": "055e8e3f-5f5e-4f03-8a99-104665aaaee8", "comment": "Malware payload", "value": "93e9621e990db2d22a1a7bb349e65698", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915076, "uuid": "b8fa0879-0841-4b03-b7b7-10e3d3651fda", "comment": "Malware payload", "value": "04a1eea659a2956ed42470f32872a206bb5d020794c9328dab86137bf697fada", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915076, "uuid": "a455f38c-c4bb-44e7-af37-5953562f2a14", "comment": "Malware payload", "value": "f3bb728d6a46222c822ca90c70804ed99a388f14", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915076, "uuid": "4a31f3f6-88ff-4a89-bf50-91a37002c2bd", "comment": "Malware payload", "value": "0bc497ff409268a67a5e921c8482e93a570f0f0c28ca93b7e0880012ed8d768d2bab417caceef9f6a4f39c705cb744e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915076, "uuid": "676c8825-6071-4baa-86a8-6395e51c9a83", "value": "4C3301D2AB17F0D6CAFAEE57086973E4936FC49C30143C595D2F258280BB554C4EBACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915076, "uuid": "9f60777c-ceae-4311-9209-3ab3afb2ce24", "value": "768:Lo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SaFh:BeKCVQbp4LTaI7ZaiNQMIXKFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915076, "uuid": "2db52589-40d6-4f0b-95a9-70d7653ba63e", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915076, "uuid": "b620def8-ba09-4b5f-ba85-02713d832746", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915076, "uuid": "cdf1dfb4-9264-4493-b414-cacf38e9d916", "value": "statistic-151755014.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e071a1-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873007, "uuid": "7736fed7-31bc-4594-b3aa-f0addbe51249", "comment": "Malware payload", "value": "e7671d9ae28a4f43d1a54cc07df51dc0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873007, "uuid": "88d65ca0-c92e-41f9-8d01-3e84ad50ae51", "comment": "Malware payload", "value": "04b733e45a345861c3c384f5acf13f842c65760f29ada2774cffc438f3661319", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873007, "uuid": "1dc46e15-f142-4811-96ba-5862e9aed851", "comment": "Malware payload", "value": "692d6b367be11647ed661209cc26c3388dd88421", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873007, "uuid": "dc05ad33-5adb-49b0-8bcb-c1d72fb9dfc6", "comment": "Malware payload", "value": "19d0aa1154f2064dca4a02e35bdcca50665e5ad84584d71758d35791e6f454acf3df59e4e67dfb77d6398a5f150ca480", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873007, "uuid": "e0655083-4e28-4e0c-a908-51041d58b812", "value": "373302F6D243B6FC7643804E4ADC6F66523B42B056290EF1C15DFEE2923931E0741A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873007, "uuid": "498f7ffd-dfc4-4ac7-8c9f-75fb867e0071", "value": "1536:W//2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFc:cXKAXh3TCdOi+KSZ4WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873007, "uuid": "629f6829-830e-4f05-9ae0-a7bc3323c1ed", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873007, "uuid": "4b1f5bd7-a7e2-4c9f-8438-6f74761461f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873007, "uuid": "69ba82c8-b99a-4624-9e83-73fb05fe83bf", "value": "statistic-1842634032.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf1b49d-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874123, "uuid": "4e3f2778-633b-4708-a349-be62d27030b7", "comment": "Malware payload", "value": "a783838a9d9aab5a1f32cd4706b0da15", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874123, "uuid": "ae800a79-8d2e-493b-8826-09461a31e8f8", "comment": "Malware payload", "value": "04c3084ecaa00680894027d9cae80e215b0fe7885445fda0631a00c5e3b43027", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874123, "uuid": "a01f16cc-4e17-4b54-a9cb-d362a1203e5a", "comment": "Malware payload", "value": "2e846d38220d1fd1ccbd247b3707d6ccd5231a34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874123, "uuid": "9ec7117f-b474-4e02-97aa-7eff0f0896b2", "comment": "Malware payload", "value": "c0fd26d4344a3c757482a4cedc28d492d3f414ef2f49850c6b626b8c251427357d662ab4885c1e4204d3b5fedb9e6d0d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874123, "uuid": "e60a5a37-fb62-47b8-97ea-f45c406b24f2", "value": "4E3302F2D243B6FC7643844E4ACC6F66523742B096291EF1C15DFEE2923931E0B5169B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874123, "uuid": "257b41bc-5434-4398-a09f-6bab622a870c", "value": "1536:R/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFW:RXKAXh3TCdOi+KSZ4Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874123, "uuid": "f525e616-f8ef-4f50-9978-d743b9290e78", "value": 51601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874123, "uuid": "8676f49a-8e4a-4c22-b79e-9976a519a81f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874123, "uuid": "e0cd3c64-fc38-4704-889d-ec7ce951290c", "value": "statistic-624948295.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9f6b19-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914691, "uuid": "3fe9b835-6a17-4efc-8750-46713f880190", "comment": "Malware payload", "value": "981d19a5876f68d81371eb1188be3f8b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914691, "uuid": "5ed271ea-b2ff-4818-afa7-44af3d00e859", "comment": "Malware payload", "value": "04cbf6f3a236aab175b7afecba2beaa8ab972c827189bb4e557dff9c0cd165bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914691, "uuid": "dcc38a77-34c9-4e75-9c39-1edcb53a110d", "comment": "Malware payload", "value": "c62cd384f09170e4a22632f177426ea62dfb575d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914691, "uuid": "bd40b90a-7391-48f8-b232-6d468f0a64f0", "comment": "Malware payload", "value": "a6b5070ef034cbcfe850ede6074472ebafb7c2adda63ba604f504162c43a19702d03324e3c83696fb14962c6522af552", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914691, "uuid": "efd2f0e1-85c0-44d4-8ee3-a58103935128", "value": "1533F1C65B13F5C6C6FADA67088633E4536FD8DD30143C6D6C2A658280AB1A8D4E7BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914691, "uuid": "ade97ace-c62f-4971-b5a7-7b703fa919b4", "value": "768:3o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK8XEK:NeKCVQbp4LTaI7ZaiNQMIXd1XL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914691, "uuid": "bce63605-0a01-4418-aeb6-fd9ee411ff45", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914691, "uuid": "5b586c0f-4d9c-4fe3-84e3-dbcd8b0c3943", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914691, "uuid": "325fc05f-a2f9-4720-ab0c-3f95fd7c27c4", "value": "statistic-1205244543.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57517bb4-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913469, "uuid": "031cedfb-df81-4b0a-9bfe-71074d9ad303", "comment": "Malware payload", "value": "ca25a1599f884080aa063e4d23044274", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913469, "uuid": "ab1a6cf0-c6c1-43c7-9eea-513202eaafe3", "comment": "Malware payload", "value": "04e1242dc2e6a90749c0669a4ca299b5f774c8027c5c1696907fab5d7be934c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913469, "uuid": "1d222a73-0652-44a9-8bc1-d18fc2cb92a5", "comment": "Malware payload", "value": "41b6149933052e163373650e7d2f180262e86626", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913469, "uuid": "00e215ee-c7b6-4db2-85d0-88506e2d8bd9", "comment": "Malware payload", "value": "b4534bb06717e422d23eb2f84ac7101a10d92e4a5a3b8f2f4d2d0f86bbd565ab098841bf539120f67d1a1781b82fc7bd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913469, "uuid": "293ad6b1-8ac6-4429-bc9e-52c4ff692332", "value": "0933F1E232D7D17AC0C504F5F92759DAA6678ECCE530E0D02D8FDE0122E3165AE9160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913469, "uuid": "eb3838eb-f129-41cd-9fdc-23a731652b5e", "value": "1536:WEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnvo:DnBrX5Eg5Enjq3axWIfkNwYvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913469, "uuid": "8e721847-d697-4f18-86cb-5aedee6377de", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913469, "uuid": "a645fceb-1474-44a6-8cb2-4df18120608a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913469, "uuid": "fb4f84ca-a553-49e5-9fc9-7da7bcb834c6", "value": "diagram-351681711.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6caa48d-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915750, "uuid": "4d0d483b-14be-4648-8f7a-136491adb2b6", "comment": "Malware payload", "value": "649fbc9b9f3497aba654cabd8e636c65", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915750, "uuid": "2a52a7a5-14f0-49ea-bfe9-11ea2ca82c3c", "comment": "Malware payload", "value": "04eaa06e4b54a0a196bb56a5e2caddc359957fa68815852b65b6d897e3c44b4b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915750, "uuid": "5a3994d7-728b-4518-b7f3-b85a4cba052d", "comment": "Malware payload", "value": "7a929ca85259a42533809095410acde8e1fbf0de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915750, "uuid": "f5ab14be-9868-4a5e-8b4a-77575f997b58", "comment": "Malware payload", "value": "b25aa23a021deac2f7ddc404d96939be297b9c578052d591d76270c5fb73301315035d4a29df15da3d008c43463445f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915750, "uuid": "93753d8f-d68d-4ee2-98a2-0d6e5cda281e", "value": "7D33F1C26A12F5C78AFADE63044523E9635F98CD32283C695D3E759281FB158C4E27CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915750, "uuid": "daf99e35-a4a2-4323-8b08-aa8ccc026fb2", "value": "768:2o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkAB:OeKCVQbp4LTaI7ZaiNQMIXUAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915750, "uuid": "b28b8fed-5a89-474f-99b2-8b58873b8214", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915750, "uuid": "7a55c001-531f-4ebe-8d58-5cdca9afa870", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915750, "uuid": "e723c68e-b4bf-439c-9bc0-e3d16396c3b2", "value": "statistic-205171796.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02a46c1-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871608, "uuid": "cda63e9f-e08b-40dd-abca-b59ca775e0fc", "comment": "Malware payload (Dridex)", "value": "061020c5c224196fba3542e1943894d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871608, "uuid": "2eb55c7f-0ed6-4c79-b0e7-43796688f7f5", "comment": "Malware payload (Dridex)", "value": "04ecad625df9223cf74f8702ced97cfb915557c3a28be16cf3ddbee8ad6567f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871608, "uuid": "594e35d8-0d5e-4b15-b2ac-d9d6b9f47670", "comment": "Malware payload (Dridex)", "value": "dd6dd59f1200660dfa92677769ebd2708f55d243", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871608, "uuid": "20327225-8e2b-462d-ad35-7dd3174b1605", "comment": "Malware payload (Dridex)", "value": "a16ef20e069764d00cea8d843c289f2cd6fa15568b6afa320aabc429152c2d46a417ca771405402f90d6d89a59443dba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871608, "uuid": "dc96fb93-c08f-46eb-9e87-1f1d385db695", "value": "85F3D0D3E21FD1A4F223063450F4F46ABA7C24C786349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871608, "uuid": "0582632e-b442-4529-b871-b0e93a867496", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871608, "uuid": "2824f2ef-131a-4ca5-aa59-42b34dbeed49", "value": "3072:k9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:k9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871608, "uuid": "0ea7a697-84f4-4f0e-9b55-559d738a671b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871608, "uuid": "6ecad225-f78d-4cce-81e3-f4dac8244016", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871608, "uuid": "0ad63557-1cb3-4a67-be89-3aa45879b232", "value": "061020c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b043db0a-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871957, "uuid": "76b05319-0924-45ef-a164-c81d7f89c7cc", "comment": "Malware payload", "value": "6094f36af8e140a501d381f6b89ce5a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871957, "uuid": "a0b43ae4-3517-4ddb-b47f-13642fb0586e", "comment": "Malware payload", "value": "04f1048a0a8dca0a9f50b53285c6cec4ce3c52414b828476900985aff73c6ad6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871957, "uuid": "a37b5c33-b647-4d61-a194-9793374cfd64", "comment": "Malware payload", "value": "52d0a943b1b84db93ca3c9576e811e72dd9885c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871957, "uuid": "3c8ff41b-ddb8-4bd7-9f32-eafbce07f1fe", "comment": "Malware payload", "value": "2336156ac262b909ac606faa8adf2950bafb66c3262d812efe59d284b487ef096594c67ed8079c48557d78363c66e943", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871957, "uuid": "75dbda29-5b24-425b-a4be-a028f1d19e91", "value": "8B3312B7E643B1ACB603C4CE49CC5E1B423B827056B88EF1CA1DDEA1923971617517AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871957, "uuid": "a7bbe95e-e770-466d-a56a-394500d33c59", "value": "1536:qL/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexHA9:AXKAXh3TCdOi+KSZ4WUA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871957, "uuid": "9b86a73e-87e0-41b1-a305-e681dc1156ae", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871957, "uuid": "46a0b738-023e-46f7-a8f8-380d3903c92c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871957, "uuid": "034e7b01-a7fa-4504-b6d8-e80abcc15f63", "value": "statistic-1077761815.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21cd4cb-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914910, "uuid": "41415dee-8835-4d7b-acc8-2c221cb71fef", "comment": "Malware payload", "value": "d70f2e83d6a2d9204be107a8c2b378ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914910, "uuid": "93370f9c-125c-4cec-90de-976d6b57d878", "comment": "Malware payload", "value": "04f86027f79ad3d8b07df8c7fe969a28f7a33c18cabf32f90f539a5817b1b41e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914910, "uuid": "78cd395a-6b57-4ad7-bdb1-57eddcc7c3bc", "comment": "Malware payload", "value": "660404336468996df7ded761105b7f9b38f98dbb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914910, "uuid": "abb13dfa-35f7-4b44-97a6-b386ca913f5e", "comment": "Malware payload", "value": "458b498c3fe61656fc008568e1f8a6946c9000eed0e3e7d6dcc05e60ac93f86486ec6bc812dd55692919feebc16461eb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914910, "uuid": "1788ca14-5d7d-4751-ae60-8ece4488a82c", "value": "8B3302D6A523F4D287BADF93089633D0A76FC84D32143C9A5C6E258280A7558D4F37CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914910, "uuid": "f0715a49-f821-442f-944b-3c18a396c2ed", "value": "768:Co4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SZEaQE6h:aeKCVQbp4LTaI7ZaiNQMIXWNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914910, "uuid": "00c525b6-7dbf-473d-9b0a-ff4ef63f0e7d", "value": 51775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914910, "uuid": "add97587-0232-47f9-8cf0-1adfaf3c0ddd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914910, "uuid": "5183f2fc-a886-42bf-9cf8-a54ba8f69027", "value": "statistic-1396467746.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac12043f-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620912323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912323, "uuid": "f8013575-ddfa-4751-a2ab-d50add203f17", "comment": "Malware payload (AsyncRAT)", "value": "841cecd801172a5c1e7c8329592a9661", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912323, "uuid": "0067361d-d0b0-4801-bf9a-812496a22790", "comment": "Malware payload (AsyncRAT)", "value": "05030526532dbe4d0a3e49140489439468957d6dea9f482ff983e778b21c61d0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912323, "uuid": "444fb93d-1b02-493f-b0d6-7a9162eec42a", "comment": "Malware payload (AsyncRAT)", "value": "f644250531e9463d519a6506ad6ddf87178448f6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912323, "uuid": "df2a8aaa-b92d-4622-908d-97762798e757", "comment": "Malware payload (AsyncRAT)", "value": "13f9a096a8f7c78bcbd38cb9aff029176f63e27416783ee7b0e4e7b6ad5a1d82a14ea04c6e672c8021cc8a8dd1fd2a05", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912323, "uuid": "8832b297-534a-493a-a990-6398f7178f64", "value": "92233B0037E9813AE2BE5BB868F25145857BF2632603D54A7CC811DB5B13BC79A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912323, "uuid": "12744c30-ee5c-42f6-904a-445bf1515691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912323, "uuid": "3df9e15f-8d2e-4a03-96fc-b170ea48c8fb", "value": "768:NxGPMZGIoNEdqc5UZdLvOr3ls1Rz68x26XC2yjbFgr3izhgBkR8CqBmdAslClZBA:NxGPMZFo0r1YhRebCrSzGBkRfymdAZri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912323, "uuid": "f668540c-08cf-4514-9321-e65a2b0838b3", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912323, "uuid": "c137d2f5-9ac1-49fe-823a-377f6aff3c2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912323, "uuid": "763b9daa-5da7-43c3-8502-01bf9cd3ca93", "value": "JNLjBGHz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce7167a-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912083, "uuid": "97004ee9-e869-4fe1-a011-92639c6e1a40", "comment": "Malware payload", "value": "7d033d9d4a74473b00a0c1354ff8a2d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912083, "uuid": "dd99ab78-05fc-4adf-9634-8822678a038c", "comment": "Malware payload", "value": "0507599d3ffa0a940f9652a16328f939fb65ae0315a8e17a12c807ec11e7ffab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912083, "uuid": "4a462082-f568-4c2f-903c-52a4e69a85a5", "comment": "Malware payload", "value": "60aa2712d545372ab776b1a4b21a0fcab5363b91", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912083, "uuid": "11b4335b-6169-4447-bc8d-1d32a2456033", "comment": "Malware payload", "value": "43a742d719919948049eeb19049024dc61daa43652b359d2fefa8d09f925bac94ee49904ad27ac73251bfe6c0aa6ccf7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912083, "uuid": "c51ae367-fb67-4acd-aa88-220813256bae", "value": "2333F1D233E3D23AC4C605F1E4274DDD6A978ED9E920D4D01D9EDA4012E31A9EEA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912083, "uuid": "3c0ce9d9-59aa-42a8-8bbb-37922670108c", "value": "1536:eEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciM5O:bnBrX5Eg5Enjq3axWIfkNwsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912083, "uuid": "63f0d8ea-17e0-4b9f-90bb-2a5409c0a2b6", "value": 51762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912083, "uuid": "f2880df4-6a2f-4b34-876b-3d5c58378e57", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912083, "uuid": "7b297c2f-d6f6-4452-b7c8-63db7d3c2bf4", "value": "diagram-1307691329.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a2f476-b40b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620924637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620924637, "uuid": "26a65794-d872-42a8-a1d3-b02a243fe1e5", "comment": "Malware payload (RedLineStealer)", "value": "aabee96d30c09e9a0f63e6fa65519e68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620924637, "uuid": "86470b49-a743-4a89-81f0-3feeac9d2ce9", "comment": "Malware payload (RedLineStealer)", "value": "0514a53b14ab75ecb568f17307de06e1aa4bde9f5cc4bb6a18934c135560d9e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620924637, "uuid": "acea2853-79d9-454e-a619-9b0eacca279e", "comment": "Malware payload (RedLineStealer)", "value": "4634c07cd2a7426ed503bc36242d3eb23a49049c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620924637, "uuid": "885ab358-9694-49ae-bcf9-d506c02ab858", "comment": "Malware payload (RedLineStealer)", "value": "c83128d74a73042b7d6b24a766efd919d6ded93bf437c777f7f1f18f5f5ab28980c5d8bb942263b6eaaf594e162beaa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620924637, "uuid": "7a4f274b-46a3-4605-b82e-760e4760a023", "value": "FB47331AB6AA4BC5D1A42D3C23F50DE016A47DEC422D7BD5231CBA893CBAF074C4DA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620924637, "uuid": "df6d8448-42a5-407f-a2a4-b498f735cf51", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620924637, "uuid": "6b4e8b9d-5e18-4f17-b696-6ccd8eedcba0", "value": "393216:IrAeGGGw+mzr7DfKfMnGQTYKITHmmpaMm5KfKc4V4Ibj24pyI30HLPrc2ky:Fe/PfofyOTHmmgJc7ajv3af7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620924637, "uuid": "b19735d7-17b5-4006-b22f-eda8aa59c8cb", "value": 24652786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620924637, "uuid": "530caa3d-33c6-4cca-ad96-bcfe983bd11d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620924637, "uuid": "fcf27658-e2d4-4a06-a1d2-61506c7471fa", "value": "aabee96d30c09e9a0f63e6fa65519e68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc08982-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869482, "uuid": "db89ad8d-266c-4d63-b80e-206d4f52d30f", "comment": "Malware payload", "value": "079182b539bfd94c2ec9e618fd3f1803", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869482, "uuid": "0bb7bc48-5b94-4ead-b307-2369966cc943", "comment": "Malware payload", "value": "0527c8f64700558349bb0d5cfcebcca15256ee1b782611d620b2185a95a7b401", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869482, "uuid": "3592032b-27d6-43b8-ad5f-0c274d7871cf", "comment": "Malware payload", "value": "869c4f4f620484a6c21eed54ff387263e591351f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869482, "uuid": "e56feae3-4e0b-43e8-b525-48a9264c4ce7", "comment": "Malware payload", "value": "f02b8303f3a2828270ed26a0b22904cdc1eb9cded9ce21c64651eca86c5ea25b2cb4d8e3597b110087af42b3b2b9d8d6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869482, "uuid": "4c880154-72e9-4ea6-8834-cb8c9bef5476", "value": "9133029673F9A900C9F1C2B0A4E275C8374F3D928E7D6DDE4C8894793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869482, "uuid": "700d0100-5ea3-49ee-8a95-c678f62d2cc7", "value": "768:C5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoE:C/czJJSI7r3Pwh8rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869482, "uuid": "8d12b0c7-1f6f-4544-afbd-49f752b6e1ad", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869482, "uuid": "f8d954da-ef56-4978-a673-0ca698708267", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869482, "uuid": "0bc2631e-ca7b-465b-a025-fc6b84f994bb", "value": "diagram-1281597196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07062829-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870385, "uuid": "70a213ee-76d6-41f8-8afa-609f715b4254", "comment": "Malware payload", "value": "188660128a30748d0dfa190723c5e6f3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870385, "uuid": "12c7382b-1ee0-4862-a11b-ba3c4854e7c1", "comment": "Malware payload", "value": "0538995b04e22e0eaa73a133a8d299d64fa95407a36ad22c8d761a62cf14868f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870385, "uuid": "4fb06512-fc14-407c-9563-081a9549bc23", "comment": "Malware payload", "value": "52f73f1eedbb47ddb31e7b8836c757b17f31c395", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870385, "uuid": "02cb03a4-4429-49e8-b4f5-88d0bb2339cf", "comment": "Malware payload", "value": "ebccf8adaafe3b1a65d904610fbc79f6912cd1b6b3f6d57fe32cb77437e7d42636700ab83972e6737d30a99b9a03a116", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870385, "uuid": "256f54a1-dfa2-4289-8c36-999914383948", "value": "DE33029673FDA900C9F1C2B0A4E27188374F3D914E7D5EEE4D8894793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870385, "uuid": "36866e30-d9af-4011-abc1-b8b86da5e176", "value": "768:x5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcJ:x/czJJSI7r3Pwh8fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870385, "uuid": "6ad09168-b45e-4930-a014-9367773651a4", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870385, "uuid": "8f9d9220-3af8-49f8-b736-ac64e7dfb2f5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870385, "uuid": "d3d92e3e-bf6c-4302-be19-ee633a884185", "value": "diagram-1867522234.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa6887b-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868968, "uuid": "0bb5bc19-d652-41f8-bfe2-0a46c5450655", "comment": "Malware payload", "value": "be3aa0133fd3aefe5220ecd1716d6a79", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868968, "uuid": "a86b53d2-b923-4c05-82e1-8dcd0fb056d5", "comment": "Malware payload", "value": "053d53bf6f46475a86a0f515858295c2ff28743f4364a8163ab4b39e99d691ee", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868968, "uuid": "1cce2dac-e5da-40c0-938a-ecc61e637cbc", "comment": "Malware payload", "value": "0be61fcf6eef0d55af12ccfdb5c2116805430cdf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868968, "uuid": "d0aa141a-185b-4292-a354-d1f641f45e67", "comment": "Malware payload", "value": "bb709dbd8a22cef9576024b192960fd5085b1e22025669d83b1e401d5e127bcbe9e268b232b3e4ca9c20a500568660d8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868968, "uuid": "de9cdc60-6d26-4251-ba47-a73264c47368", "value": "4D33F184EF5BF818DB83737BBC882F977EBB0264648DD45917C2349D0286E3766102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868968, "uuid": "2710d6cc-26c9-476e-a9b4-f41697551ad8", "value": "1536:nAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiqz+X9:ApoAnd9gucKC6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868968, "uuid": "4c6278e5-9c08-4f0b-9896-76b08b211d16", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868968, "uuid": "0673cea2-4049-4313-89d4-efdd965cb44f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868968, "uuid": "dd0f48b1-8868-4f30-9548-638d8cfbc19e", "value": "catalog-851108459.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e8bb9c-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911371, "uuid": "54d43d8c-9cf9-42db-8339-b3d716befb2f", "comment": "Malware payload", "value": "8d1f4d4aa083bce748d7a18df90af618", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911371, "uuid": "395214be-fe0f-4cc1-87d3-4acb99bdf49b", "comment": "Malware payload", "value": "0543e13fcf7b10ac8137ab80ece362de2d677e71dec2ccb29581b81c61b6966b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911371, "uuid": "446f4993-290c-47b5-9093-3e4c814f3768", "comment": "Malware payload", "value": "7dca542c471f2a5d2f79e3695bac3151190c96e3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911371, "uuid": "2dbb21e5-0496-4c40-8769-9d43022abf04", "comment": "Malware payload", "value": "ae717f022146a161ca3d68daa0f036f932d3b4802346fe99e7d48cbc33075c876c54d745d4dcc041f4c007af58e14a83", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911371, "uuid": "e54bd7bb-44db-4392-9835-b247a9a07f36", "value": "433302DFE008EBA3C26F93005FF986A215FD7558E17081689799C5F9EA832C2C53D9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911371, "uuid": "efeae5aa-4bb5-4de1-8ab7-dfe27eccbeaf", "value": "768:qqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3gmhfvK:rxTuDqsF1Cnc3P57oj2+nC6uxkLYUXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911371, "uuid": "c6666c77-ff16-41e5-9ed6-839f9fca78c0", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911371, "uuid": "305936a2-3e16-438d-97e9-4d12d516d368", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911371, "uuid": "ca20e0b6-cc1e-4f77-84e5-750ffa5f9f52", "value": "catalog-771947944.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1156691b-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620867825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867825, "uuid": "8f43fc35-4d4a-4352-b3eb-47cd12ab43e0", "comment": "Malware payload (Dridex)", "value": "801ae348d9ac34ee1d81ad6786725d4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867825, "uuid": "ef11beb7-7361-41a4-bd84-7730cec11e14", "comment": "Malware payload (Dridex)", "value": "054c83ceabc727ebd6d74e61937639498a1904ba821f485461196f91888c120b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867825, "uuid": "c324a1a6-9540-4b37-86cc-90d7ef755dc5", "comment": "Malware payload (Dridex)", "value": "66bc5f93d9328287343b55cac97b49b532bb39c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867825, "uuid": "008ca9b8-af1d-4b64-81e0-f9a3e708659a", "comment": "Malware payload (Dridex)", "value": "002b2a6bd377d8f7bbd89d10016cd6aed78e2056b069fb467779b8ec87f12dca5a501b7f6e275f0ce2f63501a63e36d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867825, "uuid": "0def0e7c-2ac4-4a73-b154-db8fd1c48018", "value": "3AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867825, "uuid": "66063efe-b575-4081-93aa-839a179f0d5d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867825, "uuid": "ff9435d2-15ee-4f64-ab6f-16f01c19ef8a", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867825, "uuid": "a3ee9556-ed90-481f-963f-1ee1a2d2850d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867825, "uuid": "d4c44a68-84cd-43ae-8adc-d72f9e4028cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867825, "uuid": "30d54bcc-a3c8-44b7-ab54-66d92dda22cb", "value": "801ae348_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879396ed-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913550, "uuid": "8c50154e-1727-4a87-821e-4c03c55c50d8", "comment": "Malware payload", "value": "0843624e3c5aa8eecb02d2735595f79e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913550, "uuid": "3a48f033-d81a-4bf0-8a03-313e6cb20ff8", "comment": "Malware payload", "value": "054de4f0c127ae1da20a184f7992b5a9fcb091dc19d14310a427d114dff13b1a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913550, "uuid": "ccf50c8b-435f-4204-8a75-2f0399428035", "comment": "Malware payload", "value": "ff80325ca0b9109d061a7fb4b453da5f96563bea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913550, "uuid": "e24c264a-0995-4e51-b86d-6191d718ca7d", "comment": "Malware payload", "value": "a0cee1d7562b4fbbc8523b1191f149b2e59b1c17c988463566e5c8ab226850e1bd1c6666665ce279373d3f7a84e4e757", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913550, "uuid": "50f3f3a2-daa1-4406-9b40-a38a419dbf5f", "value": "7733F1A232D7C13BC0C506F5F82B5ADA66B78ECAE920E0D01D8FDD1112D3165ADA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913550, "uuid": "1eca5f64-7c3e-48f4-9720-3ef653c1b20d", "value": "1536:dEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwe2hHe:inBrX5Eg5Enjq3axWIfkNwe2hHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913550, "uuid": "c00b34ea-613a-4356-9c6f-8fd31ca45dd2", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913550, "uuid": "d135e62a-f90a-445b-99d5-dccb05e77cb3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913550, "uuid": "297b7951-5cb1-4319-88ac-a6f322019f9c", "value": "diagram-398798763.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5989040-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870732, "uuid": "627608a9-b1e2-4660-806e-8b8c21eea377", "comment": "Malware payload", "value": "5754c34052a071bb24dc005d65293a71", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870732, "uuid": "c0dfc11d-c75a-4826-bed8-f6becce7a13e", "comment": "Malware payload", "value": "0563c31f932e3f39c592b3540edbb100949d691061b4280ef9f0498bffa25ce2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870732, "uuid": "bf49f343-4568-466b-a88b-fff439cee7b8", "comment": "Malware payload", "value": "68fd6f14ca8124ec3691a19fcc52763b2baa7ffb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870732, "uuid": "66b12797-1600-4ebb-82ea-360399eb127a", "comment": "Malware payload", "value": "8a563c9027e2fe8f1020b5cc2bc0b641430d6d88b6516b0536ba48cae02ac7b76e3d5898a0a88cd72b09b4114c7e528f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870732, "uuid": "7c0ea3fd-1795-4e10-b135-95d1b4e135a6", "value": "7633F19537FDF910C6F281F0A4E27189374A3D518D694EEA08D5A5793F921A0CFE52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870732, "uuid": "aa49bb92-fdcb-4a0a-bfe5-9f19cc66525e", "value": "768:+5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJDJJ4X:+/czJJSI7r3Pwh8RPJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870732, "uuid": "84a2502d-84b6-4020-8a11-16269cfc1694", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870732, "uuid": "451907db-42ee-4753-abfe-e4a1f7607f9d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870732, "uuid": "af31a954-2bf0-4fee-bad7-33fbf8943008", "value": "diagram-2100035078.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa96d762-b3e3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620907596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907596, "uuid": "18986541-1c5e-4830-a10b-368e34d97164", "comment": "Malware payload", "value": "286937ab509fd8f18946fe2a9341499f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907596, "uuid": "6eb412fd-c3a0-4cfd-aa9e-a2360bc597d2", "comment": "Malware payload", "value": "056efa4153fd0763a488a13b5d8f8e3e56c2dfbeefac5cd185e16b96b373616f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907596, "uuid": "b2ab8b50-e425-4c0c-9fd8-d6786ee75f1e", "comment": "Malware payload", "value": "fd263d1d8e4a5377aa83ac9c2cc96d2ee524a6e9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907596, "uuid": "c105ba56-9b36-47be-9ec3-8b12a0563349", "comment": "Malware payload", "value": "531e63d22c56e2e507f5da287bc9f196eb7db1ffef18871bf1150e6f593dca53f993c7370893da84e734ae18f832d21f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907596, "uuid": "0ea10037-4ac1-4c5d-b2f8-efaeb4fd17b0", "value": "329427A83A81FC135B9D1D83FE426FFD4122A5638A996187C7687FCC0DB8193C466DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907596, "uuid": "954284b1-fd1c-43ec-abde-1451c48671f8", "value": "3072:oGuaAxKTzprcjyg1tJ3SqSmVdAbK1vTIh/BScFOaTB3crTmVyoj/ZaahJUE77xKj:WOZXDZ1uh7AXETV0lYj4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620907596, "uuid": "f43c2c3b-b6ef-4e44-ade3-0b5ae2080e90", "value": 422123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620907596, "uuid": "60ac18a6-ce2d-48bc-8b44-8a9753c663bf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907596, "uuid": "1be90844-9f35-450c-9c04-79fb1e1dc97c", "value": "Attachment-FEEN17.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cde846f-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911277, "uuid": "dd2a5c73-c9ed-4047-be6d-5115f41f40bc", "comment": "Malware payload", "value": "3246d82eb1ace9608b3c314c5ea896fa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911277, "uuid": "9801a795-838d-4c6f-ada7-26c71dc29f93", "comment": "Malware payload", "value": "05796430f98e527fc4dadf24139dfcb9bf2b31b44a3055f914ddd18333949472", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911277, "uuid": "5f0e092d-c2b6-4972-bea8-f689ae427074", "comment": "Malware payload", "value": "dff07a6122eb16d31d97493833e9b8f97fc6e764", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911277, "uuid": "f526bcc7-0737-4ab0-9db7-9021d485775e", "comment": "Malware payload", "value": "4706cd8f82d23efedab7f0a7da3fb20f517ae37683ca9f749fd3a189f3e0c9d58cef7c11c47ca58054af862d1ee6a2d5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911277, "uuid": "9bcf7692-d6d4-47f5-8d48-39bc96074a78", "value": "B83302DFE414A5A7C39B53020FB5A7A206FD760CE23092A49359C2F9D6835D2C52ACF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911277, "uuid": "556c98cb-20e3-47a9-93e2-4f7efcb613de", "value": "1536:fxTuDqsF1Cnc3P57oj2+nC6uxkL4yx215C:fxTqqsF41j2Pxm451Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911277, "uuid": "15e1f373-c7f0-4699-8901-5ab24def3fa9", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911277, "uuid": "e9ef400e-bf5a-48b1-b878-7baf756fa007", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911277, "uuid": "2e290a56-c26e-42d4-909f-0f9029b7537c", "value": "catalog-710441658.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cac110-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874166, "uuid": "5df15d1c-f6dc-4ae1-97a5-ce9c29279db8", "comment": "Malware payload", "value": "e93468b4cfe59ad5d68af4daf3689760", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874166, "uuid": "17eaa075-2a27-41bf-8997-19e0d3f7af4d", "comment": "Malware payload", "value": "0587e7330bd8b640e1798b43bf536a55968c583bd80a6a388c06b49c6fe8d520", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874166, "uuid": "c19acb86-923d-48d9-b2b6-220570b1436a", "comment": "Malware payload", "value": "ac39c7b3ef78213c284ad51b09f8461c60a6e2a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874166, "uuid": "aad7e009-f2af-4a58-8dbb-f5a0a24edf44", "comment": "Malware payload", "value": "3e6c926a1fa7f167fc937cad42c15da829e889377ff74aa97578a2586aa33b711be73adf1842f92ae2fb1989353aecf1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874166, "uuid": "7486d231-8106-477b-b649-c9e0a6f7d447", "value": "CF3312F3D202B2ACB64381494E8C5B47923B817066595EF18219EFA1D33D7170B51EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874166, "uuid": "0d7fea82-6101-4f35-a04c-7ad78e764351", "value": "1536:f/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBM7:XXKAXh3TCdOi+KSZ4WcM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874166, "uuid": "52a6f0af-c24f-40a6-9bda-0e7529bd9027", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874166, "uuid": "947dd250-e2e6-453c-9d3f-444c1e9bac30", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874166, "uuid": "8d415862-d3e2-4ae9-8d0c-1472ecdaa42c", "value": "statistic-648849942.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bf4996-b3bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620890943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620890943, "uuid": "bad5df10-a6fe-4ba8-b48c-49e9102d61f9", "comment": "Malware payload (NanoCore)", "value": "19d109dbe9203696382a0fff8c8712b2", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620890943, "uuid": "4ec266bd-38b4-4a75-9e52-923378b5f27a", "comment": "Malware payload (NanoCore)", "value": "059980c8a397a5ba2f10ab5744415455c9989710e34c39061a2c601b9760d75a", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620890943, "uuid": "5fd36980-b49a-45cd-ba54-1ca8dd984acc", "comment": "Malware payload (NanoCore)", "value": "bdbe44ed8fa049f5c336c78d2323c1eab6b6bd43", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620890943, "uuid": "55197019-ce39-44fe-b509-880a966c0e67", "comment": "Malware payload (NanoCore)", "value": "e9a8c8357153df36381ac107917c709281f0fa7d555023ecbfcbc120a3902730a0faa71e96c5ef3a98c55f6a76076324", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620890943, "uuid": "4aa93a17-611d-48be-b085-8a8708098599", "value": "AC540280F2A1C06BE8B30F3125361F568B66FD592DA11757372CBB4A36B71A2894F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620890943, "uuid": "bb76adf9-ee23-4729-9012-ab7c07e93097", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620890943, "uuid": "d163dccf-528f-4804-902d-484cd46c64e9", "value": "6144:jgORakBMh4zWZgpZYx9dM7+FbJDpMqxth4TVbe:jgIu63pZYxA7+FdDuCtCVbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620890943, "uuid": "799751fc-b66b-4d60-a2fa-2a5aec8cf418", "value": 284317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620890943, "uuid": "3626c4db-cbcc-4cad-bf87-463a64171503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620890943, "uuid": "08a8d7c1-208d-4b79-b98b-d5b0612d77be", "value": "NO19800800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6094a5-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867822, "uuid": "a75e2471-d880-44bc-95a9-deda78babedd", "comment": "Malware payload", "value": "0ceee360e1602a4ef5e92875a8449d69", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867822, "uuid": "3cf3d455-542f-4e67-a663-ae67823bcf5b", "comment": "Malware payload", "value": "0599f6ea3039fae9df7c90d099138886422d43f5112946be9af16f47670a386a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867822, "uuid": "cb684bf4-e299-4d2f-8c34-5fca2fc159cb", "comment": "Malware payload", "value": "642f13bbd11f36549748db2648b0fa8ea1204901", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867822, "uuid": "bbee6204-9774-4bbb-a291-3d203292cb1e", "comment": "Malware payload", "value": "79e29a19015dcd883a7c3bdc0ccfae810eff8f956e4626f8dbbf0f87b5555b765902e18e0d93b0fed91800aad61257d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867822, "uuid": "64bfefec-50d9-43c2-8df7-6123d8837929", "value": "A633F184AF5BF45CCB8373BBAC442F97AFB7026459DDD19867C3309D01C2E2616142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867822, "uuid": "76c03948-e4a2-425c-97f1-d22bc5adde34", "value": "1536:UAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSq:HpoAnd9gucKC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867822, "uuid": "5702db89-ae7d-45af-9667-e15309c83d39", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867822, "uuid": "fec2bdf9-0a0e-4f2b-875a-6324ffc95e00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867822, "uuid": "0bfdc149-013b-4b9c-94fe-29e10f6d4231", "value": "catalog-1889517066.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672cf48c-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867110, "uuid": "b0edc26a-5df2-4510-a242-eb6040c07f98", "comment": "Malware payload", "value": "72ac253a4ef892734b86e35096d48fc0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867110, "uuid": "20770e48-1be3-46b2-b00a-5782ec823cf9", "comment": "Malware payload", "value": "059dd7bc3eb3eddc4d2e978de2830055f96ec772f6fe187d8ba601dc442e1dd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867110, "uuid": "babdc72c-97c9-441a-a5b1-7d5ce55dd3d9", "comment": "Malware payload", "value": "f68137a65dd3180862fedc680f9eb9e9d643d400", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867110, "uuid": "09816e71-625e-4ab2-baa8-63a0d975725b", "comment": "Malware payload", "value": "8d8756e1731b5373cafe051fbf798e80e87029ae6e4a4e6a299d9f5c8ad6fd58c001345d3f90788a4637f5f8a0dfd3d8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867110, "uuid": "580940b0-a7d1-48d6-9010-e9e0fce36eed", "value": "D733E1C9EF5BF818C79373BBBC882F576EAB0224558ED19857C3309C1292E62561027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867110, "uuid": "28f4151b-e86e-4813-9856-5144cf0c23f1", "value": "1536:SAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YruPF:hpoAnd9gucKCfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867110, "uuid": "cedfbd05-a926-4bc6-b33b-e333fd4ca3e8", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867110, "uuid": "7b6ba9d6-b2bb-403f-978b-40961321b32a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867110, "uuid": "e2cfc34b-fc91-4eca-a64d-f52841e75684", "value": "catalog-1341149435.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b773dc34-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911054, "uuid": "4b4efac3-6e8e-431b-920d-c4dc6ba4d2de", "comment": "Malware payload", "value": "8da710dceb75f6c6c23d72789e6d9c13", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911054, "uuid": "b853d53e-5fbe-4151-9679-6964f5556a29", "comment": "Malware payload", "value": "05a407a5cd168a36e534b26290a61f5bfa86b416ece36466db279e770ac0561f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911054, "uuid": "bd45c16f-ee6e-4539-b9d7-30583fc89a90", "comment": "Malware payload", "value": "83ccbd3bce885d00fa345ca4a807fce34617e4ed", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911054, "uuid": "bb02288a-d518-4f4d-80a0-f95c2e2b9b73", "comment": "Malware payload", "value": "81097851f57756dd66afe473c02fb1a297bd3866d3b04ca44ab19cf8686c76cef7bf2945255c6e7c8beaf22528d1672d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911054, "uuid": "b9e0f1f8-0542-4ecb-8dd8-5d07345f5c11", "value": "FF3301DFB414EAE3C19B67015FA9E6A206FC7A1DE230C11CD31AC6F5E5836C2802E5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911054, "uuid": "1d4497dc-2648-4505-8b02-50d68cee5310", "value": "768:rqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L76OzzObaF:uxTuDqsF1Cnc3P57oj2+nC6uxkL7z2OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911054, "uuid": "6c3e9f68-b8de-4521-80b1-fb2a91f650ad", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911054, "uuid": "af1b311c-535e-4060-a06e-ea3fe827bdf3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911054, "uuid": "bd537231-9590-4889-aaa2-0f2731a5c41d", "value": "catalog-544143158.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b6f963-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873768, "uuid": "60e2f2d0-afe5-49e8-ab5c-04b56a9d1fbb", "comment": "Malware payload", "value": "be0054cd0f8c885c42b6158b14b7ea44", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873768, "uuid": "aa5b08cd-8419-4d88-a767-fb231539b5b1", "comment": "Malware payload", "value": "05a506e53cd93eae9c55d55536f1348a1e0d54edbc47f8fdcef4d32172943292", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873768, "uuid": "7b17c1a3-e6f2-42f7-bad8-6c588267be4b", "comment": "Malware payload", "value": "9fc162841409c7401b63e2c7c853c9226f1f427e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873768, "uuid": "704ab804-01b4-4aef-898a-86431e051837", "comment": "Malware payload", "value": "e94b6237398a3197dac23041be2459bf05983fdf105018ebb905a5c69cb144ea545efb47805e84bbc100aa5aeac92632", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873768, "uuid": "bc2e2f62-c87a-4576-8a51-675d81bfc68d", "value": "5C3302B6D24275BCB643844A4EDC5E2F423B807052284EB1811EEFD2923D71B1791B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873768, "uuid": "a0ed41c7-e555-4385-88a4-98dba5ed64be", "value": "1536:j/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeVuX+:DXKAXh3TCdOi+KSZ4WauX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873768, "uuid": "0754dad4-0080-4414-b064-d8f152db4748", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873768, "uuid": "28e97bc2-a699-4cbf-a6f4-43e3a0f993b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873768, "uuid": "1f3ccb67-a1a4-4402-a1f2-dbd1d59702ff", "value": "statistic-342530844.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355ba3bb-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869174, "uuid": "37b1a6f1-36eb-4cd5-ab82-462a9edc116b", "comment": "Malware payload", "value": "3031d7d7a190eb71b0522133ba94d83a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869174, "uuid": "0fa220e5-b8d0-4806-8aa0-c5fc3ab3eb7a", "comment": "Malware payload", "value": "05bc6ddc5587e9bf05d992adb974c6b861113a98ff97839719c94aff9c616f2c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869174, "uuid": "75e94ade-015d-4893-aaec-a0b983ef4b5c", "comment": "Malware payload", "value": "cfd59e4e50c744efae25b7a4c5838173418c8bd3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869174, "uuid": "454478f1-61dd-4151-89fc-305ac5c239de", "comment": "Malware payload", "value": "0416a6df91cabf688cace4fccc992b75706540e2fb6b9779047b01c03512e84e151d6389be47a6b5ab4a3696f352cc86", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869174, "uuid": "9b8c4b94-9fcf-41aa-ad97-8f6cd3217fc8", "value": "3833F2E473FEE510C6B1C2B0A4D2A5893A4F3D91897D5DEA0CD864693F831A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869174, "uuid": "0dc88a31-9833-40f6-9d9a-bf84d45aef81", "value": "768:L5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8dRVIWgX:L/czJJSI7r3Pwh8tv8x8b2nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869174, "uuid": "ac58c38d-78f0-453f-ada9-5efa2cded6a0", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869174, "uuid": "aa1a0f68-a62b-455d-af69-7b56426533c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869174, "uuid": "0db15f5b-9ae0-4a06-8243-4529707eb53d", "value": "diagram-1014585236.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cbfba1-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873232, "uuid": "5c7f2501-56e9-44f6-8491-7d978d211bac", "comment": "Malware payload", "value": "3063c3c2d219b5d393f7e8cfff43653d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873232, "uuid": "ca133828-9f48-44e0-a425-657266e7566d", "comment": "Malware payload", "value": "05c2f917b7f48d770c8ba3fc8d0bfc92a1dcbd559ca955996e77a61e089b17c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873232, "uuid": "d177638a-66c5-458d-8b68-36bc9545f4de", "comment": "Malware payload", "value": "a3c623c25ad99e61116f41755c105192798fa9c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873232, "uuid": "5455d07e-3dbd-46d9-b8d2-2b1b6a03ac4c", "comment": "Malware payload", "value": "1ff786a21c19ebc4b5e5e647f8861dc81d50fc9afbfc0f47f1b84356c933741f1389325b296bd099d66c6b9a4e44d429", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873232, "uuid": "d5d36bfc-ef8b-428d-a06c-d201179c1a5b", "value": "CC3312B3E643B1ECB743C5CA49CC5E1B433B827056688EB1C61DDEA1923971617417AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873232, "uuid": "e08ce270-b3b1-4436-bd86-85ac1b7b2644", "value": "1536:wp/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexH8Y:sXKAXh3TCdOi+KSZ4WU8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873232, "uuid": "5d2ab9ec-524b-453e-a481-25a4977743bb", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873232, "uuid": "cec758c9-69b0-4a6f-aaee-d1343eb7d0d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873232, "uuid": "af9d035d-bd41-4c1f-b7fe-7ab3c220a202", "value": "statistic-1974622501.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59abc76-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871188, "uuid": "ff582512-5143-4b22-88cd-bb5bc63b5462", "comment": "Malware payload", "value": "2edbd52fad629555661728287a30a568", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871188, "uuid": "c6b49440-624c-43a3-9f5a-36c3a4e5a959", "comment": "Malware payload", "value": "05cec2a5da27a5b744d5bb3af9764366ff1461bf964470a99a029318a31d1034", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871188, "uuid": "795533b1-5ac2-44c9-96d6-414d4b973349", "comment": "Malware payload", "value": "d1ef55fbe7781fa654b2b338f6555130ead487c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871188, "uuid": "ae275458-f879-4209-83f6-3536d033e62b", "comment": "Malware payload", "value": "db99237dea16717dbfece17f655d72af3677181945b6f87fbffb5760706b5685342b9e2031e31e772553b9e81515f74a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871188, "uuid": "58431510-1960-4766-9e20-129696ee51e5", "value": "FD3302A473FED510C6B2C2F0A4A2A589364F3D918D3D9DEA0CD464693F930A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871188, "uuid": "f0729cb9-13e3-40b2-97f7-613e146d2065", "value": "768:T5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8ZT+VIWg4:T/czJJSI7r3Pwh8tv8x8Zq2n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871188, "uuid": "2bf3dbbe-f8dd-4262-827d-6c48f0879bab", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871188, "uuid": "e2908927-dcdc-47f1-9495-1d479792b1d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871188, "uuid": "4fd23ea5-c3fe-4ec8-b4ff-5841b8199fc7", "value": "diagram-482602918.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4456bafa-b3c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620893251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893251, "uuid": "75f9229a-d8bb-4bd5-b6f7-5b1175420731", "comment": "Malware payload (Dridex)", "value": "20ae66c404bf8c8403174eb5f7ec1ed7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893251, "uuid": "9c479925-9822-4847-b909-c24b1277967a", "comment": "Malware payload (Dridex)", "value": "05d0d04e2603f62f4c5a6568325141c79d247f1bd0ee90ac3c73ce7682489e6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893251, "uuid": "57fd5e20-98f1-4bad-9ddf-a40767c48ffc", "comment": "Malware payload (Dridex)", "value": "f0880a7baa9e2456494990fed06a601c62251363", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893251, "uuid": "9b4e8df6-de36-4250-91c8-3589a692e7a3", "comment": "Malware payload (Dridex)", "value": "81b445d09bdfe6875a8996e0b353a027ea1ca453e7cde9e9a4fd0d25a4c0ad817b739fb63352fbf1abc290fab55e032f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893251, "uuid": "95d88408-c572-41c3-b03f-277c50438614", "value": "AEF3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893251, "uuid": "8dede280-005f-43c3-a150-7ae5f6bf1a8f", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893251, "uuid": "4a8ef24d-0e10-4e0a-b345-616c9eb5ed6b", "value": "3072:sar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Os4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620893251, "uuid": "f20f9cd5-dd76-4616-a596-2ec592d350e9", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620893251, "uuid": "20043ddf-8325-4355-a7f9-913a897a0c87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893251, "uuid": "53067c8f-aed6-41a5-92d8-b63870948ae1", "value": "20ae66c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c953eb-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867210, "uuid": "43b80467-ba04-44a4-80e1-688740fa6349", "comment": "Malware payload", "value": "e0b739ea431918bf5d5659f5be92aeb2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867210, "uuid": "86d382de-b108-4647-997c-75f0fd068df7", "comment": "Malware payload", "value": "05d1f61f0af1f09176ef5da19afb9483178c361be7cb0e6a98d99735fc5433e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867210, "uuid": "658294cc-3d2f-4650-a20d-8ab90a7bef69", "comment": "Malware payload", "value": "f46e00b1e901b5a41483545151d2e3ad6f4ff57d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867210, "uuid": "b51dbfc1-0b5a-4347-ae7a-84e5d19c138d", "comment": "Malware payload", "value": "12c439ca7f12edae385a7c9ce645141b8ed80d49221730ad1dd523d563b9fe5b42337ac4edd0aa0e54072c67cc1e36c2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867210, "uuid": "f45157f2-6d07-4497-988f-0255bba68aba", "value": "4333F1C8AF5BF418CB8373BB7C882F936EBB0354649DE0955AC7319C0292D27661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867210, "uuid": "b86ede48-2089-4a1d-8a68-b1efd0289c3c", "value": "1536:9AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHid3M:6poAnd9gucKCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867210, "uuid": "a6e0e106-f75d-4664-9166-f56e30848079", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867210, "uuid": "cecb65ca-ad72-4d59-a604-bc6d131b3383", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867210, "uuid": "d3572ada-286c-4258-8a99-e3dfc03f677b", "value": "catalog-1410072589.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc25a4f-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911735, "uuid": "e6d458ce-2937-47b4-87a7-08d8d59bc2a1", "comment": "Malware payload", "value": "eff3a01022dace985ea55d30e8efb5b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911735, "uuid": "c0250c1f-4563-4b36-8e8a-b76213007ecd", "comment": "Malware payload", "value": "05e9d11752f1dcac2233ab2f6a45e1fc383000f3b1d2917ad1a6c26fa6401d3f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911735, "uuid": "a882837c-37db-4bed-8fd9-0074e4fbea01", "comment": "Malware payload", "value": "b342474e43548fea9f828595ad98bf027bd48697", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911735, "uuid": "9145bff1-fd3f-4dc1-8887-909a0efb7ad8", "comment": "Malware payload", "value": "23e9c3f50dcb8b3f82605e9d5b561c5329e56976f74e154b8b134e37f866e2aaa4ba31aca977e29ea535993660d58a0d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911735, "uuid": "61597b12-32eb-4a48-a972-503d80ff516c", "value": "013301E132D7C53A80C245F6F92B69DA66A78FCDF930D0D06D9FDE0112D2165AE9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911735, "uuid": "1bdea979-2586-4f44-ac11-107b01deb7d6", "value": "1536:sEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnm:ZnBrX5Eg5Enjq3axWIfkNwYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911735, "uuid": "47b7d01d-3008-4448-b58d-37f65d25cfc8", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911735, "uuid": "e54452b3-40fb-4ee3-837a-857324a7ab00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911735, "uuid": "0523b0ef-5073-439a-bb26-e6e307cc303e", "value": "diagram-103261849.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9628537d-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873202, "uuid": "1639212c-7e62-4bd9-a9b2-725833bb7318", "comment": "Malware payload", "value": "b2c1eac2c16221ff5ff5f766920ebf94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873202, "uuid": "02999c2f-cf8e-4ea1-af13-412deb35267d", "comment": "Malware payload", "value": "06023d4519128595a9463d801b644c8fe7e662d79ad5842d4fa7e83bb87fc353", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873202, "uuid": "f7c05cae-e86c-4c0f-9e8f-4e97afddbc90", "comment": "Malware payload", "value": "7ffde509b39bb41ef799b5cc55c0ed348af6f7c7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873202, "uuid": "253c4c74-ff9f-431b-bfef-b71994282634", "comment": "Malware payload", "value": "ffead9577cd8b1f247e506d3a3f8e7651817fc2f56d3e5a92e41e878d12315639e085aa8afe707e9e7edae218885ddd8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873202, "uuid": "c1a001d5-e06d-4718-93be-a76fa625339a", "value": "C93312A6D213B1BD7243C4898ECC4E6B523B813056689DB1C92DEDE3D23C31E0B4266B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873202, "uuid": "755fbcce-cca2-49b8-adbc-c7df26d61911", "value": "1536:rw/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeI85:kXKAXh3TCdOi+KSZ4WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873202, "uuid": "546ecb03-4d99-4de2-8f39-8cc31b3d4890", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873202, "uuid": "41a0bf92-b11b-48fd-89d5-890dde206a5c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873202, "uuid": "43455b5d-0925-428e-8665-a9050e8afd26", "value": "statistic-1969877526.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e325b4-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870618, "uuid": "298fbb57-d9dc-4c44-b374-c69fede616f8", "comment": "Malware payload", "value": "de98d063b8bc2ec37f52c7b0418427de", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870618, "uuid": "46220f93-4e53-4b5e-9146-a704297f38f9", "comment": "Malware payload", "value": "0609349abe2c56414eb4c7b2c8de6d6cbe7861fb782b6c08a5ffab1afbdaccfd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870618, "uuid": "e02941cc-e0a7-4951-8392-f777b2946556", "comment": "Malware payload", "value": "2977aab71a3ad49dd14c5f52346ac7528d48ac9d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870618, "uuid": "b069fba4-6fcb-45b7-b426-e380b7da6dd9", "comment": "Malware payload", "value": "d02e4a93b062022cfcb8136f9f7e8b597a243fad8da02b3ff1c1d67975f436f7427c06143843c5c28a65915088637bb4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870618, "uuid": "f8817645-bfa4-47b6-8480-c253100c99b6", "value": "F333029673FDA910C9F1C2B0A4E27188374F3D928D7D5DDE4D8894793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870618, "uuid": "a27a2a54-cb2e-4a83-bd37-d7a4f1ee9b80", "value": "768:q5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwn:q/czJJSI7r3Pwh8Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870618, "uuid": "be038ce9-36a6-4889-9333-524e32d630fd", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870618, "uuid": "2bd835f7-e794-4561-9ebe-5ecb85755b22", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870618, "uuid": "d19b9a1e-dc8b-488e-9167-63ef630993d7", "value": "diagram-2027841916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c67e0de-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916914, "uuid": "3e8f0054-8ac3-4b24-b924-cf0fe796f501", "comment": "Malware payload", "value": "9acfcb9cb6aa512ae3c2ec17da478146", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916914, "uuid": "ee7c6597-4b46-455f-aa3a-f3ee92dc7372", "comment": "Malware payload", "value": "060b90e192ce318464981ea0f9f5fbd5f44a5c2082eb69fe533e411c0ad09493", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916914, "uuid": "1cfb5e55-329d-4cbb-894e-c48376e7db0d", "comment": "Malware payload", "value": "0327ac2dda64c3dce69991e784bd6cd0498307b6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916914, "uuid": "e1e860ec-b24e-495c-a31d-eef8c3888ba3", "comment": "Malware payload", "value": "2cf731ca19983aab6b00b5b438b9fb717e1b4599bffc87f0cd505164e844ef407615a5556eb50a15593b9a8328502c31", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916914, "uuid": "7371e024-c446-4436-9885-33ba69ff8c00", "value": "703302CB5A13F6D6C7F9EE67044A62D4A39FC89D30247C14592E258281AB158C4E7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916914, "uuid": "2fd6e6f0-dc96-484d-8bc3-56ab538a4258", "value": "768:no4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SqEseL4Q:deKCVQbp4LTaI7ZaiNQMIXaE7Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916914, "uuid": "5f6f7ab9-f6eb-4c41-b72d-186a3e053d40", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916914, "uuid": "606696f9-21b1-48c9-99c2-5bf2e5d0331a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916914, "uuid": "e48140eb-f5f8-40ff-94ff-0ab16722cd03", "value": "statistic-876688636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f318ee-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868833, "uuid": "9a7b8545-77c3-417b-996e-91adbbc90a9e", "comment": "Malware payload", "value": "da468ded40a206750b2ffb182db0c31f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868833, "uuid": "abad03ff-1d64-4467-a30e-afd977a128ff", "comment": "Malware payload", "value": "061c62c2ba5627ff7ada8ccb37ed2c77ca8cb5b6d6b66ae5861a4b669a1c5d2f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868833, "uuid": "ab1d653f-49ba-4d32-b5b8-2fdf41aa3502", "comment": "Malware payload", "value": "4aadcad57cbd7cc5a89da9d4122a11449f1b591f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868833, "uuid": "c4a93bc3-8c5e-45fe-af24-b4c7d5377489", "comment": "Malware payload", "value": "791ddb04ffb0071834d4607b3fbd524f420a3c690ba1c969a94d8eb8f8e5217383dc75b4ddce49ce3ca12ff56f511202", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868833, "uuid": "6136b1a3-55a8-4e00-9e32-4d4f514ae1c7", "value": "3A33F1C9AF57F818CB83737BBC582F977EBB0254649DE1955AC6309C0252D33661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868833, "uuid": "bbb7918d-82dd-4a3e-885f-9ab39d82debd", "value": "1536:/AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQ8W:YpoAnd9gucKCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868833, "uuid": "41c8e56d-f323-4de1-8b12-f6fece7900b1", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868833, "uuid": "9d084e7e-8a9b-4590-a328-b7d226931b47", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868833, "uuid": "203da461-75d4-4b6f-b9a5-2d848d7ff364", "value": "catalog-724918747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6267f4-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909879, "uuid": "c22b081a-7b4b-4c20-ad15-09821b4ba1ba", "comment": "Malware payload", "value": "1740ecc5118073ead3e7cdb1ed31620d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909879, "uuid": "f6645436-9e53-44ae-9ea1-86c7ccb598fd", "comment": "Malware payload", "value": "061c9865aed1e851507cde6af295198bb8fd2bd7b866f4b7e13ebc4e1fd1d9a9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909879, "uuid": "d70e071f-b91b-4089-a70d-8661b3c81bfb", "comment": "Malware payload", "value": "52948059f472232e7b6f9699b3ab38b7ff52d92c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909879, "uuid": "5050b104-0211-44fa-b499-4a834e91785a", "comment": "Malware payload", "value": "5bd2ba1b54f84ec6cfbb4e5b24d356e38ed6f0b4b683142fb8405d1c3877b1a461060747b415ae315943c567da686852", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909879, "uuid": "9c2dc962-fc78-4baf-860c-19b105968249", "value": "3C3302DFD409EAB7C39B53010FA5AB6202FD754CF130A6689355C2F6E6831C2857D9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909879, "uuid": "05e724cd-cc44-4b38-a30c-d747293af463", "value": "1536:0xTuDqsF1Cnc3P57oj2+nC6uxkLlyx2ih:0xTqqsF41j2Pxml5ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909879, "uuid": "c530a031-77fd-4b9e-a771-f262a2de4117", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909879, "uuid": "6e7293e7-c2c2-4f64-b2c5-4a008370f1a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909879, "uuid": "72a4fc05-e439-4eb6-8d79-3de09001f340", "value": "catalog-1580555006.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402746f3-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912142, "uuid": "6a4dd898-19d3-4ec4-abf9-b41f09d00b66", "comment": "Malware payload", "value": "03f201791a481b808fe4198cd66da598", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912142, "uuid": "938542a6-ebc5-4e03-bc1f-ba9665d6f23b", "comment": "Malware payload", "value": "06322a61cde0d67fc9f6065ecadc4e22c72b15eff99f5428945cc1fa6169d954", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912142, "uuid": "c56b8def-19f4-461d-9bdc-9b29ece40a5a", "comment": "Malware payload", "value": "80a8c692a46a223b2a868a830ba3a7b160f23927", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912142, "uuid": "205bb292-d49a-42a2-aa2c-a9d37d5a96e4", "comment": "Malware payload", "value": "d33384cfe9e13863cf19a55a6fdd3e1453dd5a30581238301e787f091a9138dfadfde06d9cef5cf0b6dfa8535f1fc16c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912142, "uuid": "f8c52e1f-e63d-4bda-a085-2224146a84a0", "value": "393302E232E3E17AC4C509F6F43759DD96A78D88F93080D02E8EDA5122D31B96D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912142, "uuid": "d1ba3d1c-a6af-4796-a812-e3a866089cbc", "value": "1536:QEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweH6RN:VnBrX5Eg5Enjq3axWIfkNweaRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912142, "uuid": "1d6d8001-f1dd-4d5f-bd60-b48f032a25be", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912142, "uuid": "09411090-2e10-4d46-81ad-b008fdf43eab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912142, "uuid": "ed03df97-5eb8-4c89-a148-d6d4e9b1962d", "value": "diagram-1403023507.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94905c5e-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868045, "uuid": "c8245078-b81d-46f3-b4bd-d6a394535f51", "comment": "Malware payload", "value": "092e2d61b82768ac4db5a126c22cf9a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868045, "uuid": "7a44867c-7238-485d-8626-a770a7f5023b", "comment": "Malware payload", "value": "063849d8bcededd9f73d910e73b9f04c27a75634113a2d65276ee95e20227400", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868045, "uuid": "5ba89ec5-6d42-4b47-952f-3fb21f6d7d15", "comment": "Malware payload", "value": "971ca6a549c51fd4dc5e18127daee5913d744be6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868045, "uuid": "71dcf6f3-8f44-43f7-a292-daba6b8f54c2", "comment": "Malware payload", "value": "e6111454ca77e828d23ce10e6ac95a2c27f8f2110b33c7c82f475ef3badf12f3d43d12713c964780c92dc526ab7affe1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868045, "uuid": "8bc7e9c3-9ba0-45a1-939e-1d69fda8410b", "value": "7233F1859F57F858CA97637BBC482FD77EBB122464CDE0941BC331DC0296D2626242BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868045, "uuid": "dfa60ded-e66b-4e11-8d83-2521a1988738", "value": "1536:gAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHimi:7poAnd9gucKCmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868045, "uuid": "ecbf5cbe-8f0e-4f46-8934-63eaf873a51d", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868045, "uuid": "2154ee9c-a94a-48c7-b612-cc7aeba6d04a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868045, "uuid": "fc686229-2c5e-402e-a0a5-69683188c659", "value": "catalog-2070947655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438da499-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909141, "uuid": "34b37271-3b3f-4b6a-a22e-84d400a817e4", "comment": "Malware payload", "value": "898a23b82573bf50dbf0784d498a3e21", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909141, "uuid": "1a7ec7ea-1d51-4be0-a1b6-f41df81fd123", "comment": "Malware payload", "value": "063b482fa28e289d8609564099277844c2113f596ce3dbe3444ce73e94cd91cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909141, "uuid": "ba86ff61-c9c5-4f42-ac63-f81fe55560c7", "comment": "Malware payload", "value": "c6f6171feae7992874c9f023b21ecef54a472736", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909141, "uuid": "111da5a9-1bb1-43df-b452-41711f572183", "comment": "Malware payload", "value": "903b25bb37935f22f192eef88b63f5fdb5b68fd4c9df66500828c100ea523af8f1f0fbb8cd99b4b658e4b7c5f5f294f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909141, "uuid": "986dc4c9-7ac7-4ec2-b3cb-19ee07116eb2", "value": "1C33029FA404FBA3C1AF63016FB6976205FC765DE130C0289359C2F1EA872D2817E9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909141, "uuid": "9f6b1197-bc81-4a92-af10-d0fa04da42e0", "value": "768:eqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMpp:PxTuDqsF1Cnc3P57oj2+nC6uxkLuXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909141, "uuid": "3d562d1f-7b1e-4631-958f-d16ae6e986dd", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909141, "uuid": "385cde8c-68ae-4c75-ab2a-8a35797aa473", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909141, "uuid": "70c7acf6-c16c-4e1c-b64b-a759c4dbf210", "value": "catalog-115286518.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52841b67-b37e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620864069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864069, "uuid": "77ca442f-3551-4c7a-b8df-7f730a52d59e", "comment": "Malware payload (Dridex)", "value": "d893fa21372deb9fb283d24fc2458521", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864069, "uuid": "d88cca6c-fe75-4b2a-9837-8137b3be7d2e", "comment": "Malware payload (Dridex)", "value": "06454901fcfc22c30d272c84a4a4df53dfa42e89021b0040c78f689851a97c0a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864069, "uuid": "12a39dce-de90-491b-88bd-e83a3e1c719f", "comment": "Malware payload (Dridex)", "value": "636f0c3f697fdf774de907ca6b861f4b71f99be6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864069, "uuid": "12fe7c28-111f-46db-9812-a1f89ce1de5c", "comment": "Malware payload (Dridex)", "value": "94047335f86fc6482cc3c299dc2a628dcd837e3753dcf8536a5a007aa69731ae8c979c184de3ed79d326655e116ef228", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864069, "uuid": "dd8d86c8-42c5-427e-b35b-7cc60771582d", "value": "20F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864069, "uuid": "5c162430-8931-4f35-82a1-1a73aa53d0f8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864069, "uuid": "00b8eb6a-8dd4-4550-8191-d8cb68d278f5", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620864069, "uuid": "1240ffa8-a1d9-4fbf-b68f-bc923066119e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620864069, "uuid": "e9563b94-f25d-4c10-a1f7-dd36202e141f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864069, "uuid": "b53847d9-6627-49db-af1d-78e872f3cf18", "value": "d893fa21_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f670da-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911051, "uuid": "a31ecf60-81e0-4c12-a8f3-ea59f5c13589", "comment": "Malware payload", "value": "d9603aba799015f7f786d0dca0e3df8c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911051, "uuid": "862bb054-f103-4a1d-b27b-0904333ac63a", "comment": "Malware payload", "value": "0648266415ce65753e5abb7eecd0b33bd826157a00b4ed802366138cb006233d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911051, "uuid": "c9486fc3-da44-4654-b6cb-3e9b8af9042a", "comment": "Malware payload", "value": "737489bcdb4219bd0a80019e3fe973596b75add7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911051, "uuid": "32099028-61b9-43bd-8ae8-1fdb5d8ebba0", "comment": "Malware payload", "value": "c46b14e081a202a1c30c0ddee508933a2bdd2fcd4fc3255ce8f1bce9ec3d0214e7ac4ef5282287635c294f2a5c466f60", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911051, "uuid": "bfa76294-b339-4512-b3d9-78b2a4a18e61", "value": "3B33019FD009EAA7C3CB53014FA5AB6202FD754CF130A6689355C6FAD6832C285799E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911051, "uuid": "f7324309-b627-459c-86d6-bcea5fe10d54", "value": "1536:zxTuDqsF1Cnc3P57oj2+nC6uxkLlyx2i4:zxTqqsF41j2Pxml5i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911051, "uuid": "c58c1a41-5bc5-4d9e-b778-69d7a34c01ba", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911051, "uuid": "9ed64c91-e73a-45f3-b9f5-aed7f7fef0db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911051, "uuid": "4787547a-e019-48da-bad6-4b5d7560c9df", "value": "catalog-538956278.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cd4f84-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870363, "uuid": "025004fe-3936-4b57-be6a-fb86a62ddcaa", "comment": "Malware payload", "value": "7f66641afe3784ca752d37665763dcfa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870363, "uuid": "d59e7896-1dfe-4ffb-8526-88ca4a93b811", "comment": "Malware payload", "value": "064bc403f2c3fd4da36513fce32110b578a61fa88d04130c434ff18046fd9133", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870363, "uuid": "ae614382-c4c7-427d-aa92-2a3842f20243", "comment": "Malware payload", "value": "a3e6d14397645009a035d45462f3210fcb88015a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870363, "uuid": "77d3f9e2-ae8b-427d-881a-dbb50487931e", "comment": "Malware payload", "value": "952d7607e9032d7cb9bbba570cbc3feb85ef10b5e88b2553df8e288425a5140eacdbeabf02593fabe7d26d12a1914604", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870363, "uuid": "6738fbb9-c9f2-4ac3-bd00-905bc8aed69a", "value": "D333F19537FDF510C5F281F0A4E27189374A3D618D694EEA08D5A5B93F921A0CFD52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870363, "uuid": "acac6671-7e88-434a-bd59-772f1d999aae", "value": "768:E5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJVNJJ4y:E/czJJSI7r3Pwh8RrJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870363, "uuid": "26eb5f7b-2b49-456a-b314-7f7f0d113dfd", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870363, "uuid": "2c42df03-4801-4869-9a0e-ea8fe9591597", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870363, "uuid": "404cefe1-7834-4d61-9569-0cf1c20f68a2", "value": "diagram-1848954672.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136555e4-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868258, "uuid": "9d09c24a-fb05-4822-88ce-332c2b06f7dc", "comment": "Malware payload", "value": "d38c9c146767bfba306dc4a53a275ee5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868258, "uuid": "b5763266-c48c-4c68-9c6b-9e0803a85543", "comment": "Malware payload", "value": "064d2093f13b5895a0c3b06867a1371cf77cc17d7e6e849bb42b01910288385c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868258, "uuid": "5e6cf647-e5a8-4e7c-bec4-24589735cacb", "comment": "Malware payload", "value": "6bf2faf031644ba4c17a1ac16678e3cc67483a85", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868258, "uuid": "cfb1da72-f8a4-4709-afb4-df2545c7b54f", "comment": "Malware payload", "value": "94d94177affa6a489f5ac2604d09d8c5f93885280a5bdfee59e0bfe1f4cb11dd4b3801305898b41b7dc786fdfcb71969", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868258, "uuid": "047c0b7d-0b71-4285-9cfa-f4cb21244f01", "value": "C733E184FF57E428C7C273ABBC842FA77FBB0264148DE1D95BC2319C0296E67561426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868258, "uuid": "6d0461d6-e7c2-454d-b9a0-b71a87be2fbb", "value": "1536:CAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGV7A:xpoAnd9gucKCoGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868258, "uuid": "041eca90-cc93-468b-af8d-369864848827", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868258, "uuid": "251b5e71-192f-486b-952d-b113a340b2b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868258, "uuid": "9bfc7a76-0ba3-40b8-bcd6-4f4835f2e568", "value": "catalog-263251058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc66a945-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870287, "uuid": "dad8a62f-d4e2-411c-b65c-10dc29d484e3", "comment": "Malware payload", "value": "724b047a8ffa9dc23e466eb739bdb2f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870287, "uuid": "c12f1129-c63a-48b8-978c-4b8624a9bb5a", "comment": "Malware payload", "value": "065349217cc704179e6493351f9ba6e9c133feeec61630fb42b3316e0b65b3ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870287, "uuid": "a4a2600e-5377-40e2-a413-f798ada06f35", "comment": "Malware payload", "value": "9a63fee6351541c8e1f90d4fa2d6fcd685dc7298", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870287, "uuid": "76159a9d-7563-4b40-bf91-9066e9794a2d", "comment": "Malware payload", "value": "d3eb167f860bddd4869237feefb99b570b6ad13c69780d015648b49d180cbce4bd1e1f316aa2836a6f55ec3d9b9076d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870287, "uuid": "0178fe44-d450-4821-a530-5687bcabe3b1", "value": "4D33029673FAA900C9F1C2B0A4E27588374F3D918E7D5EEE4D8890793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870287, "uuid": "081c43f7-0e86-4d5a-97e4-c1c62ba97954", "value": "768:Y5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoB:Y/czJJSI7r3Pwh8rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870287, "uuid": "edc50100-37ef-4919-b02d-fb2ec8c46b1b", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870287, "uuid": "9e20a9ec-f6fb-4285-8d02-225b481e23d2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870287, "uuid": "5e63c1f4-b737-4612-96a3-eb2fe0069ef3", "value": "diagram-1803267124.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e29b67-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912653, "uuid": "76ff1f56-1ddc-4e73-a65a-956f0da43dba", "comment": "Malware payload", "value": "980c7cbc97dcd4fbafee214a3cf7d7ff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912653, "uuid": "7f74b56b-dca6-4e97-8570-a9419ec73e4a", "comment": "Malware payload", "value": "06596d454ae807ab3cce9344419b17c5381f9945762cc720d594058b6cc69322", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912653, "uuid": "5df22f7e-1c5c-4519-b318-f0a56ad9d670", "comment": "Malware payload", "value": "016b8b1ae735c99f8d8c7d9b37904eca0b417b1c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912653, "uuid": "c387a372-f454-44a3-a386-b8b08f450cf6", "comment": "Malware payload", "value": "467f5047bc1759996804ddf5b749a85bc6c04047eed696c5d0ed66b22b4eb01108ba61f31fddcbb47cdba0d9ef0c2526", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912653, "uuid": "7a25878c-453f-4dfc-836b-937dafbabad3", "value": "F53302D233E3D23AC4C505F6F5175ED965AB8ED8F420D4D01D8EEA0022D319AEDA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912653, "uuid": "529544ee-4b1e-4d0a-9e6e-b2a6b0e4853f", "value": "1536:7EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMv:QnBrX5Eg5Enjq3axWIfkNwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912653, "uuid": "ab3cc45a-e7ce-42f5-b4a9-7821eb0a2ff0", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912653, "uuid": "00421de0-176a-49da-a1b7-033d77f00310", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912653, "uuid": "6f119e9c-1d32-4706-81ab-404a03b8d8d2", "value": "diagram-1794374039.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d50e08-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912318, "uuid": "a8a554b4-c88d-4500-8930-77447adff2d0", "comment": "Malware payload", "value": "fe6b3c757cadbbd0a523ef4c41b03a51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912318, "uuid": "5ce7518d-0f75-4fbf-a7a0-e1692a8602e4", "comment": "Malware payload", "value": "065b22049bb52e3f44326eda83fe729e1c68bc548fb8a6fd7d1a6f4c32b639ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912318, "uuid": "e3b58864-d8f2-4a11-8c1b-91e58c421aed", "comment": "Malware payload", "value": "0b0263af935f2cf67e793da0ac2f2a1258ef2b31", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912318, "uuid": "0e44fb77-5ac5-414f-bcc5-427a4c402d07", "comment": "Malware payload", "value": "0d08f0fd55de4c49e436e3ef3e4f37df304505c232d7c9694d04df52ff709f3e7e28768216144b13ae610f98ded893aa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912318, "uuid": "f19f3d26-8b8e-4e0d-931c-d7677bc8339d", "value": "A733F1D233E3D13AC4C605F1E4274DDD69A78EC9F920D4D02D5EDA4012E31AAAEA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912318, "uuid": "bdd11281-5a2d-42d6-bf93-b78b663b3ae6", "value": "1536:OEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMtP:rnBrX5Eg5Enjq3axWIfkNw0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912318, "uuid": "f225a390-e2ac-4b4a-9d8a-04adcd560c1b", "value": 51762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912318, "uuid": "7b572a5e-646e-4da4-87bd-b1d38f068a0c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912318, "uuid": "6f51f1cd-9589-4628-96a8-90c08f74544a", "value": "diagram-1533560634.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68994c2b-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913069, "uuid": "0f41423e-aedf-4ba5-aa47-56fcb2d1fea2", "comment": "Malware payload", "value": "2385594c03345317028a922b18db5f01", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913069, "uuid": "4b79a8d4-a716-4477-b705-01eda13db16b", "comment": "Malware payload", "value": "065e2086335cc0c79b640adcc24036f513f46b8388c4b2be1771a5455024b676", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913069, "uuid": "ea820fab-e629-441e-abd4-aa17a722a3bd", "comment": "Malware payload", "value": "25293d70c1fa94fdd6d4fc8c59d506dec9b8fc14", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913069, "uuid": "15eba2a8-1f19-4a61-b3c4-3e46df8d009b", "comment": "Malware payload", "value": "7aa84c88981e8f338fdaf22249377ebe4e970e06a5803a53de1d5a99f0b94d032f409897e95f58d2a5bf915c987e8170", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913069, "uuid": "1e93e526-e364-420b-8657-4f0c2aa5a381", "value": "8433F1D132D7C53A80C245F6F92B6DDA66A78BCDE930D0D02D9FDE4112D2165AE9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913069, "uuid": "8d2c12d7-02d8-4777-a43c-8061202f3db1", "value": "1536:FEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnG:anBrX5Eg5Enjq3axWIfkNwYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913069, "uuid": "1928d048-75be-434a-8e52-7e92519cb627", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913069, "uuid": "b0c1680e-d313-4dde-b7bc-d206fe98114c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913069, "uuid": "3ee2106a-54a7-47bc-9969-cf0ca07539ca", "value": "diagram-199676075.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e28154a-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914689, "uuid": "3bcb693c-83f1-4a6a-9f9e-62b3a4849ed0", "comment": "Malware payload", "value": "c4003afcae8023b79a5d73e0fd66aa64", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914689, "uuid": "d99bbf83-9bd0-4a55-aa7b-8fb1917091ef", "comment": "Malware payload", "value": "065e2587298a5ea819f0f2c34c037499015bdb07259a95af74a2b409735628c6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914689, "uuid": "3290c397-b53b-4580-816e-143f10a503d0", "comment": "Malware payload", "value": "db3c56d67e79cd8edaec30eb0b5e9a0205155446", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914689, "uuid": "5b20a200-8638-426a-a5ad-97bffaafd4c4", "comment": "Malware payload", "value": "83513e6c4b17072fc656845d0034a1331cce91e5cfa7a3b44b45a958db4213b339eeb0cb0d2111c8d6213f0510eeb783", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914689, "uuid": "bf4ceedc-f2cb-4a9c-afd4-28ae77402dd1", "value": "CF3301D66E23F6D286FEDFA3044A1395939FC89D31243C58182B658281FB15894E7FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914689, "uuid": "49fd7c9e-a951-4651-a74b-b5f2d5204295", "value": "768:Oo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkfDU4k:WeKCVQbp4LTaI7ZaiNQMIX0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914689, "uuid": "7fd77886-1b86-4c81-bd77-55d7a45ced7c", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914689, "uuid": "bce38d50-d1c7-4217-ab5b-7ad4ef9fe17a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914689, "uuid": "9ac375ef-4fd3-4e01-82b0-cd28ca2c3c19", "value": "statistic-1202926173.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d69c8f1-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915949, "uuid": "fb2c1091-53e1-4702-a602-92776f6136cf", "comment": "Malware payload", "value": "61e69bd39bf2535f5ce8f58a4ea35714", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915949, "uuid": "65007e61-c3fc-4600-a8c1-b8c8fe3c05c5", "comment": "Malware payload", "value": "0669b1aabd75e3364b5afaa32ca2b02c1406dce040ed26db1b9a2e1c72feb8e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915949, "uuid": "5b8c74b1-af21-4b27-9f3d-aca40ccef83a", "comment": "Malware payload", "value": "d083c901e78a32c8dc3b8a1ad3861f93c0b8db45", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915949, "uuid": "8796727a-bfa8-4c1f-9d64-cd473e7a63f2", "comment": "Malware payload", "value": "c1b483a2e98c8db1f42db7761b53b63a7d9843129f6b1456e9b8bd326b0a123312bb41efaf24ffe5fd7e63fbd1e7006d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915949, "uuid": "7b4bdc34-105b-4b77-ba80-83a3d1de04e6", "value": "293302D2AB13E4D38AFBEEA7085112D4936FDD9C31147C581A2A298345FB168C0E77CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915949, "uuid": "65d33ad4-9e94-48d2-b14f-f605a533c9ee", "value": "768:2o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6FyN:OeKCVQbp4LTaI7ZaiNQMIXwFDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915949, "uuid": "2a5430c9-7fe3-4703-afbb-3993102987b6", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915949, "uuid": "8aede8d1-3883-41a8-9f32-d171e144f7b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915949, "uuid": "fe0b153f-bf3c-4866-b56a-f3d2cace2679", "value": "statistic-250248726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcf670e-b37e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620864085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864085, "uuid": "4580369c-44ef-40e8-be4d-99a373e18e7e", "comment": "Malware payload (Dridex)", "value": "b0756000d1cafcdeff5650dc864f61d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864085, "uuid": "74cf8601-b72d-4788-b5b2-7fae704b7455", "comment": "Malware payload (Dridex)", "value": "066a4dfe1e59709f6ece540903e184718cfc2c1042babb74413839b9d40899e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864085, "uuid": "290631e3-1a35-457a-9826-7e5c4a59e5ae", "comment": "Malware payload (Dridex)", "value": "a3647bf2fa2effcdce4f34fb50ea1e58087506cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864085, "uuid": "47f22666-adaf-4835-aa04-ef104df74db6", "comment": "Malware payload (Dridex)", "value": "62c79467829a08666f5e7a63e5ba2b2257fd56994e0c1140f966755585eae08c578670820ec47abcc9ef71e70749f3f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864085, "uuid": "95a61f07-90f6-4c7a-a1b3-099bde7ba522", "value": "A6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864085, "uuid": "6766298a-6528-47c8-819f-3353c0d2d2f3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864085, "uuid": "507911fd-c263-443d-8f5c-56def6fafdf4", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620864085, "uuid": "82610160-43d8-4be6-ae2b-321b8de4e450", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620864085, "uuid": "429ed17e-e69f-478c-b4aa-05edfc6344d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864085, "uuid": "af84cf03-ade2-4860-80e0-15f071e358f2", "value": "b0756000_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d705f5-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869012, "uuid": "3377cce3-0b32-4545-b73b-578d6c1effb3", "comment": "Malware payload", "value": "2e1d1ff6838a22643015d2b7de46e9b9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869012, "uuid": "6da5f24a-d283-4281-8003-84b418c4a35c", "comment": "Malware payload", "value": "067b42c2007630da5deb2a59fb187b4f1e6dcbd5172af0782a6fbea01c4c8790", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869012, "uuid": "d6e73a3f-a567-41fb-a7ba-5a8d68004f17", "comment": "Malware payload", "value": "75654075b7ebd6b0e0cece031ffd5b0e0cefc83f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869012, "uuid": "3e2f73ff-88ab-4f4b-a992-f48649c9ac44", "comment": "Malware payload", "value": "1d78d504f86139f433d81d7181ba2d6c13e908aa052390986dbe2e502ce4bafd41227108326553ed1f4f7eeadff06c9b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869012, "uuid": "07d38f95-b78b-4955-bb56-a25a07840ab5", "value": "7633F1C4EF5BF858CA837377BC482FD66EAB126064CED09597C6319D0296E32631427E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869012, "uuid": "08a958fd-561f-41db-a994-7b3dc8a66273", "value": "1536:vAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3w7:opoAnd9gucKCQaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869012, "uuid": "8da9e59f-7b08-4c79-97bf-793475f11f9f", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869012, "uuid": "15dba948-0b4f-4f18-8ae4-bc95576ea247", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869012, "uuid": "7ad4f583-a0a1-4c51-886e-f58d76464895", "value": "catalog-88832844.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a097edd1-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870643, "uuid": "e79bed49-5359-4660-8101-2f3d2ac45d10", "comment": "Malware payload", "value": "63013e960755e950ea1ced47f0c1c48f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870643, "uuid": "6b19c74b-52f8-4385-96c4-47d88e173521", "comment": "Malware payload", "value": "06864b713385b6b248ba5b9189401234f9c5db0aec310445086ba63f63d45775", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870643, "uuid": "308f1980-9e31-4724-8bdd-4beb65b59bbc", "comment": "Malware payload", "value": "b86c94cae6ef0c0377d12a75c72ed1a61f652608", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870643, "uuid": "3edf0b6f-00be-4628-b191-0dbd2f282492", "comment": "Malware payload", "value": "41dfc60e6870f6bbf96014ac965c3cb8cc1061ca0d91b35e0f2580878a79465c0689d90af04f8c15f358e62938b7fb24", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870643, "uuid": "9dd3bc10-606d-4a7e-bd1e-0f7741d90e31", "value": "F333019673F9A900C9F1C2B0A4E27589374F3D924E7D5EEE4D88A4793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870643, "uuid": "9e2d90c1-b95b-495e-a692-4a209fafb0e4", "value": "768:p5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcs:p/czJJSI7r3Pwh8fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870643, "uuid": "8aa32c24-90b6-4a2d-9c2e-2372a09e942a", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870643, "uuid": "b8b021c5-fdd6-4536-88e7-445a9a57df00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870643, "uuid": "40608a9b-1ab8-4b1a-b7fb-d17dfb477b7b", "value": "diagram-2043230620.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9826386-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868644, "uuid": "a7924aa6-a388-486b-8bf5-ef713dbfa50d", "comment": "Malware payload", "value": "20f82ec5809fcf6f119f7243122a6e05", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868644, "uuid": "3df3fb43-b706-45eb-8029-68acd54b005c", "comment": "Malware payload", "value": "06895333a30fed1b0657a278ddad488065b36bb1534014036df38f20866296ab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868644, "uuid": "bb32e031-dae3-46a2-a65a-5ec9670b3099", "comment": "Malware payload", "value": "1d043af41b3772133795531bcd5dc9c4924043ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868644, "uuid": "c9324561-1e53-4785-a20a-22ac3fb1b7a7", "comment": "Malware payload", "value": "e675545a401bce047e1464ee047edc770c3c4610e2c4482ea5eeef74f2576e5a0da828e052823b9a66aa40f7ca1e66d5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868644, "uuid": "2a132d6f-b78a-4366-9410-c8e0103982e1", "value": "0E33F1C9AF57F858CB83737BBC482F977EBB0254649DE1951AC2309C4292D33661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868644, "uuid": "e27a1dcb-cdbd-476c-bedc-2fccbba62178", "value": "1536:uAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQMIq:FpoAnd9gucKC6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868644, "uuid": "35e37377-164c-4568-883e-f99e3cbad61c", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868644, "uuid": "79a01763-e87a-44e8-b8b8-12a1f3e8a53c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868644, "uuid": "aa208bb0-bf11-4ed6-921e-006b54932b89", "value": "catalog-563895770.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88780296-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916129, "uuid": "cae1bbee-f62f-4135-824b-25c1b4a21aaa", "comment": "Malware payload", "value": "3fb37095f88503056163c362ebece9c2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916129, "uuid": "3ed222d3-6126-44f6-93c5-4618fbde0961", "comment": "Malware payload", "value": "068a393aadfc4ff56ef685a7c9e0ef752514a0a31e051312c8c75ca8df5a3bb2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916129, "uuid": "e6fd752b-753f-4e04-a8e6-0d85821d86fa", "comment": "Malware payload", "value": "8d72d8a424c41e4b6f95f513c20b3dc64b40284d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916129, "uuid": "5051660d-92eb-46d4-a8ac-727e360cfeb1", "comment": "Malware payload", "value": "9eab08d5e89884aeca775632e5efde8ca11163a6c796e9a4d4fa2dff9e4fea788272907240394984f529d04478da313f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916129, "uuid": "ae2ef3bf-548c-4211-b613-f9161c947a40", "value": "813302D6AB13E4D38AFBEEA708525294936FDD9C31147C58192A298345FB168C0E37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916129, "uuid": "1e7b65a1-7996-4dc9-95cc-30a5cecd76ab", "value": "768:so4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6F50:AeKCVQbp4LTaI7ZaiNQMIXwFMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916129, "uuid": "0c5b4701-c373-4f54-ae93-3a36967af014", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916129, "uuid": "148429e0-64d3-4ed4-94a7-73e475edcdf6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916129, "uuid": "afddca41-e6cb-4ceb-8bb3-52e3b44a2742", "value": "statistic-398205842.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae65084-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911382, "uuid": "794b426e-663a-43ee-8b6e-63716ae60bcc", "comment": "Malware payload", "value": "e5457f1778937566f535cf5219e7458f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911382, "uuid": "08479334-fc1a-43cd-973d-0ba3c2ea0033", "comment": "Malware payload", "value": "06989d334226bda48afa6ca58a8c0a9e7187811d249118de5932105c8ef5cf8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911382, "uuid": "d0aa99f7-430e-4a21-b213-feffd6ca8a51", "comment": "Malware payload", "value": "d0bcbd6f07039f25b11f1f73976cc05fc17714e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911382, "uuid": "f4a17eee-b9f4-4108-8404-53a525c45fc9", "comment": "Malware payload", "value": "2ad286afb6e6ec6f41760b5776e54d19d09cbc42bcd6b4a01d2a3104cb8e7c6a23a05b461a49e49466e6f060f47106af", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911382, "uuid": "426e5e27-90cc-4a1c-a25e-0addb0ee635e", "value": "203302DFA014FE67C29B53015FA58BA206FDB94DD070D658C32AC1F5F9839C284399EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911382, "uuid": "1b8c6a10-310e-4959-bd94-bbaa65f5e73c", "value": "768:nqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LpDvNmR:qxTuDqsF1Cnc3P57oj2+nC6uxkLaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911382, "uuid": "0d24b96f-5dc6-4bce-bf31-7118a5c1458f", "value": 51710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911382, "uuid": "05f6568c-cce0-4653-b2d3-96083187d179", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911382, "uuid": "058b7c3b-dfbc-4649-a582-e4fc5088faa3", "value": "catalog-784265350.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04c15ff-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872790, "uuid": "7f59265e-3460-476b-84dd-f4798e499347", "comment": "Malware payload", "value": "ce832a221321ac4b9cd053c91e594c1f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872790, "uuid": "197372da-7413-4540-a9c0-7f656c382c0f", "comment": "Malware payload", "value": "06a16511dd38fb39c046d69f51ac0ea8c8f5d646fcc2db1fceb5589d764e25a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872790, "uuid": "e3955c04-83da-4cf8-bf96-bc88982f085d", "comment": "Malware payload", "value": "bbf6ba965104ed9b114ee899c409df4f69b149ae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872790, "uuid": "f9a1754d-12fe-4e32-8da7-a6454131c449", "comment": "Malware payload", "value": "4d9f7308851275979bf5803cdf761302c0202bf3d25dbcc5de41911567752ecd910f71514ac63157e2558cf056e6361f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872790, "uuid": "7b2e37f7-d30b-49e8-9e09-ae82e51e7db2", "value": "303302A2D312A2BCB643C049C9CC1E979377427026658EB2C56DFED1A33D7160B61BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872790, "uuid": "50da3b59-2299-4428-abd5-787df47930d3", "value": "1536:k8/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8L8qz:hXKAXh3TCdOi+KSZ4WBR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872790, "uuid": "129cd5bd-a0f7-4b94-9276-adafceb6fe7e", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872790, "uuid": "f8e82380-3944-42ae-a9bb-2de9460e381b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872790, "uuid": "fc6f871d-2582-44fc-be14-e00697bc0dbf", "value": "statistic-1708368724.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0f4d15-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912969, "uuid": "f77c87ed-96d9-458b-a466-5bd31c91790c", "comment": "Malware payload", "value": "7b554c5adbad15446abc53265825417f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912969, "uuid": "64df2f05-ad60-4369-a87b-077ab834f459", "comment": "Malware payload", "value": "06a748b3ceb798af673a3bbfc6a9bf2e3422966bcb00b795a546a31a3b73df5a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912969, "uuid": "b2555f02-8d6a-40cf-b8e7-901d00fdd28a", "comment": "Malware payload", "value": "abd3e97d2a66b45a3ca20b055d991cbb33dbd8d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912969, "uuid": "d97c932b-6ccc-4654-84e6-62bc795e1f27", "comment": "Malware payload", "value": "4f3eb10299154ce29b79496b19918c041ffe361e597e89c10c3fca6b70cff8379608762fd9c473573ace0e6bf1471727", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912969, "uuid": "c8c18f0f-c3a4-4d68-b6ca-0ed38711401b", "value": "B633F1A232D7C13BC0C546F1F42B5ADA66B78EC9E930E0D11D8FDD1112D3165ADB264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912969, "uuid": "aba80aa5-891d-4331-a350-1c7f3dd33695", "value": "1536:lEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwe2TH7:6nBrX5Eg5Enjq3axWIfkNwe2TH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912969, "uuid": "a615c0c3-021f-4968-9ced-9fabebc0490b", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912969, "uuid": "449432f5-5db3-4d9a-aed0-1106ae9e4f76", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912969, "uuid": "9ffc21ba-b1dd-470f-97e2-2cfd2a2c5fb4", "value": "diagram-1934584966.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb7b248-b3df-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620905752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620905752, "uuid": "5b11fd7d-dca4-4543-a7c6-f70c1cac31f2", "comment": "Malware payload (RedLineStealer)", "value": "dd6b0757811c10eb5ca6a12cb2abb247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620905752, "uuid": "672c9099-8a11-4f05-be2b-a7ca8d301a57", "comment": "Malware payload (RedLineStealer)", "value": "06b83e0f30baffd3bacfcd00b6c75c9e6fa90156aad429bcedfa0559a2d4fdb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620905752, "uuid": "b459be95-c278-4180-8341-d88a58746de2", "comment": "Malware payload (RedLineStealer)", "value": "b1831eb9719ee0719578fe8283286c01ee4fd6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620905752, "uuid": "bac61226-0a2c-477d-a4bd-735d16b010c0", "comment": "Malware payload (RedLineStealer)", "value": "cd2d34ffb13ca0e38e88c0f6d84ef2ad81baa31baf382a374ad8e4923c4a1412b0db63a0700ebba814c0f204a0727484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620905752, "uuid": "59551f50-be53-4e32-a3b1-4dd09491f5f0", "value": "F9143925739C9A21EABC4E706471623D07F5ADC72021E6978ED0BC9E3E3B78179446F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620905752, "uuid": "0a931a2d-469b-4fa8-8e4d-f66a2f7530c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620905752, "uuid": "c1b01ad7-3b74-4890-a974-2cdc0ac5a180", "value": "3072:ISv2YVjy3QWHyf5tyddrzuLVR2P0neGR6/IZG:UYWyPyjzuz36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620905752, "uuid": "d41348c8-f082-4241-b1c9-714b9d8831ca", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620905752, "uuid": "eb345483-7049-4a0d-a857-e6f1e04077e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620905752, "uuid": "c9aa212e-8570-4972-adbf-9baba150abff", "value": "06B83E0F30BAFFD3BACFCD00B6C75C9E6FA90156AAD42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f223682-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909912, "uuid": "dce8f40a-c610-47d3-a494-01e54f014d34", "comment": "Malware payload", "value": "1df3843bacc7f1b4fd0d2447dc39df0f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909912, "uuid": "01327551-237d-4fad-baa6-e77bfd16b4c4", "comment": "Malware payload", "value": "06bb37b2300650238d01cc46c74a032113a574cbd3e03f0eb043b841559b2d98", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909912, "uuid": "5b1cdab6-3e78-4e25-bf08-aa94c1425337", "comment": "Malware payload", "value": "cdffcef8cc2bb75aacd77fe3ec62689c0770161b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909912, "uuid": "37089e1a-7484-44a2-84a7-5ddbe35cccb5", "comment": "Malware payload", "value": "7e76e4b9645eb79dc47a63c85eff7cb4b4bc1d757b15926300a1a1fa252ff4cc8cf407bd822abe1ed86eb14701c651df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909912, "uuid": "66925540-7e28-46bc-9603-fe83785e10b4", "value": "393302DFA004AAB3C19B57026FA6DE720AFC765CE0309154836AC6F6DEC35C280795D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909912, "uuid": "af37db8a-dfc0-4079-9f81-4f9892023eaf", "value": "768:Aqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOmvW:5xTuDqsF1Cnc3P57oj2+nC6uxkLOm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909912, "uuid": "866f5412-430f-443e-8e04-9defea4debcb", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909912, "uuid": "5bed849f-8d4b-4bca-aaf2-f72a9a760465", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909912, "uuid": "ce6308b1-a592-4393-965d-52350bf2cff3", "value": "catalog-1599051471.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a78341-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872025, "uuid": "1acc04c8-fbb6-46ce-ba3a-714e05e2081f", "comment": "Malware payload", "value": "989366eb20155a4e1859592618d18245", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872025, "uuid": "b744bc6f-4e24-48d0-bde0-ad9b3143da52", "comment": "Malware payload", "value": "06c1c7a184a5c2dd56c22939af1975007bb8a79af7227a0e8499068e047605db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872025, "uuid": "0cc34bfe-f810-491c-85b4-6715f3144b29", "comment": "Malware payload", "value": "cdb0773af6199e9e5e47839a88029e50d02cd8a8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872025, "uuid": "2e705a1a-7c76-447b-b517-640378fdfb14", "comment": "Malware payload", "value": "cc24327c7144792408e651fe8a166943058b33e8d1e6df8935b8f2819e1f9d2e60e02e8f4a188f3e7fce1d497185e865", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872025, "uuid": "36468e2d-08b8-4a2c-bffa-de83a988ba88", "value": "6B3302A6D242B1BD7143C4898EDC4E6B5237827055689DB1C92DE9E2D23C31E0B52A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872025, "uuid": "b96ccf7f-7096-408d-b8af-030c52010292", "value": "1536:K//2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeIPC:cXKAXh3TCdOi+KSZ4Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872025, "uuid": "dba60947-7d3a-4d3f-b5ea-53df6fcfd45a", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872025, "uuid": "b49b0d09-719d-4904-a4d6-e768b198b1ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872025, "uuid": "5500a41f-9051-4070-9c46-84a3735b6a44", "value": "statistic-1156423119.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d209ed53-b3e6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620908951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908951, "uuid": "7c76c9ba-881a-46a1-845f-a2c9fac53fa4", "comment": "Malware payload", "value": "c1d2cd9f2fdffe0441ebe67dd97e85e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908951, "uuid": "56b52e0e-67df-4de3-aedd-ec5a9ec18fb9", "comment": "Malware payload", "value": "06cde79482a0a7b436fe66931c7e94446109a26ac697a8569bf800e092ae4c2d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908951, "uuid": "57942897-699d-4712-bb6f-60a1622b37c4", "comment": "Malware payload", "value": "3eb52458451c6f43ee6f4de8c0f7518a9e795afc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908951, "uuid": "378ddf6e-cda6-403d-bc1e-64504222a6cb", "comment": "Malware payload", "value": "c0869c5b9aded4ba00a4c9203e7b3bdd66cd54a3eae30cbf9db435a30299b13b4260cbc74da9f17e2327a5802955f3af", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908951, "uuid": "b3b60002-ed62-4577-9527-8a9adbf80198", "value": "2B3302DFA014F6A3C19B67015FA9D7A206FC751DE270D158C35AC6F5E5C36C2813A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908951, "uuid": "69c00fc9-74f5-43c3-b9df-f60d61fb3baa", "value": "768:Sqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7fLO:jxTuDqsF1Cnc3P57oj2+nC6uxkL7fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620908951, "uuid": "676c790a-2a6b-46a8-aa2f-0fd88f2ae29d", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620908951, "uuid": "6a280318-74ed-47a5-9c96-c930e9932f7d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908951, "uuid": "695eb40a-0c45-4cd6-9335-db7a6e5551d6", "value": "catalog-1009515739.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a992593-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909905, "uuid": "6e3cc057-55cf-4215-9f1f-ab2fc136aa91", "comment": "Malware payload", "value": "96485b233296a55d142209fad21551f7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909905, "uuid": "63587079-3d90-4307-90fe-44859fa15cac", "comment": "Malware payload", "value": "06ce1382da2ce70ec36a3514dac265448f6c88913a6291e8e6be1ce8433b23d2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909905, "uuid": "c00b6ac6-1dbc-4783-ac99-2679f4620cd3", "comment": "Malware payload", "value": "e4f0b6032b9480b0bcd7983c0d75740550820280", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909905, "uuid": "e98ed1e1-98dc-4bea-a275-73ec9348f705", "comment": "Malware payload", "value": "13e59f2288bf88f8802f9cf357d814d5de99524ad19f894a8b9757094c5c3cad48be88812608a81c92f8f0b29f6e2fbf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909905, "uuid": "cab90ebe-98c7-48d1-bf16-6f081c6e353c", "value": "203302EF9410FAB7C19B67015FA997A302FD7919E130E158C35EC6E5E5831C2817E8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909905, "uuid": "06948e17-87ac-4378-95b9-52c441588a3b", "value": "768:oqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L77L+:RxTuDqsF1Cnc3P57oj2+nC6uxkL7n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909905, "uuid": "bc8ecba6-060b-4766-880c-32e28c0d3654", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909905, "uuid": "f03004aa-39ed-49f9-be44-113e54f85ddb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909905, "uuid": "c3d63d5a-3d9d-4dc4-86a7-a19b6f644bd8", "value": "catalog-1596132353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415a431a-b3c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620894964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620894964, "uuid": "18240621-0aca-434b-b246-f091e5c7a1be", "comment": "Malware payload (Loki)", "value": "a02be8b3b487e37010c23aa0907734da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620894964, "uuid": "a2fd24f0-3f20-41e3-bd31-0b193f657942", "comment": "Malware payload (Loki)", "value": "06f1f460d06c7ab728a8744e2faae135da19e5f2ffac966974b66ec923c3a9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620894964, "uuid": "d1049476-a0aa-4db4-995c-a3be54fbb2d9", "comment": "Malware payload (Loki)", "value": "c0225736c18f5be0f2b13246997a31cbdee736f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620894964, "uuid": "aa0af581-d80b-4389-aa1d-3b30da586cf1", "comment": "Malware payload (Loki)", "value": "e342dffa2fedc8fbe069fff447eca1c58af5b160e2e52210f45b931ff98117550d693aea572553613c9f8f44bc2eeefe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620894964, "uuid": "61f10953-f431-4f72-b6af-19c0dd3994f3", "value": "7B0506802626A19DD4613BBDA13134E407B8EE27F8E94DD7429C7B22FDFF9111FA1921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620894964, "uuid": "aefe0f71-c206-4797-ad1c-13073ca35d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620894964, "uuid": "2fc6db87-1b62-4294-a088-4f9741fd5a73", "value": "12288:gnKxeayECYOs9Lc1J1ioVeVEkoXGHd4/dhea3:yIeacWLcr1iooEkoXa4Vhea3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620894964, "uuid": "276333bb-1230-48b2-ab2e-44d718ca2911", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620894964, "uuid": "b2b9a773-20e7-46a8-96d1-154239fe3ed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620894964, "uuid": "bacfec99-7bdf-4b46-bbae-2149d2fa37a5", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3043489d-b3a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620882480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882480, "uuid": "1e28b09e-502e-4215-839c-5062100a6386", "comment": "Malware payload (Dridex)", "value": "0e0754769e6f75ddee7e74d3dce0de73", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882480, "uuid": "1fd7a537-cc74-4491-b05b-845b2ac14f75", "comment": "Malware payload (Dridex)", "value": "06f3b6b151eb2741a7f32699594e72b056a15e524ac6d39761c4a8e507fc7d83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882480, "uuid": "8965a322-db92-4ada-8dbd-7ce799fd3f4b", "comment": "Malware payload (Dridex)", "value": "135ebf7bb3d3c79e0f55912957cd9ec96bd65b67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882480, "uuid": "152b263d-3491-4d94-bc8e-9733cb9d6bdb", "comment": "Malware payload (Dridex)", "value": "76f366def00614b7a2985d67d1e37756da5a23eb7f0d8de660f85ac1c5957942b2ba98e5ccfabcbfb05f70ad22ac8f2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882480, "uuid": "d7b2a230-4125-4f2a-a027-5de03b67ba0e", "value": "B9F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576A08879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882480, "uuid": "71d2aa4a-3bd3-4c98-9432-03ccd19e0c4c", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882480, "uuid": "237e2cf1-ec23-46e8-85ab-0c65b44bee9e", "value": "3072:Mar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:us4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620882480, "uuid": "b633876d-6e1f-4554-ab47-86844b976d2a", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620882480, "uuid": "ce6a6d7d-557e-4438-ab3a-cd159568a915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882480, "uuid": "af54b6e1-3f68-447a-be8e-b2d47e966c0d", "value": "0e075476_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb756e9-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868440, "uuid": "ac2f1bf3-f3db-47a2-85fb-379e0ce6bfda", "comment": "Malware payload", "value": "fbb25846c47cfa394810e122cca443f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868440, "uuid": "a22d70c7-e8b0-4a35-b6fd-d616adb116ad", "comment": "Malware payload", "value": "06faea4b1f72bc5aac200fc1913ce3baa335f14796162322e74b5148fecd1ab9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868440, "uuid": "e3370be3-8344-4c76-ac08-69d507108c58", "comment": "Malware payload", "value": "53f8ccea4fe055181e5c0a323fb4db977ac750d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868440, "uuid": "997db14e-bea0-41a5-b38d-af1dfb295f46", "comment": "Malware payload", "value": "5eb446e44b722ba26a605a96ba52f485d9ba1e8af0505d48752fae2a575de7d7f56df2842eed647bf7639286dd662580", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868440, "uuid": "3080da9a-1a61-4090-a0a2-f3f8aa21fafa", "value": "2233E188EF57E818C79273BBBC842F976B77026454DED5996BC2308D4287E3326102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868440, "uuid": "0564773e-91a6-4367-8beb-807ba19a3aab", "value": "1536:VAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqk:SpoAnd9gucKCIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868440, "uuid": "af9181af-a7c3-4a08-b30e-81b5dd960f69", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868440, "uuid": "a91b84f8-8a3b-4277-b7f1-c6b3d5ed2efa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868440, "uuid": "3a822bb9-a126-4374-b335-7693f2d75c6d", "value": "catalog-411533787.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e785f5e-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867149, "uuid": "5019dadc-0cd3-4959-a022-b5dcfecfd637", "comment": "Malware payload", "value": "91e810b5558ccac0c37d26d6fd4ad626", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867149, "uuid": "ccbfa96e-acd6-48d3-bd93-1f8fb9364ae9", "comment": "Malware payload", "value": "07050dcbd2c6f3651a29cd8dee2170991fda6f31b284d766a000631db8257ed8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867149, "uuid": "8b41ea33-f121-4cc6-8076-4cabb5d3fda8", "comment": "Malware payload", "value": "988830db37eb69845d9d881c7e012bb298bf1a9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867149, "uuid": "9f93785d-6390-4ab8-a14a-b94aa6f76234", "comment": "Malware payload", "value": "24fd780942aceee54341a36054aa38561b3ac8f8d44d810614fe227997ff716d51fe3c69d4604dfef4c1924afb2e9f58", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867149, "uuid": "a592bfcd-f7a0-4414-861b-b9cdbbb19ea6", "value": "2D33F1C4EF1BF858CA837377BC882FD66EAB126464CED09597C6309D0296E36631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867149, "uuid": "9884d793-7317-4eba-a8d8-5e735a52096a", "value": "1536:LAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3zqs:MpoAnd9gucKCQaD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867149, "uuid": "5307a049-99ea-45dd-852a-42189bb3d72b", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867149, "uuid": "122852c9-a6ea-431a-a587-1d6c2c9522ed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867149, "uuid": "ca72211f-394f-44c0-b047-11903b62da68", "value": "catalog-1359844434.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b709d7-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871243, "uuid": "5e2805de-401f-49ee-a1ad-587a4ccaf459", "comment": "Malware payload", "value": "37ed7164602a39edd5fdc834be424af3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871243, "uuid": "c687c39d-4458-4b13-a66e-544eea0d0cc8", "comment": "Malware payload", "value": "070a79a3b5f1d8bce0e7635260115d44839a1d2bcf64099547af05722227f5f5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871243, "uuid": "1979a918-964f-4c3e-8fdd-9f093a72f884", "comment": "Malware payload", "value": "98f793ce5c5d5d37f0b39a6ab8f2bb0e59476a5c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871243, "uuid": "c418976b-66bb-461a-8456-78c6b52ff135", "comment": "Malware payload", "value": "cfd09cc939d5756569334336812c48a4f79d817527fb3a5c4b23eef0643db04add8dec1cb5d0e6fa52bb77ae1d87c6e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871243, "uuid": "a46837ce-4797-4a70-ad04-163b727d79cf", "value": "8D33019133FDE510C9F2C2F1A0E27289369B3C618DBD99EA09D865653FC21B5CED52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871243, "uuid": "81f58480-6b74-4443-a7b1-007f3607c8df", "value": "768:K5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ4tbbf:K/czJJSI7r3Pwh81tbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871243, "uuid": "fd176709-6562-4430-ab02-ca960a8dc754", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871243, "uuid": "f487b03c-754f-46f6-8d32-5cef3b68a689", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871243, "uuid": "ba712d98-475a-4b69-b839-b8b61af30eab", "value": "diagram-521183704.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa35f3-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914841, "uuid": "74945226-ace9-4074-a5d2-598389e8c501", "comment": "Malware payload", "value": "e1648bed94d0e51c6de0f5ba56d678f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914841, "uuid": "63c371eb-1a19-4a8e-9adb-3a0220010474", "comment": "Malware payload", "value": "0713db792462c37bed415b58633bdbdbd68c21f0ed3c0e53774ba68246c907af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914841, "uuid": "5ac8afba-2bb5-47c6-988f-b6d6aca94b1e", "comment": "Malware payload", "value": "c5f80787253cf9f1fdf4c26abd4d284e32a04266", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914841, "uuid": "809c17c6-d459-458f-9071-58c83944a435", "comment": "Malware payload", "value": "6c22274990f734069108a2480e6bb13b92293ed8733904a24a7446d23bd07c17f171ffdde9852ba1666e3775e61ae155", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914841, "uuid": "46990ee2-23a2-4da0-a79c-0c5f6c939aee", "value": "5333F2C26612F5C78AFEDE63048922E9635F98CD32283C695D3E758281FB158C4E67CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914841, "uuid": "f348957c-2366-44f5-ab42-ee28fcd252fc", "value": "768:Eo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkTN:IeKCVQbp4LTaI7ZaiNQMIXUTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914841, "uuid": "0ff52e40-1ab9-46a3-8b6d-ba00a1b8963f", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914841, "uuid": "1940507a-4819-4f06-81ee-055e706d04fb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914841, "uuid": "0e0c9be7-4917-44b2-a674-74998743cef0", "value": "statistic-1349354258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64279f5c-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914350, "uuid": "d498e9fe-bd7c-4963-9504-46509c97d9d1", "comment": "Malware payload", "value": "30de242966207ee6ae24782b556cc668", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914350, "uuid": "152da96f-3a59-4d00-8c57-b9e533567b5b", "comment": "Malware payload", "value": "07172ae2e8e261d33e408ac31cd15a50952a97ee0b2139488fe7c11c23d4e945", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914350, "uuid": "99d9be7a-f123-4e16-b386-3154eb7e9943", "comment": "Malware payload", "value": "2d7f5a0969d198fac34560df7f36d9769d240ffa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914350, "uuid": "64a201e4-017d-4e0e-a1b4-f12df483b4fc", "comment": "Malware payload", "value": "ac5f5a56f1b211ca3a736ea8edf2c865e640ab50a4897cfa1377c674dfa15f2208f2e1fedf6a3d4bfd4b20bb15fcd8ef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914350, "uuid": "f188285f-8b22-471c-81d6-581ca9ac2a34", "value": "9A33F1D132D7C53A80C245F6F92B5DDA66A78FCDE930D0D02D9FDE4112D21659E9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914350, "uuid": "2297fddc-fe4b-4b44-aec7-4a4b98a05acf", "value": "1536:mEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnq:znBrX5Eg5Enjq3axWIfkNwYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914350, "uuid": "a97fd424-f080-4ed7-91e8-dc76a0f5a4a0", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914350, "uuid": "71f5f338-b2e5-44dc-a88a-9fc8d0ef81b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914350, "uuid": "a9acf2e7-d7c8-490f-a61e-52614f814c25", "value": "diagram-990142273.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06926bf9-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912045, "uuid": "887ec4ea-37b5-476a-bba2-e53b6897b9d4", "comment": "Malware payload", "value": "4e07032066c3ca560e504b594c99add4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912045, "uuid": "3004c4e2-2526-4600-83f7-b31b26a2a399", "comment": "Malware payload", "value": "0722dc4c9b9f1aa7e300b92de868375f67ef0b796fd6858580df76389301540c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912045, "uuid": "42db4a04-56be-4df0-9752-da5323b8d47f", "comment": "Malware payload", "value": "b9bf49b5c7c3f3883e183243bcba411cc712b99d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912045, "uuid": "a4e526b0-a3f3-4a1a-a11d-56c409a7e218", "comment": "Malware payload", "value": "51095efa9046ff34f20e8893ea408394cf6e278d0e98da3209e20509da9909350f806284228ecf3b20e598da1b8f21d9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912045, "uuid": "164700d7-5dd9-43fb-b445-70020ad6abc9", "value": "C433F1D233E7D239C0C505F5E52B49D969E78E89F530E4C05A8EDA4022E316AADA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912045, "uuid": "550d3b46-b665-4003-9559-a033f11fcbcf", "value": "1536:ZEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwbciMws:WnBrX5Eg5Enjq3axWIfkNws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912045, "uuid": "f366bc9d-32f2-4b33-870a-de91d635ef88", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912045, "uuid": "f7fc2ca3-0738-4b19-9901-7132e0b4e2ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912045, "uuid": "6d0aa990-6593-4640-a606-4f347bdbc6aa", "value": "diagram-1288047341.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4f675f-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870015, "uuid": "b088b9b8-b26b-4523-8582-52261ba8d3c5", "comment": "Malware payload", "value": "a68647f708222f73b621f738622ec5cd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870015, "uuid": "71a251b1-1113-4312-b3ba-17b58d07c516", "comment": "Malware payload", "value": "07286a0edddb8483d5773ef39eb2564378e3f41b8f7612d62b4e0587583c7f71", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870015, "uuid": "14dda225-98c5-4735-9ce3-08f46eb25857", "comment": "Malware payload", "value": "40ed5ae5bcc4c3d5188ca5ccfa1047336929d488", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870015, "uuid": "72709c36-2479-40e7-aaed-30980ac9a1f7", "comment": "Malware payload", "value": "832ea38e5805efd787d69bac5ef639070a15897ceedf4c50baaa4b561e30403270f6e92ce2aae83504ddb8f1398e642a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870015, "uuid": "b8a7276b-5750-451b-80a2-4ba1356160b9", "value": "1933F19537FDF910CAF281F0A4E271893B4A3D518D694EEA0CD5A5793F921A0CFD52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870015, "uuid": "fecc4b49-89f6-45ec-8093-63b209244583", "value": "768:c5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJrJJ4W:c/czJJSI7r3Pwh8RLJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870015, "uuid": "5903562c-cb8b-4426-a3e7-e9bf7ca07ea8", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870015, "uuid": "0cf9e017-88e3-4ffe-b3b8-7c19b3fc8987", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870015, "uuid": "2ebb0ffb-7bb6-4167-99fe-857314e83d0b", "value": "diagram-1590439122.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19395af6-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916372, "uuid": "919c436d-e8f4-4217-a85e-4e7c8eaeeda2", "comment": "Malware payload", "value": "78888737754b753de36da3de884cdd44", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916372, "uuid": "a20d9931-c8ed-41e5-b47c-653408637855", "comment": "Malware payload", "value": "0731ab7be7c0ec1e6cf2dac6551aa39b687f1fca077fb1c390575891715cfbef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916372, "uuid": "3e211454-3104-48d9-9b53-c1e076865b82", "comment": "Malware payload", "value": "ae1ed570dae44f0884fccb08c5e411aeda2f7198", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916372, "uuid": "b6f2d10d-00cd-4249-a4da-9285fe4e609f", "comment": "Malware payload", "value": "4672732a61786aa20e14b7f97432898ce5bb7ea3b220977c68eae5a4e194900e92984f0acda729c67abdaadd272bb320", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916372, "uuid": "37785ea4-d800-4683-8d9c-c29883bdf2ea", "value": "023302D69B23E9C28AFADB770C5522E4936FD89C31147C59092A298384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916372, "uuid": "5759be84-7816-4c4e-9c2f-5c1bea7173eb", "value": "768:Fo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6FSz:feKCVQbp4LTaI7ZaiNQMIXAFvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916372, "uuid": "b5f72cb2-a54b-48c8-8c70-f83456cdfd85", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916372, "uuid": "f79e51fa-5a7e-4b78-b56d-ed9e6fc10534", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916372, "uuid": "2763b59f-aba9-4f12-aa4b-210556145c2a", "value": "statistic-575777870.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ae9505-b3c1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620892990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892990, "uuid": "d9184f0f-7483-4658-a94c-532a7a7de4ee", "comment": "Malware payload (Dridex)", "value": "f0665eb99c0766b8cd9d63b299a3b300", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892990, "uuid": "2f97f059-db02-464d-b98a-34df42d921fc", "comment": "Malware payload (Dridex)", "value": "073f4d42bd6ac97d9c7ce3f586e4426c2161001313346d715e76b90065146c57", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892990, "uuid": "2d566460-d0d9-435f-b29f-53c551f4a39e", "comment": "Malware payload (Dridex)", "value": "a800322b6f57a0b967c2ee3ad2f239bce35422ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892990, "uuid": "d343b5e4-c9cc-43b5-88b1-019c2a626f60", "comment": "Malware payload (Dridex)", "value": "95adced05cab4331bd3ac1a1c3826ad9cee094b15a31a76239a14418d37013b82161036b0d9d52c00d8301c6641cbb96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892990, "uuid": "14dddd0d-d504-43a9-ac0d-852132a176a4", "value": "4EF3D0D3E21FD1A4F223063450F4F46ABA7C24C786349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892990, "uuid": "d741222e-b2fa-4847-a5f8-b016c5565b8a", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892990, "uuid": "86e487e5-7def-436f-9140-41c573359dd6", "value": "3072:89F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:89F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620892990, "uuid": "a22efeff-40a3-42fe-ad9d-f447f07e58ed", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620892990, "uuid": "a0171201-22d5-4a4a-8ae5-b5349e09815b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892990, "uuid": "331958c3-4861-4b23-96f5-9cac5cfb1f9b", "value": "f0665eb9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815203c5-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867154, "uuid": "a6b6395e-2fee-41b7-af1f-4ae386a635c4", "comment": "Malware payload", "value": "4c5e79002ef25d2a12ef18444916cd6b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867154, "uuid": "ab800f5b-fb82-4cb5-8521-230e444452d4", "comment": "Malware payload", "value": "0744fdabd5cf75d7f43c6f06d2527e9dbfaf41be77c41faefca1d1e68d22983b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867154, "uuid": "78234b5b-abc6-4ff3-8315-30183f461154", "comment": "Malware payload", "value": "48d01aa73072153d77c89b3e82332db40d80163e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867154, "uuid": "0b4834be-9970-4b33-8725-d46841795170", "comment": "Malware payload", "value": "f422ce4ab5c00900bd7fd1399c148b91f10d9bce04e219dd1d68f1ca7440cadcdc12b2ef3d1ea74f63173c7bd38316f6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867154, "uuid": "ef92cdf4-4f89-49f7-87b5-519b56b52012", "value": "5833F1C4EF1BB858CB837377BC882FD66EAB125464CEE09597C6319D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867154, "uuid": "d27697d9-176c-4e4b-b593-bda8ad7b920b", "value": "1536:fAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3SE:4poAnd9gucKCQax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867154, "uuid": "34c0210b-72c0-4932-815b-5d7c040d90c0", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867154, "uuid": "8d90530f-94dc-4aa6-8372-f531fffdf1b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867154, "uuid": "b6b7510a-e76f-4e39-bc07-4553fd5b0c63", "value": "catalog-1366619288.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185819e1-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909928, "uuid": "7fb15089-c750-4c17-946e-a27a1f245415", "comment": "Malware payload", "value": "78fa7bdfb7a850151cebb4eabafb78c6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909928, "uuid": "a0b818b9-c4ce-4af4-a82a-a9b75787c997", "comment": "Malware payload", "value": "074601ec0b7bbdee2851dc172a8bafd0db90b62722c72457673b3fa0c1a4ea9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909928, "uuid": "278549cc-4ce3-47db-9fc3-d67949912f42", "comment": "Malware payload", "value": "3131f0796e0bddccca8d65e5a7f5c11752304e60", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909928, "uuid": "8a91b185-3008-4d9f-9522-94ea00126b54", "comment": "Malware payload", "value": "307645d37653bd40664d68246a791ae10404a60e5ee7bfd1aaedf183b4d155eafed038373d2fc6342e6847b7f9adba24", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909928, "uuid": "db2a163a-f931-40f2-93c9-f005ebaec81f", "value": "7E3302DFE004EBA3C25F93005FE98AA215FD7558E1708168979986F9EA833C2C53D9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909928, "uuid": "bcb87f2a-3e48-4568-aa51-32600efc3ec4", "value": "768:xqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3g2hfvW:sxTuDqsF1Cnc3P57oj2+nC6uxkLYkXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909928, "uuid": "6896b1cc-1e42-4d0d-8ed6-febcfac22bcd", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909928, "uuid": "dd54f894-91ed-421c-9788-e6c65fd90b80", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909928, "uuid": "ca866fee-82ee-4507-9435-fddb6fa8587f", "value": "catalog-1612198599.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc53972c-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915384, "uuid": "9055b6d1-de01-4f8e-a596-d6477d0e3519", "comment": "Malware payload", "value": "b427596644ef7e9de9315dcf73e4b2c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915384, "uuid": "e5c57e55-4d91-4127-94d6-515dd572bc87", "comment": "Malware payload", "value": "07461545b8db0517f22c283b2ed31e601a2ecf89e31b8d6bb9b0b4356084bec5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915384, "uuid": "a834272c-2cc1-45d2-95b5-5b9acc2b4147", "comment": "Malware payload", "value": "60ad7af64739ba2cab4e9499f389b4f1f1ae821c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915384, "uuid": "a97c36d0-4e2b-4236-b6ca-fd8e9c27c065", "comment": "Malware payload", "value": "a59f75896fb0b09bc4ae1cef64e0f30e9f1fbe7747f0e3dc591309c36f58a8fda674ad9d8da5be3ccb84c6645bb27227", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915384, "uuid": "725b6ea5-8ab4-4a55-a135-dd7f6edf095f", "value": "DD3301C66B13F5C6C6EADA67044673D4635FD8DC30243C68583A658281BB1A8D4F3BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915384, "uuid": "a5ece88e-4d8a-490a-9b91-889aba5c06e3", "value": "768:5o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK8YYI:jeKCVQbp4LTaI7ZaiNQMIXd1Nin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915384, "uuid": "2721a25c-dded-4a67-ac06-4d34b19dbf8c", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915384, "uuid": "c1aa78d8-41c8-4a59-9f47-76920a928ee9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915384, "uuid": "ef21cb55-524b-4d7b-9001-e1c666afa8d9", "value": "statistic-1748752748.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d72732-b3d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620900236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620900236, "uuid": "3d9c8c42-9b94-4367-bfd6-d230627c200c", "comment": "Malware payload (Dridex)", "value": "3dcb4c50d50a8ca553829ca7043aeb87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620900236, "uuid": "8a89dabb-15e6-49a0-8730-4d9633cfec70", "comment": "Malware payload (Dridex)", "value": "07522dc1539c9f570d13fd9593d279ee58e62fbfc053aab293b1de9ef18f0257", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620900236, "uuid": "fd2ca254-6939-4d98-9764-8df1d255328b", "comment": "Malware payload (Dridex)", "value": "1813a78d28f4bf33780c2f84c487f389b5d6effc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620900236, "uuid": "1bde77ce-298d-43c2-b700-5310485a642e", "comment": "Malware payload (Dridex)", "value": "da3a1d8e00fadd2f9d002b5b858d37bc8ef83e106866fefe6bce432a9805c1a8d9823c073a9df731b2156b091eec3e97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620900236, "uuid": "6b80e500-38ad-4e02-ac8b-73bf2b51afcf", "value": "B0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620900236, "uuid": "f66c39f3-cbac-4ad7-8863-be3952222db3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620900236, "uuid": "bb447e84-3aec-454f-813e-f6b492880acb", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620900236, "uuid": "5d710d9d-94ab-46bc-b133-223bc72cd64d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620900236, "uuid": "7b31bf39-4131-4de7-9212-c28cb9b9fcd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620900236, "uuid": "37c68a01-2f3d-40e1-b9f0-8a96e737a186", "value": "3dcb4c50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b7a4f0-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911645, "uuid": "0747ea47-e9ca-40e1-a37e-5b8095875976", "comment": "Malware payload", "value": "7bc0cf9677016921ba8d88080049d13c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911645, "uuid": "5754144a-4f20-47c7-98d0-c67f3c7367fa", "comment": "Malware payload", "value": "07535386bdcab9e00a9da02dc3f613de2594cb9507f985d458e3f5b42c1b4198", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911645, "uuid": "731a2427-70e0-4d8c-a67f-797367f5f12b", "comment": "Malware payload", "value": "106420d0a82d17755a486042c1b76fe4e6ca8940", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911645, "uuid": "040f0047-1c5e-463b-9a7d-b9a5a2075a2a", "comment": "Malware payload", "value": "8318d68cb814441542a8acc8703945de02eb0f169c7d922700364184fde013f196fa7deedd639836bf920752c9d25e6a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911645, "uuid": "c2cbbef0-7620-47ab-9fe6-1bca57ed7847", "value": "223302DFA014FAA3C19B56011FA6D76206FD7A1DE2309158835AC7F1E9C36C2C02A8E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911645, "uuid": "a875d194-3e9a-4201-9e54-cbb2b7e8da0a", "value": "768:MFqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNWLtM:3xTuDqsF1Cnc3P57oj2+nC6uxkLTNWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911645, "uuid": "5eb66e65-3227-4c22-a616-5c423772386a", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911645, "uuid": "4c135dc3-dcc8-4a2c-986d-621196c2c32a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911645, "uuid": "bc4c66dc-35e3-46c5-8f1d-802527fd74a8", "value": "catalog-971400946.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3291b0-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871523, "uuid": "105194ee-b896-4424-b12f-0ba379854a60", "comment": "Malware payload", "value": "c4e3904a26214c1680b4f0caffdb086f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871523, "uuid": "62d571a3-a0ef-48e3-9b21-cab9b43ed59a", "comment": "Malware payload", "value": "0754ca015a31cc8bff13294529634600dd6568a42e0a3d7b062bbc00c45148b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871523, "uuid": "a8404f2f-90db-47eb-bae1-18a953bcef38", "comment": "Malware payload", "value": "1ee568048fe5bc5a05cfcf48e5d500d3910f2600", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871523, "uuid": "7e82b8fe-d079-4a53-aa2c-44b3d71ff41b", "comment": "Malware payload", "value": "f8b38dfb1b14c5efde6e4aa4e288f445ad18a339c280f9619599bc39caf9ba95f3f9e5c13244f5e19ddc457a884ec44e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871523, "uuid": "0cd4be01-71b9-492f-b892-bde582acba99", "value": "C633029673FAA910C5F1C2B0A4E27588374F3D928D7D5DDE4D88A4793B920B1CEE16C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871523, "uuid": "6f3938a6-8265-4578-876b-11aad5453ebf", "value": "768:v5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJc4:v/czJJSI7r3Pwh8f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871523, "uuid": "ba39780e-9273-42af-a313-da6046440fa6", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871523, "uuid": "2bc455ee-3071-4b8b-a9fb-d688470f4a1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871523, "uuid": "e509e35e-e72c-4368-b00a-5c1fbb4e6702", "value": "diagram-728477766.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8cdd02-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913560, "uuid": "69b36070-3c7b-45ae-8637-58515500cc28", "comment": "Malware payload", "value": "d268f872b6882baa7c937d3a4285de5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913560, "uuid": "30b32b32-e966-4cac-b299-d95cffdb4116", "comment": "Malware payload", "value": "0764225ca8b0f69d87f7e4531f65e6e9ab084c5fff367c3aa9bf2706ed9b1772", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913560, "uuid": "d8ccc006-dca5-4e0f-be10-229cee3c6f0d", "comment": "Malware payload", "value": "0d882fd8106d3aaaebdceaf95e50e62f9ad86655", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913560, "uuid": "ce91ea04-1871-4dd4-956c-f9428b8aa7c0", "comment": "Malware payload", "value": "31b16d8f431346883bdf748573084ccd5cf1d5d120382e369a4e1405d3d475ada263721225f5512780be21a5e7b55578", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913560, "uuid": "d8bd0fb5-fb37-449f-90d8-2a61d2a6587c", "value": "3233F1D232E7863AC0C505F5F92B69D656A78ECCF030A0C05E5FDA4112E2166ADE279F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913560, "uuid": "aac47c88-9b39-4f91-8c81-aaace6d8b64e", "value": "1536:2EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwR1:jnBrX5Eg5Enjq3axWIfkNwR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913560, "uuid": "58ee489f-5b07-45f5-b7b3-8da9ac7fadf1", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913560, "uuid": "ef557468-c621-45d1-8453-8a538172925f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913560, "uuid": "da408f4d-d227-4388-9401-d109ef0c1cb2", "value": "diagram-407957915.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5a9a08-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870667, "uuid": "dc59c0cb-bab1-43ba-8249-27f13e38345c", "comment": "Malware payload", "value": "1b9b6f67ffe5b62c9a29903efe3cb2bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870667, "uuid": "9cfa5c20-0d20-4021-93ee-fc2542cddbc5", "comment": "Malware payload", "value": "076ce5f34513e90393f39757057f7193044378349f96d81412166504ab364e50", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870667, "uuid": "1a495dac-1ef7-4a1c-a113-9613a551c7ac", "comment": "Malware payload", "value": "8507d7c1ae37266bf7c7d8c49b52d2bc7d24c514", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870667, "uuid": "751421f5-b11d-44aa-a88a-17a0660e0d65", "comment": "Malware payload", "value": "587f738be5b9a7625df27881d30bf21fbc6c396660c3ec57e1dd79ed3a5e5737e6bbe494a8533d84cc7897f5462b1fcf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870667, "uuid": "6fda24b4-2e99-490b-8777-1e2c93c52f9c", "value": "7133029473FDE520CAB1C2F06092B689374B3D918D7D59FA4C95A4AA3F93094CFE61C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870667, "uuid": "4171478b-8ed6-44d5-9ee3-d2e668a48f85", "value": "768:C5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8s7:C/czJJSI7r3Pwh8tv8x88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870667, "uuid": "7dfbedfd-6a1d-458e-8645-0b81d8484887", "value": 51598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870667, "uuid": "665f382d-b80e-4981-8f71-bd81962fa49a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870667, "uuid": "57a7dd21-9207-471e-8000-114622161e37", "value": "diagram-2062857392.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d05d98-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909041, "uuid": "35102046-f196-4f5c-9c44-fc23d065be21", "comment": "Malware payload", "value": "e7987f674d24b5a8f594d3645f8951af", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909041, "uuid": "98461968-d79b-4ed4-b570-a16a4cd6d6c2", "comment": "Malware payload", "value": "076f9f71db7ac0a73067ed3e6ab582609dbbebb0364d3f698f45794626277f36", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909041, "uuid": "5f320f1d-673a-49ee-85f3-6783175df0ad", "comment": "Malware payload", "value": "9948c7fbb56165d1f6dc1dba8944352481897101", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909041, "uuid": "5230b687-45cd-4b8b-b235-3b5028a71dd8", "comment": "Malware payload", "value": "130a7c0ec252b6c7fc4883054498fd584d7c4f859c57b3554a8587a182c901f94dcee72b666208168d4cfb1fb409fa09", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909041, "uuid": "87f13784-b16f-40a4-9b3e-85687814f964", "value": "A23302DFA014FAA3C19B67015FA9D7A206FC791DE270D058C36AC6F5E5C35C2813A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909041, "uuid": "125871f1-5b20-4b6b-8224-50eb7efb3fb7", "value": "768:0qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7vLT:dxTuDqsF1Cnc3P57oj2+nC6uxkL7vH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909041, "uuid": "8a78e48e-59e5-4a5d-96d8-e6fdfeb0434b", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909041, "uuid": "c0a53114-d0e5-4f0e-8ed8-d1264f33d4cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909041, "uuid": "3de04a36-d929-4861-b559-a6c39b6fb8c4", "value": "catalog-1082054245.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ebb6e7-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914667, "uuid": "5303ee8f-06c9-466f-95b3-7be8fc6b6e22", "comment": "Malware payload", "value": "e3e7d36beac96541802d03434ac2cc67", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914667, "uuid": "ee0fda41-efcc-4364-8208-cad4d7cc4278", "comment": "Malware payload", "value": "077e59c034dc81df7e7056527734fcd0e03ad9baf2e3d17d4bfe6af616caad63", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914667, "uuid": "e4214a4f-dc91-4a00-bd8f-ed51ea969185", "comment": "Malware payload", "value": "42b3f31b62c047fd0a8c8ced5f3a75da6e644eee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914667, "uuid": "24a14833-f2b1-45da-afcd-8e39d95bce5f", "comment": "Malware payload", "value": "5620be852ae497a07c594bc66b2c8a1626c99429af3b6562fd89bf905082ea7e0cb454f597628bce39e341a61b7bd24f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914667, "uuid": "1ff3c3d3-52fe-439b-87ed-f6555f30df02", "value": "303301D6A523F5D287BACFA3089623E0A3AFC44D32147C995C7E259280A7158D4F37CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914667, "uuid": "bb2b64bf-0c36-4d9d-b4f0-7d901a0f0c00", "value": "768:Vo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SZEaQEs/:PeKCVQbp4LTaI7ZaiNQMIXWrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914667, "uuid": "c5867837-7507-4b8f-a74a-468d295ad4bb", "value": 51775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914667, "uuid": "2a97ba42-84d4-4e7b-b267-e92cf7226880", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914667, "uuid": "8a076173-9fe6-4a1a-a59c-2da389741f5b", "value": "statistic-1188585609.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b256fc-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869975, "uuid": "89f2289d-2406-421b-8555-5b14599ed5b4", "comment": "Malware payload", "value": "bea0360ae22f1ee1ea75d87f8b200d34", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869975, "uuid": "d5c7d908-0dc9-41e1-b804-85642bb9fe05", "comment": "Malware payload", "value": "078728b231a949e00c2a45f79878f1b07148cb2133203f227d99df696d9d1eee", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869975, "uuid": "1dd89986-a0de-452f-bb82-fb9f10c11b79", "comment": "Malware payload", "value": "231cc66e7527e4e7c44dc4814d43e3284788fc97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869975, "uuid": "bafa28d9-ab35-4022-bd86-02ff90749867", "comment": "Malware payload", "value": "34e4c188f32527942dd19ee45f57dae94a949d8f294b3cd2c4e8066721010a1a26a9b50cb727f35816b7c846d13ec8b4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869975, "uuid": "f1afdbbb-c0e6-4013-807b-8a172f8d50da", "value": "F133F29473FED510C6B2C2F0A4A3B5893A4B3D91897D6DEA0CD465693F931A4CFE22C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869975, "uuid": "66500f69-0bb6-40ef-b118-f0901d2e0278", "value": "768:f5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8/vVIWgx:f/czJJSI7r3Pwh8tv8x832nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869975, "uuid": "f906ff67-6e92-4a04-ab90-70522cd79c46", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869975, "uuid": "280bd9cb-e18d-4ca4-a429-e020a5b7453a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869975, "uuid": "2085c810-3290-4661-a234-231dceb69ded", "value": "diagram-156836046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd347bab-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868140, "uuid": "2bee9cd6-1810-4281-9e18-6bcaebfb0455", "comment": "Malware payload", "value": "ecf0d977cecee0352b2139348dbbb9e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868140, "uuid": "a253277e-2a34-4e58-b1f9-b96f95f69587", "comment": "Malware payload", "value": "079a6f1cb07a2f8e556eb0c8ebb0c3ffaccd5f8151709e2142c707376be68b4e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868140, "uuid": "2bf1c484-8315-4249-ac24-d6f5d62bcfab", "comment": "Malware payload", "value": "b3812cba11811f917f7107a82e454ff981e43699", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868140, "uuid": "bd9ca014-b9fe-43b3-a27b-af3e9bbe6159", "comment": "Malware payload", "value": "f9b0855a382e3a5a24e6acf794e5b62d4bca1a8ddc88a030d226d0ff2ee5d12266f67b7679f8df1e3252f70b18a546d3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868140, "uuid": "6a08e752-7a2f-46f1-9190-0135405eff67", "value": "5233E185DF57F858CA8273ABBC882FD76EB7026464CDE19457C3319C0296E3356242AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868140, "uuid": "0756638f-662d-487e-85ed-62b85f6330ff", "value": "1536:fAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHi4y:4poAnd9gucKCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868140, "uuid": "ff590036-ae94-494b-935b-79f8c6d47917", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868140, "uuid": "a34097c8-7bbd-4fa7-96a0-ef31df7a97ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868140, "uuid": "7ec76b0b-b849-42e4-91a4-12c1c6fe58ad", "value": "catalog-2120910161.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64270b64-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913061, "uuid": "4b2b3c98-e619-43e0-8474-c40c2fb16263", "comment": "Malware payload", "value": "46aa88abaee3f4f9bdf70fe46a573118", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913061, "uuid": "844f5318-5ba2-44fa-ac2e-de24375581c4", "comment": "Malware payload", "value": "079ae8c676d51c43ef99808d1cfd5f9dbd5fbc273819d3f4086035c57bb2553d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913061, "uuid": "c3e51179-14b5-4f70-87e7-aea0fb9d35b0", "comment": "Malware payload", "value": "78cbff0ee43b05172a5f8b6e8d4c130961d1b85d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913061, "uuid": "9e2fce90-1205-4490-b37a-c22a7e073a67", "comment": "Malware payload", "value": "47d0a34f9e9857abf202c559fe15ae98dc86691ac4efafc13554c5bef5d52accd2b4e69ad495fbadfd305356cba94951", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913061, "uuid": "67492631-52a6-4737-aa2d-6d802b3d65c9", "value": "8B33F2D232E7863AC0C505F5F92B6ED656A78ECCF130A0C05E5FDA4112E2166ADA178F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913061, "uuid": "5608b9f3-4094-419e-b0d7-4f427789a0ab", "value": "1536:JEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRe:mnBrX5Eg5Enjq3axWIfkNwRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913061, "uuid": "96b700e1-7997-47bd-b48b-f1bc5f644ddb", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913061, "uuid": "9be2b51b-4bce-4e7e-82b1-bf46b13dab97", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913061, "uuid": "de0de3bc-cc18-4855-ac49-c2e8ed2e6481", "value": "diagram-1992558145.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f1d563-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912694, "uuid": "a02673af-fbeb-4af1-b3f9-ed223eb20620", "comment": "Malware payload", "value": "d5759b1a9a578d666a64ca7e174e27b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912694, "uuid": "d99de415-6efa-49b8-be8f-f392b70954fd", "comment": "Malware payload", "value": "07a1756163b1aff9cb36f2f12d64172f3581a78c1e0a92278339fc9dfe8949b3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912694, "uuid": "02e6a85e-a678-41e4-ba69-e39e13b8f63b", "comment": "Malware payload", "value": "6aa1957ad338ccd0021c2d873f40d2f217efe662", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912694, "uuid": "6917352d-634e-4fde-b8c8-cdf39e12a5ad", "comment": "Malware payload", "value": "1545b88a962354ae4e410491066e692201c587413973d17e6627423f5719edb0522882ef8689af3da7300d2ebd51df68", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912694, "uuid": "76154264-8833-4801-a827-e1a6e8439022", "value": "9D33F1D233D3913AC08609F6F92B5DEA26778EC9D520D0D06A5FD91112E227AADE170F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912694, "uuid": "5e79cd97-04c4-4a3e-8063-ea55deeabb18", "value": "1536:8EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwMK:JnBrX5Eg5Enjq3axWIfkNwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912694, "uuid": "ee117f1e-ba5f-4bcc-bbba-8710e78248e3", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912694, "uuid": "c394fc16-aa69-4929-808a-447c52ec8748", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912694, "uuid": "04af9b9a-8fd6-4ccf-9659-53ef477ebea3", "value": "diagram-1816306717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8df2588-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916720, "uuid": "61b7232a-283e-4d3d-918c-88359f1b58f1", "comment": "Malware payload", "value": "56be1da0fdcdbd835e91289360db8496", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916720, "uuid": "9d74e1ee-d6df-464f-9c20-6d4309c24b32", "comment": "Malware payload", "value": "07b02a844e39b01271106c5f8a5a9f5634f58cc50633aef245b288330c0f98ea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916720, "uuid": "866aab68-0281-46a8-8710-b5ad7fd3fa52", "comment": "Malware payload", "value": "e12f2887f74ae2714211ced5ac4913d18cd3859f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916720, "uuid": "67b24924-fa31-49d1-ac8b-cbf6c7fd0461", "comment": "Malware payload", "value": "4075d937c7f5b9345522d18dec85770520ed16fd4c616eac7602258224ebab866e6e6a37815bfdf523051c762c34a91f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916720, "uuid": "f9ec017c-1a26-40c5-9d59-4cdbd13fe9e2", "value": "153302D69B23E9C38AFADB670C5512E4936FD89C31143C59192A299384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916720, "uuid": "8480824a-44d2-4b09-8c6a-7c97591e77d6", "value": "768:8o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6FCI:weKCVQbp4LTaI7ZaiNQMIXwF/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916720, "uuid": "f7a6de49-936d-44ef-9aab-74d6984ba899", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916720, "uuid": "fac6b542-d2f6-4736-abb4-8695bf498427", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916720, "uuid": "15c0a1ab-f513-4e0b-b84c-b2a9f4d45b13", "value": "statistic-74528129.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6a6031-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912991, "uuid": "85628220-b14a-4416-b6e1-4278529eb77c", "comment": "Malware payload", "value": "3d8c720f906b98061cc950d09e1e9cc4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912991, "uuid": "dd61b108-2065-4158-bbec-2eab26df858f", "comment": "Malware payload", "value": "07c33b67aa19ab2f7852e7874737204cfa5390c7f05688326a999707422fbbce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912991, "uuid": "1663196b-580b-4026-81c1-0b8fdcf2eb0c", "comment": "Malware payload", "value": "fb7e2562d9799397221f644df4dffeefb84d10c1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912991, "uuid": "f9b2c135-243b-477b-b641-63a4ad05a4cd", "comment": "Malware payload", "value": "4c2b65a3c6580f977143c54958a3312cd16344d7bf161dd03a56386d102777709931f7f7345e7c361b0946437decb2bd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912991, "uuid": "f117671c-6fb4-480b-b093-dc1e7edd491b", "value": "3B33F1D232D7E23B80C505F6F52B59D62677CAC8F83094D16D9FCA1213E3166ADA170E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912991, "uuid": "de9cb9cc-b784-43d2-8280-68c74ad9aae9", "value": "1536:CEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnS8:HnBrX5Eg5Enjq3axWIfkNwnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912991, "uuid": "5a16be80-79c3-49ce-a334-3435062e0a1b", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912991, "uuid": "89cac99a-5a97-43db-95c0-28a224ffba0d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912991, "uuid": "71b2a721-7d9c-4a93-8ccc-4bbb5c2ebd2d", "value": "diagram-1953696594.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8408c4-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912463, "uuid": "f20676d7-8615-4c68-a8c5-21ab7b911f45", "comment": "Malware payload", "value": "e694742b203158f116fbc75751712962", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912463, "uuid": "48236d32-e63c-419e-9609-02dc27ef559c", "comment": "Malware payload", "value": "07d3d8a61ea590394e3d530e77fef99453885da1b875813ff8a14a6c48816943", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912463, "uuid": "cc2153da-4e06-4588-9936-0aa9406174f3", "comment": "Malware payload", "value": "68afec4bed42d249228c47ac344aa0092adf4b47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912463, "uuid": "55272e9c-4d5d-4d0a-ab3d-1e2513f0acb6", "comment": "Malware payload", "value": "8b4c17731beab74305aa5c0fb7e7d77549f0d80ba4c44b667d2b458aafb7375d949edbb48e98b999d4a98ec44ea79fa3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912463, "uuid": "94111b04-3e8a-4f78-b8e8-1dd94359f5bf", "value": "4C3301D233D3D13AC0C401F1F52B6AD966B79EC8E43094D00D9EEA1227E31AA6DA174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912463, "uuid": "2ec45e49-7898-4097-9a4d-b600865f779a", "value": "1536:3EnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwi6zq6fv:0nBrX5Eg5Enjq3axWIfkNw/Pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912463, "uuid": "99045b2d-30a3-448a-8aff-91dcf603314a", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912463, "uuid": "bdaae561-b92f-4d69-93a0-093dba5a09a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912463, "uuid": "e80bbc95-0c30-4cc7-a884-bfbfc573903c", "value": "diagram-1643309197.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c2151a-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870869, "uuid": "253a4327-6fa9-46c8-9af7-be05b3fd8cdd", "comment": "Malware payload", "value": "013ffeff3c9f303d7e03fdb9d4d9d15e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870869, "uuid": "f21789f4-98dc-4ab3-a9ed-b9e6656f8ee4", "comment": "Malware payload", "value": "07d4df657b9dab6ff1b1810fdca402f0475d5ea3d6b9c8dcdf51459d7a947bd8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870869, "uuid": "10c250e8-0cbe-467b-88fb-403cb0363fc3", "comment": "Malware payload", "value": "fbf1ad05219c2279050fc15c34dea8b01be8a7db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870869, "uuid": "16989f59-11fe-449a-a607-5162b0b29a76", "comment": "Malware payload", "value": "b69f52de631f8686f4e6033cfbcef151ba57ae21027ec51f8bb7529c5880790e6e152144f58278f61edc8d4f5bcc48dd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870869, "uuid": "05b4fc14-bc73-4bf8-a245-2ed0a3b08ff2", "value": "6133029673FAA910C9F1C2B0A4E275C8374F3D928E7D5DEE4D8894793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870869, "uuid": "ca438290-e3fb-47eb-9b6c-eb0012b09bff", "value": "768:n5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwD:n/czJJSI7r3Pwh8TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870869, "uuid": "3ab48403-5b7c-4ab2-9ebb-463125336a72", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870869, "uuid": "5fa99fdd-85da-46e6-97f8-6767ec97e54f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870869, "uuid": "e6d6b9a1-cad3-45d2-8783-1b3ee9da30fa", "value": "diagram-273229082.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e592e3f1-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870329, "uuid": "dc904386-08b5-4e2c-a4a1-943c8d5729fd", "comment": "Malware payload", "value": "59b6cb5a92010a910e9c68c90d2680bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870329, "uuid": "2ff47694-8981-4253-8d65-46765d905d9d", "comment": "Malware payload", "value": "07ddf3032d0e5203d5d74b19101517ef8bcd17027b21ed0c0dc08d46208e7642", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870329, "uuid": "3a11b145-3885-49ba-a3a1-f88b7f917faf", "comment": "Malware payload", "value": "59e0d32413509a159f5ea00de6a444552469fa3b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870329, "uuid": "c2ec99ac-ab76-470c-a997-928ebb41239d", "comment": "Malware payload", "value": "dc6e93d9173dd573cd941e27bcdd6acd6f31646a9e0dd3e0591f89b53075cdf0f3f8e45d672b8bc84e97339cf8737bb3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870329, "uuid": "13ec295b-fa9d-4147-9f55-26f1aad86c4b", "value": "C733F2A473FEE510C6B2C2F0A4D2A5893A4F3D91897D5DEA0CD464693F931A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870329, "uuid": "5f129722-5b93-4649-918b-8e02f90569dd", "value": "768:l5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8vSVIWgi:l/czJJSI7r3Pwh8tv8x8K2ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870329, "uuid": "6c377fce-dc89-4200-9732-2659d53f627b", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870329, "uuid": "760ddc1e-5099-4903-a5c7-7337689dc749", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870329, "uuid": "1939897b-ffc0-483b-ae39-0e52d23aba22", "value": "diagram-1820795159.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb735f7-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870022, "uuid": "42043d84-cabc-47e5-b870-f5d01858a14a", "comment": "Malware payload", "value": "9261724d616c0e9de09c28014236a5ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870022, "uuid": "f4956d02-3c08-40b3-a57f-9508db6ba7ab", "comment": "Malware payload", "value": "07e406ea4133564bd751bc749d3edbe25eb519f3a5055ec171dbb7508fb523e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870022, "uuid": "d0a7262c-e9d8-4569-8c34-06e1228e1b27", "comment": "Malware payload", "value": "b991cbbd582edb27eac33eeb8c0f8f21d01d1115", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870022, "uuid": "6d3dfc60-f276-48c0-8537-67f7ff356d98", "comment": "Malware payload", "value": "dc59bf4f667ebf554a4447a486702f0f10ba071e60b123cb7e0fc30dbac8197a502e60c6f0b4a7ae8f8a4052324f2b92", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870022, "uuid": "be7f5031-5185-4f5b-b826-c9faf481f889", "value": "A633F19433FED910E5B2C2A0A0D275863B4A3D91497D9DEA0CD475B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870022, "uuid": "e309520f-579f-4cce-b22f-6d8087e9591e", "value": "768:U5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccL5A:U/czJJSI7r3Pwh8aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870022, "uuid": "23cbe4a4-dd1c-4621-91d1-9990223ed7b2", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870022, "uuid": "abea4c59-a980-4a67-afec-7a567bd7c0fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870022, "uuid": "39749a75-38d9-4fd0-95ce-8a38165d81c3", "value": "diagram-1595335589.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6171ae-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872864, "uuid": "bfc1040a-a9c6-42ba-9162-029cf429ce5f", "comment": "Malware payload", "value": "013b6305a799e0c33985eb5adc4158e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872864, "uuid": "92c32027-447c-4517-85de-72f777041e26", "comment": "Malware payload", "value": "07f37948cac38abdf3f207e27f254dbcdc6650fdd8bd17afd1884d199b7205ba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872864, "uuid": "539451c0-cd6a-4628-8d3e-49b1cfd8cc46", "comment": "Malware payload", "value": "ad699eb61a575e4bdaafcbcbe4af661a65df5e0f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872864, "uuid": "54003915-f646-4699-bff5-18ffd3500e86", "comment": "Malware payload", "value": "bc23958c795aa09c907d57009776a30d9f1a693185302216f5d864aafc145ab1e2a8df2a59308b0fa8d6513678694204", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872864, "uuid": "fe2b9a04-1271-4c5a-9d2b-7790a693468a", "value": "D93302F1D603B6ACBA03418D4EDC5E6B5237427096598DB1C54DEEC2D23971A0F90AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872864, "uuid": "a9e553fc-6f4d-4da8-85f5-8a9b166f263d", "value": "1536:Tj/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMy:/XKAXh3TCdOi+KSZ4Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872864, "uuid": "93b72246-4f55-40e1-88a6-58dd0a6de2c6", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872864, "uuid": "da6f4145-e00b-4205-a59f-c25a9c684bc3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872864, "uuid": "7d4f3133-cbfb-438e-a3aa-8988fe32e009", "value": "statistic-1758210825.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53f597c-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912446, "uuid": "2a6ed73b-941e-4244-adf7-3d0fe08bd859", "comment": "Malware payload", "value": "085e3589d9d8840d52ce6c5c3cecd8b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912446, "uuid": "d72775fe-a184-42a2-89e0-f8bf9e744ed5", "comment": "Malware payload", "value": "07f469179474739eed0dfe6b5fbadccc846f7daf9ef9bd1098812e1339329e52", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912446, "uuid": "120a49fa-985e-4602-9c98-47e88441dffb", "comment": "Malware payload", "value": "e721e1f878833baef1da131f5b97f7701f30cf68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912446, "uuid": "c963515f-3b9b-4f96-a5eb-a837438d1e9d", "comment": "Malware payload", "value": "a5aa789a8792c0b83deca7100d726b4dfba93a62f3b7bbd0921337c272fc276862d77e0bf06b632b23ee697e7d59cecc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912446, "uuid": "120ba9f8-52c7-43e0-8b19-1bce0d1186d3", "value": "7333F1D233E7D23AC0C105F1E5271EDA65BB5E89F920D4D01E9EEA4012D31A9ADA174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912446, "uuid": "6ce77c5a-d6a7-4be4-a6cf-a0c9a4c57281", "value": "1536:OEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMqJ0:rnBrX5Eg5Enjq3axWIfkNwBJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912446, "uuid": "7fde6377-074b-42c1-a3d7-aab64295f226", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912446, "uuid": "13d98e95-2de3-4714-9c8c-e33fa4f7f16e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912446, "uuid": "47810976-ea75-43d1-aabe-185327e20880", "value": "diagram-1632759962.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ccc515-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870111, "uuid": "5c8bbb24-da5e-4d6b-8094-9254d115b9d1", "comment": "Malware payload", "value": "7541f83f33ef7444f890c980fc4bc46e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870111, "uuid": "c34b1bd4-1d5e-44c1-b2b5-bcc8096b6526", "comment": "Malware payload", "value": "0819cc0da4221e5fb0b352827d78126c158d101092f2dec0e190646e73535af1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870111, "uuid": "f9e4e354-eb9d-4473-906e-57912119157b", "comment": "Malware payload", "value": "913e14c673dcda28300fedc0db21659158cf75a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870111, "uuid": "593f7067-7e96-457b-a15f-55fbe3aac560", "comment": "Malware payload", "value": "e12a0c6dc7597d83c59079a889b3b7159e74173d0440fb5e848905b5f7d444963d425134794f0b1237e4fcc6fea1e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870111, "uuid": "972f6ceb-7ee5-4f89-952a-74392bb75407", "value": "9733F19137F9B900C6F2C1F060E27699274B3DA18DBD5DEA0C94A5B93F931A0CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870111, "uuid": "f69f27dc-5f42-4cd4-8f3a-a8fc978077f4", "value": "768:x5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJ0Y:x/czJJSI7r3Pwh8RyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870111, "uuid": "eec0da45-9d66-4add-aec3-a7b46f0622c0", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870111, "uuid": "1a1fd673-fe67-4be6-aa1e-802a88de2697", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870111, "uuid": "eba95f13-36fe-433e-ac6d-6ef14fead494", "value": "diagram-1670925915.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0054ba13-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916330, "uuid": "9ea04b9c-c179-4a35-a867-afaaf5cec8f5", "comment": "Malware payload", "value": "1aa95a289937bcef4b39ecbd4f836a19", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916330, "uuid": "6687daf4-1e7f-4485-8a18-6c8facf1de16", "comment": "Malware payload", "value": "081c636fa4e94de95e6abb37b686af74b5ba025c7594e254609d0d1342a63b49", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916330, "uuid": "6454dd36-f4df-42b5-9ae4-f6bfcaa425f2", "comment": "Malware payload", "value": "3ca3724c416daf587a1f139bc2be62425ed95ee3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916330, "uuid": "cc8a9cd0-2a2a-40e4-85f6-4cbba4f25b6c", "comment": "Malware payload", "value": "467201051736a30c723dc80b96d2f41e87798fc193ed2160e9df558a27c93bbc89412c7c15aa653c7ad638c106f66ccd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916330, "uuid": "fc33b141-817e-46f6-936e-f76bfe95316f", "value": "7733F1D6AB13F5C6CAE9EAA7045562D593AFC88C3014BC58593E248380FF558C4E7BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916330, "uuid": "062abfd6-c0a0-4fed-8886-c1b092ecff0b", "value": "768:3o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SbyJLIN:NeKCVQbp4LTaI7ZaiNQMIXLqUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916330, "uuid": "92e1253c-de71-4513-9869-ecf26f4c2fa2", "value": 51768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916330, "uuid": "0ac97520-7bc0-4391-8f4c-fc9bd6eaded4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916330, "uuid": "7ce9b6d1-35c3-464d-b7fc-9a89098cabb6", "value": "statistic-547000780.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8056d0-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914208, "uuid": "2d1c1971-37f6-479e-8fb6-dd30bf37842a", "comment": "Malware payload", "value": "2dbb74905b30623760b4899809cc6f5c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914208, "uuid": "1cea92c6-bb0f-41b5-b6bc-62709264cd41", "comment": "Malware payload", "value": "08277bd12111a2c4eed41587dab69e0fdc035960b5a08b901cef933c8ff15489", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914208, "uuid": "4e87bdd6-4add-4d83-84a6-caf1a65ecc81", "comment": "Malware payload", "value": "e8f07e026b99bcccd38988360caf52c175e9228a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914208, "uuid": "03f6b3bf-c885-49c6-b640-2d62fc324635", "comment": "Malware payload", "value": "3022deb872d47b161f3c7eb0d50198d486fa41dba16e1a3d9a29b65380b760c2bcdd108ff3ecfb09ecc8bfb407678538", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914208, "uuid": "60bbe198-f0c6-476c-a115-ff8b679754d8", "value": "5133F2D232D7E23B80C506F6F52B59D626778AC8E83094D16D8FCA5213E31666DA170E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914208, "uuid": "661bc419-39b3-4752-a9cb-d32f1663e871", "value": "1536:hEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnhO:OnBrX5Eg5Enjq3axWIfkNwnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914208, "uuid": "1c73dc58-18eb-49e0-b2e6-71e232e4b5f1", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914208, "uuid": "87818094-28d5-472e-a436-e76722ea460c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914208, "uuid": "247a2fec-2c81-4340-99a5-b63e8fba454a", "value": "diagram-865389726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134ac6b3-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874271, "uuid": "e0e9d520-85ec-43ac-b988-67c6b17090b3", "comment": "Malware payload", "value": "1acb92970e4d7f55aa7cb9b70bdb1c96", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874271, "uuid": "44543785-4317-4905-a5ad-fcef7d2ffbde", "comment": "Malware payload", "value": "082a0e61fb0fe6bb8cf269038bad47290ae6835ad14669735cf2fed1c99b8c01", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874271, "uuid": "504c2873-9068-4ebe-bf99-92fb8c4e56bc", "comment": "Malware payload", "value": "4fa9c8f2d5ecd749dc0832985a60f126bd9a63e4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874271, "uuid": "b4e11c0d-cc98-4fb5-9f14-f659ce4c9210", "comment": "Malware payload", "value": "8ffa0c86400242bdb0c56567ec3e009c30e842202f3555a1333ffd621e6120deb2a051596855d677b396ee6ace30bb3a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874271, "uuid": "3b66b1a4-6214-4ed5-bdd4-965b4b48d116", "value": "FE3302E3D653B2BCB203D4C985CC4A5B113F4260156D8DB1C51DEEE6A23D31E1B91AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874271, "uuid": "7bc8b5b2-fd5b-4955-a2e9-b72dc15c0d20", "value": "1536:4/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wetf:4XKAXh3TCdOi+KSZ4Wof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874271, "uuid": "3495afd5-30d2-423d-81e4-e43b4e0850c9", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874271, "uuid": "133e5278-67d8-4161-bc6e-2c10ce652bc5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874271, "uuid": "d10ad85a-be65-4beb-a442-c2b561341068", "value": "statistic-748579685.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99e1d09-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911111, "uuid": "4385be0e-40c9-4585-9888-a757e9416c0b", "comment": "Malware payload", "value": "5fd8ac9e9bafe3281b2f40c72cc89fd5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911111, "uuid": "f5b4f1bb-4773-4410-aa4f-8d95e7b2f155", "comment": "Malware payload", "value": "082c277dfaf341cc028c2ee0ed40df50775b7f7c42d19541aeadfda2f1736b41", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911111, "uuid": "0672893f-ae78-4a0c-9ff5-c3ebe35d6847", "comment": "Malware payload", "value": "63bf9037c5ae667a99d4bab54121974d880266f6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911111, "uuid": "87f92c64-b5ea-4216-a9c8-650ddfa00026", "comment": "Malware payload", "value": "a6b58aea4468367b723b14696e148966757d041a0d4e9eee364276e042fcf6f8b57354608f452c948f6b3f67114e4ef5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911111, "uuid": "c9e34b96-8c43-44ce-874e-3f5d8573564b", "value": "1833029FA008AAB7C19F57026FB69B620AFD765CE03091648369C6F6DEC36C280795D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911111, "uuid": "eedf0202-9d7c-4e41-946e-92909a46db44", "value": "768:jqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOXvI:WxTuDqsF1Cnc3P57oj2+nC6uxkLOXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911111, "uuid": "d8f09171-49ba-45ec-9349-d837f0756d02", "value": 51711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911111, "uuid": "c4475473-0058-4df9-adae-5475efe2530a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911111, "uuid": "8dd6667e-ae82-416d-b779-671d7db0d682", "value": "catalog-577652846.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba703d8d-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912347, "uuid": "e8d2c121-8a0f-49c2-9d07-ab7d9be5ce9f", "comment": "Malware payload", "value": "0a5e9227453f658e5e30aba915cd4eef", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912347, "uuid": "5f10ef19-77f0-4677-86c1-b5e28e978a6a", "comment": "Malware payload", "value": "0830252aab9fd87690f135ecddd741a229252370cf796afac345b5492e1b17c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912347, "uuid": "eda770ef-d3ae-4fc2-a5e5-8c3287f83524", "comment": "Malware payload", "value": "33dc96c4c943273f14f256e12e4887accb1f67eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912347, "uuid": "a3cfc4da-c938-4617-9ebe-a22ef317c424", "comment": "Malware payload", "value": "991e04c0e5e90b1947dc76c64cd683af044491438ead81464c8b7cbbb5dda7d471563d9afb365c57e3e05ffb8983e397", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912347, "uuid": "2ef73ca4-e3f6-428c-bdc0-943da06e85e0", "value": "D03302D232D7D27BC4C105F4F42B59EA5A778EC9E830A4E02D8FDD0112D31AA9E9274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912347, "uuid": "518f0026-b0d3-4395-beba-baddc7fa13de", "value": "1536:hEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnUt:OnBrX5Eg5Enjq3axWIfkNwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912347, "uuid": "be37e3fa-4d81-48e2-80d9-bfa7a6a18f28", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912347, "uuid": "efa9a1c6-060a-471a-9913-41682ec7e557", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912347, "uuid": "bdc80857-8447-4f89-917d-4361ca320cc3", "value": "diagram-1556199811.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af2583a-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913959, "uuid": "c79db65b-384e-41ba-8e3a-5f9652c9eeda", "comment": "Malware payload", "value": "750168b256cf48499409d6451b474234", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913959, "uuid": "5dbfd2bb-75bf-4185-a528-151198a312ba", "comment": "Malware payload", "value": "083b1934b7f8fc876c81ec6d90998edf26e317ea8498aed51aab6722f9f4cb37", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913959, "uuid": "e2c8ee74-a0c4-4ab5-a7a9-baece86abec7", "comment": "Malware payload", "value": "63f6bc1cd5d2fd7e6907d142c4d10862f19d41e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913959, "uuid": "49fc5a9b-1756-4663-9ee9-bccddad870c9", "comment": "Malware payload", "value": "eddcb6b87b196e66a4e6c5a7d1f174febedb6d5e61652e3c03830abdcf827d837e7443f389a252a176b2b7816909089a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913959, "uuid": "fe874a1e-6b5f-4710-91a6-cc3464180e2d", "value": "363302E232E3D17AC4C509F6F43B59DD66A78D88F93080D02E4EDA5112D31B56D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913959, "uuid": "3950ae71-e0fc-4a01-a144-8a04771b3b95", "value": "1536:7EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHyRV:QnBrX5Eg5Enjq3axWIfkNweSRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913959, "uuid": "a385079f-5d9c-449f-84b2-646207791ccd", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913959, "uuid": "f87948cb-d635-4789-bd7b-8487c5f2b4bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913959, "uuid": "0363072b-785f-4a36-9d2b-4f7e8fa6f2a8", "value": "diagram-678273422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe1ab36-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910101, "uuid": "e9924069-03e4-4028-870c-8a4a364f6b7e", "comment": "Malware payload", "value": "f984d3e556642317218b30fdfb32d2f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910101, "uuid": "7bd4a440-668f-4c73-819f-7ac488c321ad", "comment": "Malware payload", "value": "084db57dfa9bd22c1fd03a9ef87787adefa5aa5218fa2a3ddc082ed99fdf246a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910101, "uuid": "63758e65-ed98-40e7-ad6d-b9ab7dcf406f", "comment": "Malware payload", "value": "6680228458c2bae1013f1e5ba2e69c98e0fd4b04", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910101, "uuid": "e6078883-634e-412e-911c-25de25711e07", "comment": "Malware payload", "value": "29f8771078b10e94ea45c98feb21b6dfb0b7330b6a4b00eab0682f12330476f1ce6623c8c41a51fba1c31f22cfcfea2f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910101, "uuid": "82b4ecbd-79a1-45a5-b50d-dab1f9c39564", "value": "7A3301DFE415EAB7C1EB66014FA59BA306FCB54CE0308628C754C3F8EA835C6853A5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910101, "uuid": "6fdb1b8b-7f09-499e-aa3e-5cc361e3bfbc", "value": "1536:WxTuDqsF1Cnc3P57oj2+nC6uxkLiO9urt:WxTqqsF41j2Pxmilt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910101, "uuid": "a8481c19-0a80-4b5d-9cd3-56a320699447", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910101, "uuid": "aa785071-ca79-44ca-98c0-e00a5e4d38a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910101, "uuid": "341fb2ee-8087-429e-9ce5-62e4b59feae7", "value": "catalog-1759361671.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed054ae8-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870341, "uuid": "7a40ace1-c982-4e93-8e37-ace52ecd6cab", "comment": "Malware payload", "value": "8a303b6d8d38bfd6f7478df0740e141a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870341, "uuid": "f5506588-c737-4f02-a015-6011cb95b5c4", "comment": "Malware payload", "value": "0851c1720c82161791735dd9b7ab3893c14e61021996f9cc11525c5c83f02271", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870341, "uuid": "0b3e7708-ee79-4bb8-b996-d7e8aaaf4e06", "comment": "Malware payload", "value": "22a6ed867826833dd838be95598d701ba331e92a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870341, "uuid": "9f591a7c-dfef-40cc-a0e7-970f0bc2390d", "comment": "Malware payload", "value": "89e967565c5631304119e7a30aec41f261e069517b9cba29e36ab504fc0e165207f7eb866bc4f3bd5c7808eca8ba563a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870341, "uuid": "54328f39-fe85-4974-ac5d-19171a73393b", "value": "2833029673FEA910C9F1C2B0A4E27188374F3D928E7D5EDE4C8890793B921A5CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870341, "uuid": "d002b9a4-07fe-4a14-b472-8bc645776fc1", "value": "768:j5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJceD:j/czJJSI7r3Pwh8feD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870341, "uuid": "10e2880a-2f0b-41c4-8b18-14e90e346102", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870341, "uuid": "b4577e41-fd03-426c-bd90-ca58a52ccb9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870341, "uuid": "c25de34f-8716-48ac-a956-e39d831809e5", "value": "diagram-1829600494.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e0e907-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915376, "uuid": "23ef6ab8-6b3e-459e-b5d0-168dc132013b", "comment": "Malware payload", "value": "eafee2fc7b7f7b50626d09f3b0930abe", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915376, "uuid": "9885f8c8-002a-45d5-8419-6493940b893f", "comment": "Malware payload", "value": "085281b5a32d79f57523958cb7ee47b0159ada3ab8556a3681594091b09ff180", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915376, "uuid": "b1744dd6-c1f0-47eb-b267-5b68f01757c8", "comment": "Malware payload", "value": "31143b390d7b671d753f91390ed40cd525f88a77", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915376, "uuid": "b75bce9e-d923-4a6c-98e1-034cf3cb11c1", "comment": "Malware payload", "value": "a5eaad8eed138376ffe542294c62be54f3fced098ec1e4d91676f02be42c1d00884860c033699542cfd45f9a02e880f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915376, "uuid": "14f94bcf-0904-4b9b-8e1d-088a38015ba0", "value": "2433F1C66623F5C686BEDA67049723E4A3AFC9CC30147C685D3E258281BB168C4E77CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915376, "uuid": "0c5aa3ee-273d-4d9f-a18f-dff063ace631", "value": "768:3o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SqEseL40:NeKCVQbp4LTaI7ZaiNQMIXaE7LfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915376, "uuid": "ac96de8d-78cb-49e5-abc0-725d55fb8511", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915376, "uuid": "0bddbd49-200f-44dd-a3ae-f59185d1494c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915376, "uuid": "06a44fe0-8b2f-4556-a262-7882042c2441", "value": "statistic-1747066304.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f99a622-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868413, "uuid": "24feb5da-4ffe-4480-b4e4-dda9fa752272", "comment": "Malware payload", "value": "e30f71c567ac3dcf5596277c87c824a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868413, "uuid": "2ee4ea4c-f867-4b2f-8009-c77c46639a52", "comment": "Malware payload", "value": "085aff211ca508f8729b13b3071bcb439e607ca7a426ebe09b72c3995092c2d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868413, "uuid": "7350dba1-29db-4cc4-bcf4-bd0ae4e9dd34", "comment": "Malware payload", "value": "2666204081c0fc6f472038469bbb91d87012804a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868413, "uuid": "a7c2001b-a522-4664-ac2d-d1e86b9142ca", "comment": "Malware payload", "value": "77eded2a1900b60e1984510bc884a6ed7684126ebd2d486d3e086a3ee40d9487f1ff2721e32a8d638da4ed1e3178db2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868413, "uuid": "4fb71a56-0e93-4f18-911a-0a138d7efce8", "value": "F133E1C4EF1BF858CB837377AC482FD66EAB1264649EE09597C6309D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868413, "uuid": "53a7d649-8c8d-4530-914e-6f10560a7471", "value": "1536:uAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiHb3aA:FpoAnd9gucKC7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868413, "uuid": "61485c21-0e66-4e8b-8b46-09b6e3aec86f", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868413, "uuid": "ff5870a0-4604-45d7-a858-35f51599ef45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868413, "uuid": "e641ad8b-504d-42d7-9233-23275f443c3a", "value": "catalog-392572194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250d3217-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874301, "uuid": "b54ac9dc-b83e-4851-864b-363df945c0e1", "comment": "Malware payload", "value": "4b702d994f086d4cf3444f6f76ec1c8e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874301, "uuid": "545f427b-f49b-4af3-96d6-f577b9653a6e", "comment": "Malware payload", "value": "0867cf1348425fe729af0213e56018b059caf206e071cc2aadf1fe230766fa4f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874301, "uuid": "ee9ec0cc-c9ce-42ac-8252-7dae34cb59fe", "comment": "Malware payload", "value": "eb7c34219cced04db7d762e9011ba65f659065db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874301, "uuid": "08202d01-f23b-4de0-a6b1-0fe634b5f7f2", "comment": "Malware payload", "value": "e8a838a85eb9b9906fa3893e889769b74cb9b5297d5d9647e0165b427b562fe492970efd5a130b0bebabd3527143f25b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874301, "uuid": "16dfe97d-c068-4447-bf70-687af4291dd3", "value": "4C3312F3D653A2BCB74384C549CC5D17413B827056A8CDB2C93EDEA5523E7260741797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874301, "uuid": "5e2d501d-577f-4e55-ab9e-49ec1f7767bb", "value": "1536:C/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexHU:iXKAXh3TCdOi+KSZ4WUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874301, "uuid": "fdca88d2-7175-45bc-80ca-3e64b198945c", "value": 51601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874301, "uuid": "52d0bfa9-6752-437e-a678-64777776f0b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874301, "uuid": "4a302cb7-190c-4190-b041-11310ae68f53", "value": "statistic-778032600.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8be19e2-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910224, "uuid": "507c612b-6ace-4d22-915f-f85ca298bbe3", "comment": "Malware payload", "value": "27f6784605a994c6c015ae4e9ac2296c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910224, "uuid": "0f8db91e-d3f3-4894-995c-889de9cee02f", "comment": "Malware payload", "value": "0874dae63f00bcb352a4d95ccf9ab3c769649b976094f6e72298e70b3e14ade4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910224, "uuid": "e9dbba35-3fc0-412f-93da-05f405ee459e", "comment": "Malware payload", "value": "18f548936320516c0c70e1b59624944a4f11e105", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910224, "uuid": "6f6ac8c3-0503-461b-9011-b7e49f5c2a0e", "comment": "Malware payload", "value": "8abd1513ed0153cfc7dd613f37607abd0dacc3b894c647e23388ee9515df86df42a68884414bfec36477c712235beaab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910224, "uuid": "74433eea-e82b-476b-8a38-c9d2906d7f84", "value": "AF3301EFA059BAB3C29F57014FEA97A206FC7948E170D264C365C5F2E6C35C5843D898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910224, "uuid": "32622ed2-5841-43fc-a7fb-44fe978cf888", "value": "768:Z9qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LR50a:ZYxTuDqsF1Cnc3P57oj2+nC6uxkLQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910224, "uuid": "1829020b-5fe6-453c-960d-9c5614b05086", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910224, "uuid": "0f115658-5681-4713-b994-023d1a2fe05e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910224, "uuid": "cfe122ac-9a34-4a69-a599-68431b7150c3", "value": "catalog-1842821696.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a76f77-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909974, "uuid": "e8f88518-6950-4236-8fa3-cf5a01a888f4", "comment": "Malware payload", "value": "f4dfe37ad27d19db74f3844aa1d4f9a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909974, "uuid": "500b0c78-8fd1-4d91-a825-3cb2e3efa39c", "comment": "Malware payload", "value": "0876b74b888b8e1e068d4aee7a7f95311b3ecd92abaa78b61902482c7729d461", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909974, "uuid": "aa2f2558-3a10-4f9c-8cc9-29c291544445", "comment": "Malware payload", "value": "b588d737cece815f8c2309563da751482525ff50", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909974, "uuid": "24c53d59-0558-4d32-9b0f-dac468e8f79f", "comment": "Malware payload", "value": "407e9de9f5142432dc278e6f28bd0cd530dbca6302b382d6d6228b9d058ea7411a4a737e78ecc95510907ec481f34293", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909974, "uuid": "82809914-5960-466d-a7a0-7f25f3890deb", "value": "6F3302DFE004EBA3C25B93005FE98B9215FD7558D1708168979A86F9EA833C2C53D5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909974, "uuid": "ff371c62-8f90-4bda-b8b2-39c921d69675", "value": "768:nqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3gchfvp:qxTuDqsF1Cnc3P57oj2+nC6uxkLYyXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909974, "uuid": "487928d4-297b-4764-bd79-becec0f9d01b", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909974, "uuid": "37c295c9-e998-4b83-85ea-59d05e1ce25c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909974, "uuid": "0bb6ad84-33d9-4b1a-98c8-c8cc743f18cf", "value": "catalog-1648914407.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b2eded-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915500, "uuid": "a7b187d7-c10f-4a41-8322-ec05a696d341", "comment": "Malware payload", "value": "8c910370dea1cd4e7646dd6d8401d570", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915500, "uuid": "1be01c12-1258-4413-bbb5-35337e4eb990", "comment": "Malware payload", "value": "087863b706d434e53c456894151b1ba184443b6eb3c3cefb1bc15d940834e0b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915500, "uuid": "3ad14fca-fe82-4f7e-8de1-76e6b0ca3012", "comment": "Malware payload", "value": "eac630e924f3c1d0b7df519c2ed5f23faa5f55f9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915500, "uuid": "c30792af-46b4-44a8-afe7-ff3560316199", "comment": "Malware payload", "value": "1913356ec93f863f5517108ba0e87c13e7561871d8f9419c8e2ff33e5e41631c9c9e70a862704ce5a0bc79361a093203", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915500, "uuid": "4d521a35-9754-4d50-9520-9b2b0941ba51", "value": "C43302D69B23E9C28AFADB670C5612D4636FD89C31143C59092A699380FF158D0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915500, "uuid": "2632a896-2e3b-47bf-b74a-ae433ed2bce4", "value": "768:yo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6F9m:qeKCVQbp4LTaI7ZaiNQMIXwFup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915500, "uuid": "d241d7e9-c25a-48a9-935b-4ee619221f67", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915500, "uuid": "16b5e7fb-d5a9-41b5-b84f-b328a0068b52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915500, "uuid": "388c4a97-570b-4114-9868-4bef497a7b4f", "value": "statistic-1836859781.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbc7a46-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912490, "uuid": "dabd6d89-78f0-45ae-b552-209dbacde278", "comment": "Malware payload", "value": "467312443a0f6706483d53ad38607cf4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912490, "uuid": "3dcac23a-3f98-4791-9c21-90df0dc576bb", "comment": "Malware payload", "value": "087b0b30bb499969fcbb6efe797982280ccac48a69703fbb118688bd682e9096", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912490, "uuid": "777c3a6c-8eaa-42ef-a879-c730b4e6a6ab", "comment": "Malware payload", "value": "f898d9c4766af589bcc040a87e66c3780f444aa9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912490, "uuid": "ce269fd9-22b1-44c1-ab7b-f2080a97940d", "comment": "Malware payload", "value": "1624d702ef1c07d46c572ef14db2c17698d16dcb505ed52d40e0ed3b77f7b76ea350b6164106c0ed0c17f6e40e83ba0a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912490, "uuid": "9e3196ae-9571-4f6d-bf50-3989c6ff5988", "value": "2733F1D232E7823AC0D504F1F5276AD956BB9EC8F430A0C01E9FDE4116E31B56DA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912490, "uuid": "d53be161-4dae-4332-a32f-e45727594673", "value": "1536:iEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRhp:nnBrX5Eg5Enjq3axWIfkNwRhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912490, "uuid": "c2ea9999-6de6-4fa7-b88f-7d560d7c6bd6", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912490, "uuid": "1ccedc5a-4832-4f5d-80fb-5b4a91efc582", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912490, "uuid": "ab9bb8c7-2c6d-4162-82ba-3b1529f0004b", "value": "diagram-1668076456.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b89af9-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872772, "uuid": "7ef490c3-d3fb-4b30-b129-50a22e8546a0", "comment": "Malware payload", "value": "7c5e567c80d3db4a9df491eb326de013", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872772, "uuid": "9816c38a-81ab-402f-ab58-eeabcd701f74", "comment": "Malware payload", "value": "087bbd06bf50866e0b512ec43330a9840885bde11b4253cabd793fce8275e1f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872772, "uuid": "c7a11c4a-d62a-4405-9050-29f347e34187", "comment": "Malware payload", "value": "4bd1ce954a4559ed9ab5c705d78a36fda73c64ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872772, "uuid": "0d60c8bb-fa3e-44bc-bfeb-bbaf1679fba2", "comment": "Malware payload", "value": "32bbc65c2c417657e517179c92594762a41c505f12a7345f2050428dc209bc5a8bf42e2ee980807242be2152c15cad5d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872772, "uuid": "ebb9c852-d80b-4891-a8ad-3fcd73e805f0", "value": "343302F6E24275BCB643844A8ECC5F6B423B817056284EB1811EEFD2923D71B1791BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872772, "uuid": "bf3e7b3c-6a43-49a6-8bce-4c5ce1782783", "value": "1536:nO/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeVuSl:GXKAXh3TCdOi+KSZ4WauSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872772, "uuid": "0d588894-765f-42ff-b862-d819119e420a", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872772, "uuid": "91ff36af-644c-4f0f-9f5d-7dbacc7958dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872772, "uuid": "463a06f4-42c3-4bd1-b7b7-dde8b837aee2", "value": "statistic-1701231380.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b1a1c2-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910433, "uuid": "6e0d53ac-f212-4064-8ced-994463562efa", "comment": "Malware payload", "value": "8eac2db1c824b5f3d2f9d9120722fdaa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910433, "uuid": "26c5b72a-7148-4a5d-87dd-67900935837c", "comment": "Malware payload", "value": "087e38ca1205d98291f529bea097466be1290b11e10d83a427268e7d14814a00", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910433, "uuid": "15881e2f-0f3a-4544-abf7-0c2cbf8f4e01", "comment": "Malware payload", "value": "bf5236bdbb7b12b30a25de7bb3149eb5798b4e3a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910433, "uuid": "d406eb2a-c637-42b1-8741-0bc680f9fc90", "comment": "Malware payload", "value": "0223e8d2318879d3f9657c9e68fd01a17386b97513937306a5e890d99fd147ed35e150ea5b624cc71691ad97490038e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910433, "uuid": "e3be31ce-a39e-47a6-9295-8e0fca29ae4f", "value": "793301EFE014BEB7C1DF97004FA65B6116FE7A19D070A154836AC6F5E9836C3803A499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910433, "uuid": "1f4c3e85-e32c-4af6-a9d9-be906c315160", "value": "768:Lqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/Ld04O4:OxTuDqsF1Cnc3P57oj2+nC6uxkLd034", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910433, "uuid": "3735d875-32ba-4ab8-88fe-9b463e327b20", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910433, "uuid": "c5b0b523-927b-47dc-a439-b97875929526", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910433, "uuid": "6bc6370e-ddba-434f-82df-2157aee6da83", "value": "catalog-2000669852.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb0a2cc-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867044, "uuid": "b1bdf90a-fd82-4e34-92db-c9afecd1cd49", "comment": "Malware payload", "value": "150b5fdfdfb013b77d8e78c60f63f129", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867044, "uuid": "d8ec3e6a-3e81-44ce-bc60-a6e2ba2c0f24", "comment": "Malware payload", "value": "0888651709e2c1de79ac3d71286f01127492d9a141ddb0d01f2773f89f4787d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867044, "uuid": "dcae0dbc-ece7-4482-8324-53cdfe0b011a", "comment": "Malware payload", "value": "03dc0cdccad5bb236411bbb8861bcacebbe43b7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867044, "uuid": "73a48078-733a-4ed2-bc8a-093348e41ef1", "comment": "Malware payload", "value": "166f82110c066f6cde74a0001498db9ff459cb67a2395086c7037527ec5f1cc103878330b29a727acb14da40ad05670a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867044, "uuid": "22025930-2fa0-4830-9072-33980d96a02a", "value": "8433E1C4EF5BF858CA837377BC882FD66EAB026464DED09597C6309D0296E32621427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867044, "uuid": "3253a281-8ef2-44ba-af2a-4c56d8793b8b", "value": "1536:GAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3v3:9poAnd9gucKCQa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867044, "uuid": "359e4f76-64ac-4da1-aa2a-f9d17e2e5a69", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867044, "uuid": "83a882cf-e497-4f73-b909-4b8d9a055f82", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867044, "uuid": "552c23e7-ef95-4730-8dfa-bd51abea4af1", "value": "catalog-1274689307.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab8b2c5-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909663, "uuid": "be38ee48-5a68-4121-b828-51b2258ef963", "comment": "Malware payload", "value": "00a439d85ae75906369f21113ab66ba7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909663, "uuid": "d218b8c6-eb0a-4f06-bdb5-373816ae0a3a", "comment": "Malware payload", "value": "089b95f9e1e792070475b4bf074f9285cfe7820a8c8d76f5058078f9e3e7903c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909663, "uuid": "b9ab5af2-de3d-481b-a35e-422b06f96fb0", "comment": "Malware payload", "value": "9c7cb03460f35004dc337fc7accfeaa03954501a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909663, "uuid": "4fc07d6f-9690-4173-b4bd-4f52d715f4a6", "comment": "Malware payload", "value": "8c513ba764f3098b862a7402ea992e0bcbb86d16ddf9d0502dccdcc51b8c0fe33a89a0782e7231fd126d1158d14f449e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909663, "uuid": "b80c5478-b9e8-4fbd-b6b3-40840ecc33b3", "value": "003302DFE004EBA3C25F93005FF9869215FD7518E1708128979982F9EA833C2C53D9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909663, "uuid": "a8bd76f5-cace-4672-b969-afadaa0b0b37", "value": "768:pqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3glhfvv:0xTuDqsF1Cnc3P57oj2+nC6uxkLYXXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909663, "uuid": "0c2a12ce-c4ae-4c2b-a621-e3d040bc0c08", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909663, "uuid": "986c5771-1a6b-4dfe-b64e-c2f3337d51d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909663, "uuid": "0b746ec7-f7a5-43af-b77b-282fec2948bb", "value": "catalog-1408472022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b302f788-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867667, "uuid": "639ef735-c0bd-4bd4-8d19-c7ff4f3121d6", "comment": "Malware payload", "value": "96d5373b1a2dba24234c4adf08e07903", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867667, "uuid": "f18213a8-ef5d-44ad-b33a-bde7c42b1ac8", "comment": "Malware payload", "value": "089ec66cdb1d8d831f0dc796c6745947f39b55e055dae16bb126a4db828b619a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867667, "uuid": "c47dd68d-0ec6-4376-a72b-3f468a8d3b73", "comment": "Malware payload", "value": "b112edaa11451505e36c0992e189abca7d2fc35f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867667, "uuid": "f84f421f-7318-495c-b5d0-31d94ef05a76", "comment": "Malware payload", "value": "b59cdaca0361d1676b6950310147d691fc816eebac9a3fde126a5605861807a6f57ae9592072e09141ae453d173c8cbf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867667, "uuid": "168103b6-8791-4ee1-a42a-46e99fd6ad1e", "value": "FD33F1C8AF57F418CB9373BB6C882FA36EBB0354649DE0955AC7319C0296D27561036F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867667, "uuid": "620fc4d8-8bd6-45ca-aa9e-1d0a3f9671c0", "value": "1536:DAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHidhH:kpoAnd9gucKCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867667, "uuid": "b083886a-0cf0-4d48-ad62-d3188877e2a4", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867667, "uuid": "968c769b-24e3-4cc2-9a44-d86236260b3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867667, "uuid": "cc79cc23-5cef-41b3-aa8a-148f20afcd70", "value": "catalog-1782710690.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c27f64-b3bf-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620892049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892049, "uuid": "8ea6fff8-861a-4c90-8b71-5a3cebdac5c7", "comment": "Malware payload (NanoCore)", "value": "ec8197d2b3f4265bcf7534dbd47f25ff", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892049, "uuid": "b30418a0-b4b2-4cf8-b2c7-6c504cda415a", "comment": "Malware payload (NanoCore)", "value": "08a345684b22bc5e7fb8f6915596609613e6dad3a767b04a44faaee7bebabc4c", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892049, "uuid": "51637e32-d8fe-4118-bd40-1c523f57b79a", "comment": "Malware payload (NanoCore)", "value": "434867dd4c255e4a2d9e7396a41ed15521d925c2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892049, "uuid": "c68da50d-744e-4726-a3b3-441cf23df302", "comment": "Malware payload (NanoCore)", "value": "da768b5473f8c65cc19713714f2699031c63270da26b041c4f5929c91ba4c17fb286db1c5aeb0b050a56aa214b0ba195", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892049, "uuid": "49c6d294-6478-416d-9e77-a6d523cea93c", "value": "4915E0217354AF66F23E8338A521992087F27C1FEB11D74E7EE930EDA6B1F444622752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892049, "uuid": "2c3a91a7-64a8-423b-b820-fcbc9417c567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892049, "uuid": "78114613-642a-400c-b107-96f4309d9cc8", "value": "12288:pRLVfmJOkuQBo0RdecUjkQodMnGFzr4DZirI5vOgvvMoNC6MBVMO6FdzMjvLe5:p+EJQPLecUjkJMGFzEDmIXb1MyEvLe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620892049, "uuid": "40ef3e3a-4b1f-48a9-89b7-3e72c89c5cf0", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620892049, "uuid": "d4a86bab-2b44-45d2-87a2-462e0180c45a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892049, "uuid": "44b75391-c15f-4b58-9845-a22b37a29811", "value": "Quotation_Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7451aca9-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870139, "uuid": "7f0806da-ae12-436a-99b4-e9249ee7c691", "comment": "Malware payload", "value": "9e9148efbeb057011efc16508d66815d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870139, "uuid": "0587ec38-f512-4064-b85b-02daa2b45273", "comment": "Malware payload", "value": "08adc6da1534168da94cc62997766398824837655ab42918e958b607b4b61a45", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870139, "uuid": "9080ea9f-fe6c-40b2-b08a-817e9e0e2c2d", "comment": "Malware payload", "value": "0f087286151c98733e98ec2989f6f4a36cf643f7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870139, "uuid": "138446b6-e6b8-4b55-8c54-cb83df8360e2", "comment": "Malware payload", "value": "ca02c1e22a1d9f51d27ee5d8d2f4fdcf61aa09612ee02e3f7fda2f18385f5d34afa06ffe4c0aa76ab92fcdec57e2d5f5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870139, "uuid": "e98b2ede-f81d-4748-bf8b-752820309ce5", "value": "4D33029673FAA910C9F1C2B0A4E27588374F3D918E7D5DEE4C88A0793B920A4CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870139, "uuid": "1ed74500-ac8b-4eba-b3bc-3e71dd753fc3", "value": "768:j5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoS:j/czJJSI7r3Pwh8rS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870139, "uuid": "e68179d2-735a-4d1c-8df3-35fb2f5381cd", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870139, "uuid": "c95b7cd9-16e3-43aa-bb68-f7fd0387b80e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870139, "uuid": "087ffe46-7f5b-47b0-a247-abff7189b302", "value": "diagram-1685108918.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b317c6e2-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912335, "uuid": "6cc34f6d-9218-49b6-8f74-8733a7b80482", "comment": "Malware payload", "value": "2cfc154bc2a06e044cff46f30661b907", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912335, "uuid": "7c83e2ea-7c27-49b7-a2fb-556586905d3a", "comment": "Malware payload", "value": "08b192f18448e1ddd5361d9ad4a0f9bbf0fdd969a20b53575f2074c36f627bac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912335, "uuid": "650b3abf-ac88-42f3-9322-24025d342883", "comment": "Malware payload", "value": "48c2df91495def11ea2733e17a27529bb23beeda", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912335, "uuid": "8d7b2b02-8408-4fd6-b197-0a4d7fd30626", "comment": "Malware payload", "value": "4dfca912233c9b16ebc6e465236280848728089d96fc888699992cf35cce4f188b91a63530d1f0ab0e06e460d523a0dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912335, "uuid": "4d4654b2-e881-40f1-a6a4-d05ddee55c5d", "value": "0533F1D333D29139C4C449F6F52B8AD952AB8EC9E530A0D01D9FDA0112E31BAAD9270F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912335, "uuid": "f18e839f-f0b9-4629-bcb6-40eda91bb31a", "value": "1536:DEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwb6uF0:InBrX5Eg5Enjq3axWIfkNwPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912335, "uuid": "c655a6a8-fa9d-4cde-bc48-7dd53ec0da85", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912335, "uuid": "05c3eab4-10de-4835-b4aa-2d0ef6538a2c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912335, "uuid": "90a80158-612d-4d11-acc7-3a16d393c3e0", "value": "diagram-1544462645.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1646e509-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874276, "uuid": "f4345159-5a02-4dcd-8aef-dc98be864822", "comment": "Malware payload", "value": "ac521625060a46500c31660f30f6e395", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874276, "uuid": "e9e47723-eddf-4c91-9da0-097bb4470338", "comment": "Malware payload", "value": "08cef77ce6ba4ac51602027760f21eb815985c34c905e5225af3df1b60cfebf3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874276, "uuid": "cf12c576-0692-49ca-87ee-f330a251bce5", "comment": "Malware payload", "value": "65ccf3bc3f365e164ea04071e363e22c22ce561d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874276, "uuid": "a7813232-ddd2-4b33-899b-064fc90df378", "comment": "Malware payload", "value": "5bee3f16ce230b0e8f235df1018cbd1616e87ca0c8d0319d1624f4a29d919ab5f4a76d90772d8523dc17b8247e18620a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874276, "uuid": "b9cacebe-01ed-4c3c-be28-d977aa6956db", "value": "CD3312F3D602B6BCB64381494E8C5B47923B817067585EF18258EFA1E33D7270752EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874276, "uuid": "66da0a65-4653-44d3-970d-705ad7d76626", "value": "1536:F/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBh0:tXKAXh3TCdOi+KSZ4Wch0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874276, "uuid": "d1f435ed-1b14-4044-8fc0-8404d5769422", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874276, "uuid": "094eab93-77cb-43b1-8b53-37a5958404bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874276, "uuid": "1e5919bb-d8eb-4768-afeb-c915696601b3", "value": "statistic-751182662.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bb3bf8-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871624, "uuid": "ee37e229-880f-4d74-9ac2-5d8de95cc8c6", "comment": "Malware payload", "value": "cf7126180dc387e959eec27dd07f01d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871624, "uuid": "10967c01-dab5-4f79-816f-9e47ea2a4610", "comment": "Malware payload", "value": "08d03082b34ace5a4533552cc310adc79538a2d05b1ee0d3160bf6123805c0ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871624, "uuid": "77b98574-603e-4cf6-ae1f-c8a4e26d440c", "comment": "Malware payload", "value": "dc602f61e49f3a3bcf818508b7254e094ec6524c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871624, "uuid": "04a5d6a7-477d-461f-a795-c7a6e32201bf", "comment": "Malware payload", "value": "c386bf9fb3792ce49d88727853c620568658eddb32294720be5c570b1a842d88d336a1e259f87409e36aab3410e351e0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871624, "uuid": "5a691f86-4d7f-4ab4-a1b3-becfc23c6d26", "value": "9A33F19137F9A900C6F2C1F050E27699274B3D918E795DEE4C94A5B93F931A0CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871624, "uuid": "8ad9c72c-42cb-4c6f-842f-2767448d6aa4", "value": "768:Wd5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJnPv:O/czJJSI7r3Pwh8RxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871624, "uuid": "a1da17d3-1b9c-46f8-8ebd-e38d2acfcfdd", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871624, "uuid": "1e320915-3677-405f-95e3-94ce5c67ce39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871624, "uuid": "707b74e2-b6e1-4a80-a4ac-3a2a944424b4", "value": "diagram-840511432.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d8ba0c-b38b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869519, "uuid": "81c8de19-9f39-4da4-9022-735d7bc5e1f7", "comment": "Malware payload", "value": "428c890f9204a8090706765f39d221b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869519, "uuid": "2b8deabc-2ab8-4231-8383-fccef6f39f33", "comment": "Malware payload", "value": "08d6877450ddda690942f95b79f32f22f538d94e227d04a54080370f4dd45f9a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869519, "uuid": "da2fd969-3312-4aa3-9f41-a69cf560c9e8", "comment": "Malware payload", "value": "6d6c5e1e89c621a5588f2ee4e4b1e063225dff80", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869519, "uuid": "3038a5d4-f542-4bd1-872c-e960e32020a2", "comment": "Malware payload", "value": "e185efce7360f5ef4d473e652c8617223750645570dfa77a688d2d4409389bea8c98148e732c5f122c4de5ea45740c4d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869519, "uuid": "e6a76d87-8d9a-4719-be32-9dab12657331", "value": "8333F19137F9B900C6F2C1F090E17699274B3D918EB95DEA4C94A5B93F931A0CFE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869519, "uuid": "40d5577f-6dfb-40d7-bf94-4ca598fff79f", "value": "768:s5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJtZ:s/czJJSI7r3Pwh8RrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869519, "uuid": "aff2fe58-f2e3-4b80-9776-9ddec713364f", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869519, "uuid": "5eff177a-8de1-4d06-a889-cae2f47b6291", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869519, "uuid": "99296d03-c09e-4b89-9c26-dd2d036fafca", "value": "diagram-131714295.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13868767-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871694, "uuid": "0dafed06-df72-4766-be81-af771a636564", "comment": "Malware payload", "value": "9a78b57f6582ec706a898ff04a5c98b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871694, "uuid": "30bfe87c-584a-434d-b1ea-f7e73f81fb44", "comment": "Malware payload", "value": "08d89766f0f9034af89c5f03419e44b84e0cb0bd633a2a904e2a747458d9845a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871694, "uuid": "64688d80-67e2-489c-a8e7-7a946d0b3b65", "comment": "Malware payload", "value": "624aac2fee9ad3062b212470bf8a89b71d8e3065", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871694, "uuid": "650b0c59-3f58-4bab-93a5-2fb0ab91c23d", "comment": "Malware payload", "value": "e1580f625081b3074f949bf696a91fd69c5bf1e16d643cbca854aede7a8c3b5340ea1d6207f5ddfbaec52c9667cfceb4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871694, "uuid": "13e705c6-58d1-4244-b783-2daffa0668c2", "value": "C433029473FDE520CAB1C2F05092B689374B3D918D7D59FA4C99A0AA3F830A4CFD21C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871694, "uuid": "80d503c2-a45e-465b-8ba4-5a7e106b9016", "value": "768:G5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8Stn:G/czJJSI7r3Pwh8tv8x8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871694, "uuid": "a4a0372c-f0e4-428d-b513-1d395d013d21", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871694, "uuid": "74c35dd4-a66a-418d-b451-649452877f31", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871694, "uuid": "1a168ada-b29e-4227-918a-ce20ae798f1a", "value": "diagram-892255308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76b1722-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910302, "uuid": "932ef688-e045-4f86-99b0-ea0a5e6deb13", "comment": "Malware payload", "value": "113915686b94a3ebf0024da8319a1c4e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910302, "uuid": "6d35fe92-cede-4781-b760-801607b965ce", "comment": "Malware payload", "value": "08dd21cb64a79ac802a2db86eb92e3e8a1e36b24aba8585174f5b43eaf108429", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910302, "uuid": "e79d7195-db6a-467d-ad67-0a4d67977206", "comment": "Malware payload", "value": "9a7855f6fe84e9a739cfa03108fc02a15bc65e38", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910302, "uuid": "c59bdf37-6aa9-4f05-8c5d-8209eec57d4a", "comment": "Malware payload", "value": "9e74e7d0d4c43cc6044ad66691822df137c9d6692b07fc286b639d9b33f7c66bf60ac07702983f1c77b89e12e1958e14", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910302, "uuid": "e132e68b-86c3-41d5-a635-8d2190a5daa4", "value": "F733029F9014EAB3C15767001FB997A305FCB51DE130D15CD359C6E9E6836C2857E8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910302, "uuid": "fbec4ba2-817c-4f7b-ae10-41c4bb4c8c64", "value": "768:3qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7ujf:6xTuDqsF1Cnc3P57oj2+nC6uxkL7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910302, "uuid": "db57b98a-b1f6-4424-a899-09ed928d4121", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910302, "uuid": "6cf16f9c-a89a-446e-a9c7-badf9ad07d66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910302, "uuid": "b56ef39d-d62a-4fc0-ab62-7067d9ec0d52", "value": "catalog-1892844522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba426ee-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914819, "uuid": "6d5f1cce-07ea-4ca4-9ed6-b8f7d209f162", "comment": "Malware payload", "value": "fcc11a056d810ef2dba82463615e2e8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914819, "uuid": "fb01376b-c053-4059-9ed4-90f684eb366f", "comment": "Malware payload", "value": "08f199944ab6c7365102603b397fb98ceb7564ae789ddc067d2d8c242a684d5c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914819, "uuid": "2edf72f7-9433-4914-af16-cf9ffe3bfa29", "comment": "Malware payload", "value": "f0e87aee51226e19d64f26871a45cd13a0ee6375", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914819, "uuid": "30524586-2ca1-4eb7-9127-8e11c61876e2", "comment": "Malware payload", "value": "019f84aba1acead3202368ff2f52cdc7f89dedc7716c3d21bd15f7900647fdb5051fcae5e98ed24874616ec4b58f678d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914819, "uuid": "1c4524db-6426-443f-bc38-8c3e8fc57194", "value": "F533F2E65B23F5C2CAFEDEA3084523E5939BD49D71283C58552F254240FB568C4E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914819, "uuid": "d5e5a2f9-5382-413d-8645-f7cb557c933c", "value": "768:Ho4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/G5:9eKCVQbp4LTaI7ZaiNQMIXvG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914819, "uuid": "d9fe4fb1-4e4a-4bb6-9e44-4d72de2e07ff", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914819, "uuid": "5b67bbcd-b5fc-4e5f-b21d-ad6a4f609a05", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914819, "uuid": "f9328c3e-6ca3-4c3b-aa4c-a90df19b6c67", "value": "statistic-1316717360.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f519f6f-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872224, "uuid": "8b9ce03c-433d-4aa8-a078-5e40b48098df", "comment": "Malware payload", "value": "3f3ae87eff74b9ef4139c95cb40c8aee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872224, "uuid": "5c86e5e1-0584-4c4a-a1cf-2cebbfdbf121", "comment": "Malware payload", "value": "08f2599c67ef9fd9b70023b6eb5078ee3f18d4bf05bad65dc2590e43c20f4d9b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872224, "uuid": "218ec702-33ab-4ae3-a74a-1c01f04e510c", "comment": "Malware payload", "value": "758503a6a8f1f31a91d2a5d6462f675bee715348", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872224, "uuid": "d65a5733-c380-4245-b26a-704b3d4f3b90", "comment": "Malware payload", "value": "21f244cc9ebf7d89fc0dd62ef953587799579365673b4a0646eee2722285d0cf4e491fd158b598486ec18deedde78cb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872224, "uuid": "8a25d921-7516-4464-8f9e-e3900250a9c1", "value": "7A3312B3E643B1AC7743C48A49CC5D1B423B427056A88EB1CA1DDEA192397261B417EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872224, "uuid": "a864c6ab-d202-4d24-811a-9b5ea0edf333", "value": "1536:Mt/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexHYP:IXKAXh3TCdOi+KSZ4WUYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872224, "uuid": "ca25309e-a6ce-4736-ace2-783930b8684f", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872224, "uuid": "875da556-7749-44b8-8fd6-0bf3827aec3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872224, "uuid": "ea91010c-d118-4f7a-8b57-21b37d58ea5a", "value": "statistic-1313734872.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c388500-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866689, "uuid": "2b171a0a-50ef-4d9e-a7fc-80424bae33f2", "comment": "Malware payload", "value": "f4b08a6531f8e04967b953e755171aef", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866689, "uuid": "a20c3dae-def4-4935-9cb7-abf535d3b293", "comment": "Malware payload", "value": "08f5e239714e7cdd48bceac25bf45de0e4a7d8b829d4c7fb9716d6c878c3a9cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866689, "uuid": "20c1a515-41b0-4369-b5a3-de98f771e96e", "comment": "Malware payload", "value": "c1965659db5f94439a8b19df816c024499dfd7e5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866689, "uuid": "8171e944-1619-46d0-aa06-41716a7ef905", "comment": "Malware payload", "value": "5392d0d0ced119ec2f570d6af158737c1f4d876d8e9d0df240104ed7aaf8650eceadf9834097d4b344de7f8cc809daa2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866689, "uuid": "3f32dc3c-7ecc-40aa-9218-bf2108ee808c", "value": "DD33E188EF57B81CC79273BBBC842F976BB7026454DED5996BC2308D4287E3316102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866689, "uuid": "48811dd1-c553-4efa-946b-8f63e0fbe737", "value": "1536:2AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqZ:NpoAnd9gucKCIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866689, "uuid": "9aac8c45-77d5-4f9f-b629-c1c0356e18d4", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866689, "uuid": "1da900ef-cddb-4c19-84e3-20832b21a52f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866689, "uuid": "5a40153d-3bc9-4594-89b1-7dbd38b949a7", "value": "catalog-1033459163.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caa48ab-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867898, "uuid": "7eb88f92-f062-4432-8dc8-4ca5db45b552", "comment": "Malware payload", "value": "db5fc584161056357cd22786010980b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867898, "uuid": "a2c07b5f-d6a9-43cc-a843-b43a58097458", "comment": "Malware payload", "value": "092504857e8c8d0cfc96915dc65f968964b437f8df34ecbef075fbdb80609f43", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867898, "uuid": "24041d0e-515c-43bc-81a7-01fcc7a68287", "comment": "Malware payload", "value": "9c14630ab3c0e0eae2ce6874d0a4590326af2156", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867898, "uuid": "427f0b83-da4e-4e4b-9835-3bece8c72ad0", "comment": "Malware payload", "value": "3b8ce8b4ab8817eba6f2a4ef4c260986538d43a0474b439e410db430e6429b66a652026cfd3d4c28a5a74c497389a31b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867898, "uuid": "5eab3736-70ef-4062-99a6-b755303cd3d0", "value": "C133F1C8EF5BF418CB8273BBBC482F977FBB0254648DE1955BC2319C0296E67161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867898, "uuid": "6b22baf3-a12e-4e24-b06f-4f3fa0e10cb1", "value": "1536:YAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiAMAD:zpoAnd9gucKCAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867898, "uuid": "1f686c5d-acab-4a03-8e43-57775ba0f088", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867898, "uuid": "f9c133df-5eb1-4020-a362-ac4abf02252b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867898, "uuid": "8be289d2-3572-4b20-99ab-0a10c7e1306e", "value": "catalog-1959588866.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4894c5da-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870495, "uuid": "b19d22b9-5ecb-4e0b-bd92-70ef07d8de19", "comment": "Malware payload", "value": "79acf5cdf5d29325453273c3e43c0321", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870495, "uuid": "e10d65d1-82fd-4c60-87d6-30455f855292", "comment": "Malware payload", "value": "0928afef35f523274c6d692d7c4cb7dc67515ddc036049907a303aa577f04d62", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870495, "uuid": "7e409d71-e241-4f56-bf2e-923ceeb40dd2", "comment": "Malware payload", "value": "5c8db2736cdcf08ee44023c40b323f2db913fffb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870495, "uuid": "06e2c56f-d4d2-4565-908e-08227149dcb1", "comment": "Malware payload", "value": "0b3bd77ac9fd52e117505fc8f13e3d01233e389969bf489864d62ad37dba10143b3660c087407937970b10a864687f91", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870495, "uuid": "1b919af2-1c9a-4a8d-8866-f882ccc1d350", "value": "0933029673FEA910C5F1C2B0A4E27588374F3D928D7D6DEE4D8890793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870495, "uuid": "ab30d44e-345d-4a77-87a5-c47a819554f7", "value": "768:w5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJorc:w/czJJSI7r3Pwh8rrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870495, "uuid": "1a2ea6d3-ee1c-4e82-8fe9-a935af833007", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870495, "uuid": "8322d1cf-1fa9-4ea9-bd8b-d2ff2d8e355b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870495, "uuid": "f63b71c8-5d6d-4485-b6c7-16cc22bca24d", "value": "diagram-1957113074.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c8b9d8-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909496, "uuid": "d04bfd6a-2326-4d04-a064-9c616099e257", "comment": "Malware payload", "value": "de7460969794cfca6271983d4b8092dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909496, "uuid": "3563e79f-47e3-42c9-b511-31c8c12fbd7c", "comment": "Malware payload", "value": "0929043cd008a973c2a2c612af3f7bb6999465fc38f6a3b7e7d46bfa12d09c0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909496, "uuid": "2d58f7c4-ef3d-4614-813f-2f0c14cb484a", "comment": "Malware payload", "value": "4712a7a74e2f76a14608f7df042617a9326a7284", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909496, "uuid": "7fa7a149-1e20-4e9a-968f-a6774ec1ec3a", "comment": "Malware payload", "value": "234efff4f52c75651f186ccaf672c6e9b46f624bd842aa032e98bb80b7760135fd5e4ad7e3f8ee1cd775b24a30357d3c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909496, "uuid": "2dc8fe45-4f8a-44ed-b38e-2c59de9cd2b6", "value": "2E33028FA000B963C29F93016FA59AA306FCB95CE170C15C8368C6F9E9832C1C43A8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909496, "uuid": "f9a1fd73-0cc3-45dc-9e0e-5368fc9d2139", "value": "768:Eqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0CxfE:txTuDqsF1Cnc3P57oj2+nC6uxkLlfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909496, "uuid": "7d893c9d-5981-435f-b0a4-f1388cc3615b", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909496, "uuid": "989a4dde-57d5-4798-b638-0ec05b455057", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909496, "uuid": "25f95bc7-4626-4b74-a971-a17aacca9ae1", "value": "catalog-127312755.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3da6081-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909383, "uuid": "10bcf74f-e6f7-4f51-9d58-60e8c8c85293", "comment": "Malware payload", "value": "b26f6e8ae80a53f5c3052de3488e1b03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909383, "uuid": "ad8fbb6e-c51b-446c-93b5-fb00fb9b173a", "comment": "Malware payload", "value": "093844b806237b199d8feea0efbc4430814c738fd5ce89393e5194357283749b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909383, "uuid": "bf4ff950-23a2-4020-8d41-ee5ebeac9898", "comment": "Malware payload", "value": "ba21890f083356235bbe9bd23ac78a22740f3830", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909383, "uuid": "f1cb47c3-c0de-473c-b897-31c036c100bd", "comment": "Malware payload", "value": "7f4c9bb4bdc8480e32a4675ec28eec70a5ee1563d8b466b0477706bdcddf01185fd998ad5a8930f4882646a9baa95ac7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909383, "uuid": "775ce4d7-9f04-4e1b-b2d2-73219b14c056", "value": "DD3302EFE415EAB7C1DB66014FA59BA302FDB54CE0308628C754C3F8EA835C6853A5E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909383, "uuid": "01d0ef8d-7c8f-461b-a075-0cc2c1f56bcf", "value": "1536:axTuDqsF1Cnc3P57oj2+nC6uxkLiO91rG:axTqqsF41j2PxmiUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909383, "uuid": "ef87dcff-8258-4ba9-b497-573b662edaeb", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909383, "uuid": "cac7ca50-b5f1-46b6-8a32-5221b3e62126", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909383, "uuid": "a44ccd94-272b-4ad5-8121-ecae92670df5", "value": "catalog-1215698662.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ceaf37-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870786, "uuid": "6ba9b2bf-b049-4275-9a36-f340e887cf01", "comment": "Malware payload", "value": "6236abf981b9e6132d0c58b0e5d4a774", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870786, "uuid": "950647fb-93b3-438d-b593-f254bd0b9297", "comment": "Malware payload", "value": "0940d6ebd1d12960996bd9ad0227d4f53e9c6d5232baa84c5516f3bb60f078a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870786, "uuid": "43817d13-0c65-4d48-a830-872d6de5e5d2", "comment": "Malware payload", "value": "226845e1ec0ece06d96063448431f1b5a5fdb9cd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870786, "uuid": "6ad83787-6300-44fb-a7a8-688306fc2d25", "comment": "Malware payload", "value": "a6737093fb0df5b4b61d1f926e48169544e011a78a6dee16241490a1b94667dd8c4357aa92a13e5e1d08b93183aa1224", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870786, "uuid": "f1b2cc0b-d65e-47c3-8649-d78729877ab3", "value": "3733F19573FDD510DAB1C2B0A092B6893A4B3CD18D7D59EA0DD964AA3F920A4CFD22C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870786, "uuid": "d590a9d2-6f2b-4de8-b876-70d3c5e2eaa7", "value": "768:X5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8SfmGj:X/czJJSI7r3Pwh8tv8x8RM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870786, "uuid": "66fb2b32-7eeb-46fe-bca5-399fc3da0fe6", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870786, "uuid": "1f4f94b1-98ac-4172-a6ed-a1b2ad194a92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870786, "uuid": "987549a6-1f43-4b74-9e0e-1266ac0e5e2d", "value": "diagram-2126656005.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8717787d-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871459, "uuid": "78528f96-104f-428d-93c4-a0523a5d063b", "comment": "Malware payload", "value": "5b4f035e415ab70646ee0bdac30f2c1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871459, "uuid": "efb9fc9a-07fd-4200-baed-74a3529bb5b8", "comment": "Malware payload", "value": "0942568fa2a51f53d2d5a67b17bda0a49323f7552e8a36dfa6d135711c4123e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871459, "uuid": "f98e6ffa-ac9e-426e-9e43-9df735e90800", "comment": "Malware payload", "value": "fe1d39248ca0375ab7d38406b9890bfe833ca814", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871459, "uuid": "55d6aec8-3f26-4e89-a4d5-d299b8ef0a26", "comment": "Malware payload", "value": "653d4ad16e2c7d5a48e8d41e3d1c4b124c5627844574256c5ed4726a9c2f31db983f3ed5b228d3cc9c499b022df3ef10", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871459, "uuid": "5eb839b7-81c7-40ee-af13-5234837600ff", "value": "F233029673F9A910C9F1C2B0A4E27588374F3D924E7D5EDE4D88A4793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871459, "uuid": "911422cd-e6b9-422e-b667-b00727cc061c", "value": "768:S5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcu:S/czJJSI7r3Pwh8fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871459, "uuid": "19a75971-e495-4ae2-9a96-e39aad18a956", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871459, "uuid": "27f62516-8de4-4e8c-99a9-d8e860aa701b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871459, "uuid": "2cc7e21b-896b-401c-afa9-562412d9b4ab", "value": "diagram-690119237.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d271ed-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913921, "uuid": "7ba0d7e3-e2d6-4c57-b502-7475b9356f41", "comment": "Malware payload", "value": "fd799767161b1db4e1bfaed880dc1139", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913921, "uuid": "29c5dd3a-8d08-4b5e-b4c9-4e75ead74901", "comment": "Malware payload", "value": "0944c48163b0ddf304a5f97e174da9a651127ae8bfbf77391bc1f777a22e2a16", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913921, "uuid": "90571f06-8197-46b6-a4f8-fa03706f0c94", "comment": "Malware payload", "value": "399b4b21210804b94f05ca34ec3801511aa872d6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913921, "uuid": "3d14d91e-9867-46de-ad85-f701d7499994", "comment": "Malware payload", "value": "deca2a71b5191e26e984753d87ab195e4a1dd26a5f8f663573f10a64ac1822294a275e86b1df86035f315f6aa3b79041", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913921, "uuid": "84f4d86a-f852-4a4f-9744-e25df0518019", "value": "9333F2D233E3D139C0C115F6F5275DD96A978E88F530D4D02D9EEA4023D31AAADA278E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913921, "uuid": "8e678525-068c-45ea-be25-794bb3ee2a6a", "value": "1536:GEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciM5:TnBrX5Eg5Enjq3axWIfkNwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913921, "uuid": "1245143b-e4dd-40b6-a2be-3930168c9b27", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913921, "uuid": "874e8da2-567e-4a0f-8d0c-7b0907c9e93c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913921, "uuid": "f3db01bb-c5cc-496b-877a-ee29c7e5251d", "value": "diagram-656842252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40aed1cb-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870911, "uuid": "8d5379b5-81aa-44ec-beec-8c42bde1483f", "comment": "Malware payload", "value": "0733406c588e403a8a45e2c583fed620", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870911, "uuid": "02804611-07f0-45ec-9b3e-a06fa5dc7318", "comment": "Malware payload", "value": "0945875a559acee138ccbb1399dc6754b998756c8fb619503739609560f20244", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870911, "uuid": "9489cad8-ea99-41c1-bbf3-1cd98813b6be", "comment": "Malware payload", "value": "450714f6d5fe997c4d99d0374ed74609e5f68b43", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870911, "uuid": "c2caaeda-229e-4dea-b788-f09883ad4e59", "comment": "Malware payload", "value": "3010b265d2935deec8be3bcb6fd3e5d27df03f68218bf1c72805b62bd864bb3e81937f6d88617a962f63ff4a6bd51f54", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870911, "uuid": "0fe79ae2-c59f-4460-b2e9-afe9da3cc68d", "value": "BF33F1E473FED510C6B2C2B0A092A589364F3D91897D9DEA4CD864693F831A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870911, "uuid": "979174c3-7935-4021-b487-6b162d488082", "value": "768:L5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8KqVIWgg:L/czJJSI7r3Pwh8tv8x8j2ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870911, "uuid": "6aaebf67-f046-4654-98ef-6e60e756c181", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870911, "uuid": "d67c35ec-55df-44cd-9143-005aa695b1c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870911, "uuid": "d0d23e51-ff5b-454d-98aa-583ba4f32d0a", "value": "diagram-298723989.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7f32ca-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869507, "uuid": "06e8c509-bd87-4a81-b0e5-1fa49e232350", "comment": "Malware payload", "value": "62d87783d59c574e820982b7457b0b83", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869507, "uuid": "512e77ef-8f4a-4cbf-8349-bdfb94424479", "comment": "Malware payload", "value": "0945fb595c83087a7e4df18caf179feca80d5fe283636de4124800a32d1fdd2f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869507, "uuid": "56a4872e-ec3f-497d-89c7-aed2b7f5a76c", "comment": "Malware payload", "value": "64189941836ce937c349bc138d0a98bb43e1d1bf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869507, "uuid": "ea46c5be-82c5-4ce9-9704-b05b4354d27c", "comment": "Malware payload", "value": "4d7871e04ec1a633cce2cf5b1d6c3093eecc57d9eefb050021e4c44bc302ea274aaea4b7ab4f7da931999ad14dd6747d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869507, "uuid": "87f921fd-b6a3-4e58-b0de-198f0c2d320f", "value": "9E33F19433FEE510D6B2C2A090D275863B5A3D91493D9DEA09D8A5B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869507, "uuid": "994a77af-bf80-4fdb-beec-5ca5a072944e", "value": "768:L5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccm5e:L/czJJSI7r3Pwh8de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869507, "uuid": "5bf94e8f-3e7b-44bb-b115-aaa9759f11f7", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869507, "uuid": "4226b06c-070e-403a-ad80-e5b75163bbba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869507, "uuid": "f9bf82de-722f-43bd-9d39-91fbefdf9c78", "value": "diagram-130673300.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e763d9b-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620914716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914716, "uuid": "56d6a96c-7a3d-4606-bc8b-0fdcad259529", "comment": "Malware payload (Dridex)", "value": "000feb5fcdaaa54f1623b20817123e20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914716, "uuid": "8b9b044a-0a58-4919-8d62-24c0b31fa26f", "comment": "Malware payload (Dridex)", "value": "0948f620f1355a42917223748771e5116f28727da855c2011d45b8b9e1dd0d65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914716, "uuid": "8fe94df9-7c6a-4d65-9445-e33dba5e6022", "comment": "Malware payload (Dridex)", "value": "3c622619dfa9e68c63cc85a7bdad846e48d64901", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914716, "uuid": "ac0224d3-a9b8-4f28-85d4-64733152f759", "comment": "Malware payload (Dridex)", "value": "9e7a514f7ce26eec2e14d9acd28759b1f0825071e4a17eae93078322af9e4dc5397283c2316040a0a955006f4c0656a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914716, "uuid": "2220b504-0ecf-4910-b439-dac5e7648561", "value": "6FF3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914716, "uuid": "b4ad3829-2240-496d-808a-d31b0f690819", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914716, "uuid": "6fa8bdcb-ed2f-481a-b8bd-62803834c95e", "value": "3072:Par6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:ps4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914716, "uuid": "3a9ac5fd-974f-4d77-88fd-9eed2d22f8fe", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914716, "uuid": "1a55c2bb-703e-4ead-8be7-f77e174a8894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914716, "uuid": "9e3c5333-25e1-4138-bfcc-b347d85c3c66", "value": "000feb5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68919393-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873555, "uuid": "28e9a2c2-adf0-4543-8af7-d637daad95a4", "comment": "Malware payload", "value": "ea30d809ba3b4e1f0dd58ed95a75e8d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873555, "uuid": "67a79fa3-ed26-4033-bb0d-852a82ef1ab9", "comment": "Malware payload", "value": "095212f2d38a9eb046ae0b9366a2e3ac88438288b5d69f0aabd545f77e7d54b3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873555, "uuid": "70db769b-6bc4-4784-9f02-92b7f64fd40c", "comment": "Malware payload", "value": "91c0a7a5c5366379fcce619fb1e4f9f897585962", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873555, "uuid": "2f813dc1-a4b2-4339-a883-5155203cfbe0", "comment": "Malware payload", "value": "8523f291a7c6ea07005db7d28712e6430531cec27c3e2709b7a82636997323e5797c2341247407520c8f919c47eb4849", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873555, "uuid": "8e6c2af5-f450-445b-ba32-2a5eda208c27", "value": "453312B3E643B1ACB603C48E49CC5E1B423B427056788EB1CA1DDEA192397161B41BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873555, "uuid": "82044e76-2750-45dc-ad0c-50dd0dc7295a", "value": "1536:fb/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexHsZ:zXKAXh3TCdOi+KSZ4WUsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873555, "uuid": "9a061aa9-63f2-4c1a-be38-735ba20f592e", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873555, "uuid": "0a090d51-15e2-493d-8d3c-b11c818cb1de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873555, "uuid": "e9f196b1-bac5-4b98-974f-278388157244", "value": "statistic-2113402998.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f98381-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916312, "uuid": "ad3edfa4-060b-4158-a1bb-562b42cf94fb", "comment": "Malware payload", "value": "7d87967cd2d416d6352acb433cd4b453", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916312, "uuid": "a35b8103-6edb-462b-a504-af6f633bdff8", "comment": "Malware payload", "value": "0953dd1f6dd7df009442d1c8546905b123397b21ecaee6bb744ddaf3ad6ffa98", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916312, "uuid": "49cb1696-a000-4964-8aea-1ae4bc737d18", "comment": "Malware payload", "value": "b9facbca5ec85831206e3f8128acca3b2abf72af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916312, "uuid": "498788b9-d7e1-4986-8e4e-709d5a1f18e8", "comment": "Malware payload", "value": "529024bfb09f355238baa7934d69839b3af31e04061d4b87720ffb2257e1e5d7e99627e4c0365bcc0d1888e3f3b9f866", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916312, "uuid": "133e5b75-8f12-4cef-87ca-eb646fd2e9e7", "value": "FE3302CB5A13F6D6C7F9EEA7044A62D4A39FC89D30247C24592E258381AB158C4E6BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916312, "uuid": "bd19617e-9f06-4d6c-aeb2-73122f1b2297", "value": "768:eo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SqEseL41:GeKCVQbp4LTaI7ZaiNQMIXaE7LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916312, "uuid": "39cbc1ac-c15c-43bd-9f5e-3e8d5f9f7ac3", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916312, "uuid": "064cb687-c3a3-420e-8dd5-2f55b5a942e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916312, "uuid": "9f4a2f8d-e104-4bd2-a851-0f0898e695d8", "value": "statistic-534993968.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b94084-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867755, "uuid": "77fe3afd-9b90-4008-8169-da7030c8e481", "comment": "Malware payload", "value": "21c7fd1750b46e3a54135a9a2de32c7c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867755, "uuid": "ae84bb86-942c-4ca5-977c-9572fe0c3fc0", "comment": "Malware payload", "value": "0957d1c454731d902775d9edc792aa63761f35d73c8d3e0cfc39258d4c9369a8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867755, "uuid": "b9787443-73c0-49dd-adb9-ed326c8aa46b", "comment": "Malware payload", "value": "ab5476ed4a569232eb8f5c7c6e529c4f96e1b53f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867755, "uuid": "10bca10a-d84c-40e3-a41c-a4f61fdcd8ba", "comment": "Malware payload", "value": "8365a67ce2f414bb8a31670c3aca9632bb53c32b126259e5b20f6f5786af0bc6cefae97bbe3f2c987c27f877b59b0218", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867755, "uuid": "7fb5eaca-e7b2-4447-bda6-0e9cf0236e9c", "value": "0F33F1C5AF57F814CA9273ABBC842F976FA7026474CDE1955BC3319C0292D3316143AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867755, "uuid": "2b47e900-78d7-4bed-94be-42e63b8e419e", "value": "1536:dQAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiBVO:5poAnd9gucKCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867755, "uuid": "2743e48d-86eb-4793-8593-68066cdff058", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867755, "uuid": "7cd03fd3-62a8-4619-a612-c50ca7a9c021", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867755, "uuid": "26134219-588e-4f02-aa59-a7f732049411", "value": "catalog-1842833935.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2348a9bc-b437-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620943447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943447, "uuid": "597856fb-88aa-4cb9-bd35-7ebc0f66dd55", "comment": "Malware payload", "value": "d0b807fdbead5d6bc656e0604faec838", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943447, "uuid": "53218014-cef9-44ab-9109-88a30ada5e4e", "comment": "Malware payload", "value": "095a8025cea70c557f7af0c6663048171a673b55ce1db7e82b41d0748bae4f95", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943447, "uuid": "845a84fd-3b7c-499c-bf78-6e8bc756eae0", "comment": "Malware payload", "value": "7e6332e5628986c195fd3141e5d5dae2ddc19a3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943447, "uuid": "69ad8139-9f3c-4053-a92b-1315e2a49f7c", "comment": "Malware payload", "value": "3195bfed25592156fcab6ac7696b2f2479a7394ee1ed4b8179358ad24d354226294b1cdcff1a4a3705beda912d5ec3c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943447, "uuid": "7390788e-e714-4dd2-a193-0ad435136051", "value": "3DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943447, "uuid": "5f3a3a3f-5fef-4513-b867-68b78a96648a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943447, "uuid": "12b05e2e-ba55-47bd-903d-fa966ccbff2f", "value": "3072:Tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620943447, "uuid": "cfc2c9d9-5f98-4954-8277-f7a3a12b052f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620943447, "uuid": "cb0d449e-9b63-4763-84ab-b2d3317ebc81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943447, "uuid": "9247dab3-3386-40a5-a332-4118c7b32d36", "value": "d0b807fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cde0655-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914794, "uuid": "de0149ee-20df-49e8-82f5-294d97ae08be", "comment": "Malware payload", "value": "b5551d8121a388f1f50d78c83addfc6d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914794, "uuid": "f9d9af6e-07a4-4915-960c-8a4153b6f6d5", "comment": "Malware payload", "value": "095d61056121d9d66103c09c067d31bb4e6d99add036455e947f1372d47dd505", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914794, "uuid": "f9294bd9-abb2-4ab9-98d0-dc9114b1fc48", "comment": "Malware payload", "value": "e021f01f24d48344e43b5725a0470a5925bcd958", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914794, "uuid": "ed10bd16-4f7c-4c74-9925-d493efab5ce3", "comment": "Malware payload", "value": "28eaaf00993ee70e64ec08b86d5d12a467faebd20e3f168c66c8356f646cf6bac49a6efed296c19e0637343187a5a8fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914794, "uuid": "116ca515-9eda-493a-b033-09564d3233e6", "value": "443302E65B23F4C2CAFEDE63044523A5939BD49D75283C5C552F258240FB568C0E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914794, "uuid": "26a56932-e220-45c9-a99b-d3852d2ec2b8", "value": "768:zPo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/qCq:xeKCVQbp4LTaI7ZaiNQMIXvqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914794, "uuid": "c8de0b13-aa1a-49d5-b8a8-943b2c9a868c", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914794, "uuid": "9fbdbb6f-2b21-490c-bde3-ba19cabec3f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914794, "uuid": "d3b19738-63d8-4873-955a-0f112bb948d2", "value": "statistic-1287347507.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87398b9-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874602, "uuid": "4664246c-e7eb-42b7-974a-c3e41db922e7", "comment": "Malware payload", "value": "e6b583cd5d110c914901780c8ce6721a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874602, "uuid": "f5569912-0ab4-47e4-b46e-0cc9caebc7f7", "comment": "Malware payload", "value": "0962e052db4e103e00788f2fa3d4f54a9ac7b1306fa9a958ea749adba16205f1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874602, "uuid": "0c8b19a6-bc24-46cd-8955-2886cd47f732", "comment": "Malware payload", "value": "4230279605e9005d57005b1f87d2c337c87d3c7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874602, "uuid": "2c7978d0-af10-4b0a-bd03-c9bbde90d882", "comment": "Malware payload", "value": "7776800db5557b3d19497c85a8cc21092b692653f94f7243a3401cc3a7783d28c4eb8cf5eccc171dc8ff10491cea304a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874602, "uuid": "e18ef981-bb92-40ac-b02f-0b785bbd4895", "value": "7D3302A3C312B2BCB643C049C9CC1E979377427026658EE2C56DFED1A63D7160B61BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874602, "uuid": "824f32ee-f949-4a42-b599-d4213e461b40", "value": "1536:l/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8L+uG:NXKAXh3TCdOi+KSZ4WBRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874602, "uuid": "f90c1091-4512-45b2-9d67-5ac31d977924", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874602, "uuid": "4073dff7-6d61-45c3-ace2-47b2dacf6ab7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874602, "uuid": "32df131f-71a4-4937-96d9-61ae49026c86", "value": "statistic-986919601.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120b70a4-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "7bfdf616-e39d-4fa2-9492-81fd53748989", "comment": "Malware payload", "value": "ac1d5211ed9396afe3b2d24254990404", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "9763daaf-7cbd-417d-b2cc-38fba15845e3", "comment": "Malware payload", "value": "096d6c79c5b3a418e3c7fe894132859c35cf976c7cc81a5932dbfd508e04b98c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "c09aac84-7f31-4619-9afb-061ff44a76ae", "comment": "Malware payload", "value": "fc47af5def90c58f504e38131c74c48a598d5179", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "75afe07b-9867-482b-98ee-1bcb253a8c26", "comment": "Malware payload", "value": "1eb72b536bd8cd726083bc4aacd838b70bb205c0f26ba0a8e8affd2dac52e1c323ef2280fbbfb67b9a955b0f5ec69008", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871692, "uuid": "b01c1e34-c921-438f-a985-f2a9b221b0d5", "value": "5433F19433FED510E6B2C2A090D275853B4A3D92497D9DEA0DD4B5B53F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871692, "uuid": "3c6982ae-a23b-4892-853a-9c59bdfe08fd", "value": "768:Z5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccS5k:Z/czJJSI7r3Pwh8Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871692, "uuid": "2e3a8251-26fa-42fd-91c4-938d5d768dbd", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871692, "uuid": "43449f37-69f3-442b-95fb-7df5503bb09b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871692, "uuid": "896a93c1-207e-48ea-b011-673890ff2449", "value": "diagram-890703723.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021ac9f3-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620867800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867800, "uuid": "68ddbedd-0dc9-4ca9-ac65-5361a51dfd87", "comment": "Malware payload (Dridex)", "value": "2509cd6f03ace6baa39fa0c718ffe908", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867800, "uuid": "97a027d9-73e7-46e5-950f-4d643acdb919", "comment": "Malware payload (Dridex)", "value": "09720fc1b126378dd14e672701b3eedfc3d04a7146be9be5eb8f0ed66f9686be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867800, "uuid": "d30b5397-1ec6-4e13-ae88-6eb5762e8de8", "comment": "Malware payload (Dridex)", "value": "91b8ef0c162b6d6761a7a05f5289ffb7e2b13b50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867800, "uuid": "84243b4b-64b1-4d6e-a1ca-0c1a0e4026d3", "comment": "Malware payload (Dridex)", "value": "2a18fb090dd9b92b2a02386e6161260eec5a8aa174e850a11263673f170aaab38b31a5d56cd3a94015aef53346e3afcb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867800, "uuid": "fd90e836-8407-4b55-8775-9718806f1dd5", "value": "F8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867800, "uuid": "f552fe14-c7d1-40a0-a72d-c458119a4cd8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867800, "uuid": "fa4b35ef-1830-4949-aef1-d88c0b19b2fc", "value": "3072:+A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:+3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867800, "uuid": "fdebace4-0494-42ef-9902-00d57f164e76", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867800, "uuid": "1d1cb042-2c18-4035-8764-bb481d0b1311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867800, "uuid": "38a02032-50c5-41a3-9068-b2a48c3f220c", "value": "2509cd6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b5e1a6-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872767, "uuid": "ea4098f7-6182-44a7-b62f-9977e942d9ee", "comment": "Malware payload", "value": "e88e6c7cce33474885cf7484968d42d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872767, "uuid": "0d831ecc-b4fb-46fa-bb64-d5266e06a13e", "comment": "Malware payload", "value": "0983aee08c690fed23fe68aaf8d03767a6fee543a637b694be533a21885695af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872767, "uuid": "b56aaf42-939a-407b-9ce2-b15971cce1f2", "comment": "Malware payload", "value": "8fe793c959310e15fd1be15376fd1393976ddd7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872767, "uuid": "518d2d16-eab7-4ecf-ae7c-d75bf1bf8476", "comment": "Malware payload", "value": "bcb6d6e298e3544a57ca3d9f4eb3c1b64c9a0063b146d3b2f919ae7fc7d3254ea5fd7d9da14fd59c47b92338a59d414a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872767, "uuid": "bc549f6c-ddf9-43fa-b4a9-875ae6586a2c", "value": "483302F2E253B6FC7643844E4ADC6F76523742B046690EF1C15DFEE2923921E0741AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872767, "uuid": "e6fd5f57-c4b9-4cdd-9082-af8e170455ea", "value": "1536:An/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFL:6XKAXh3TCdOi+KSZ4Wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872767, "uuid": "cc4eb3c2-86e7-478c-9509-fcefbde1a02a", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872767, "uuid": "5c6bf0e5-07f8-4a25-849a-b86d2586a45b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872767, "uuid": "d963644a-62c9-4f61-8b68-62cf7be9ac83", "value": "statistic-1694546127.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb79297-b405-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620921939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921939, "uuid": "1809b624-edd2-4a65-bc27-1bf59ad3569e", "comment": "Malware payload (Dridex)", "value": "4a9309a47868c41264b166b69e2e5b3e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921939, "uuid": "5abcc2f8-aae7-4971-af21-c30fed419a5b", "comment": "Malware payload (Dridex)", "value": "098ab4cf81dc93d4c45fccbd7b8dbac0927096403197f427dfde293800918c1d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921939, "uuid": "c05618e4-51ae-47f1-b309-6944cbcc9218", "comment": "Malware payload (Dridex)", "value": "dc5f6230ebab9cb2c9c3888c3a01800771a9e288", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921939, "uuid": "69641c95-175b-4204-ade0-eddfd056d0a6", "comment": "Malware payload (Dridex)", "value": "5ff32437980a673fd3869379b4361b127f0fd0b39de510308c88966b1ef2c135b1d8a5021d45604f38b65c99f4d6838d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921939, "uuid": "8aca4070-0274-4fc8-8ace-75c6f8bdadb9", "value": "B6F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921939, "uuid": "1bdec4d9-8307-44af-9ef0-885df1cbd947", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921939, "uuid": "32209307-980d-4978-8657-29595e23e21c", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620921939, "uuid": "23fb1d3b-0e60-4175-b72f-c62d1d3ae682", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620921939, "uuid": "8723d3eb-a9c7-4f9c-a27f-c32426283cac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921939, "uuid": "bd8db6aa-982b-471f-8176-4be41f88f676", "value": "4a9309a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240f31c7-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866998, "uuid": "960148fa-dc69-4179-ab8c-20433abc8b3c", "comment": "Malware payload", "value": "65f2e5cdfb97d190da77a9d3ecd4a8f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866998, "uuid": "6dd528f1-c69f-4d3c-8ff7-8aebebebfedb", "comment": "Malware payload", "value": "098c43d5f39ce1d0f66aae1c5350a70fcec6fce26a034c9fab150075920b7f33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866998, "uuid": "a021fc83-ff2b-4614-a2d8-ebeffb03d1ed", "comment": "Malware payload", "value": "a70ff9537f7a2f43e64352a5baa3e2c02572a38b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866998, "uuid": "5066239b-1baf-4603-b056-21501dfcbd93", "comment": "Malware payload", "value": "da09cdc9f4b8014695094096080eb872f1874fd1ee7a6ffde8ab90f8664d903b02bb72f3269d78d6f0e3441c39028d3a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866998, "uuid": "71f6b153-e827-44ed-87aa-083be7cebf49", "value": "C033E184EF57F518CB8273BB7C882ED7AFBB025454DDE4996BC3319D0286E32561026E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866998, "uuid": "db98e936-9442-43f4-b4af-a8d66733e6a4", "value": "1536:WAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqW:tpoAnd9gucKCIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866998, "uuid": "1a94fce7-f43e-4c70-b8ec-187411c0c85e", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866998, "uuid": "a05c6f3d-0fc0-4132-9ebb-bd15c0b8bf0a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866998, "uuid": "d5e592fc-a755-4073-8956-b8b78a942eec", "value": "catalog-1240748385.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0917b519-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915056, "uuid": "acf61484-88d2-436d-8640-dffeb7c910ed", "comment": "Malware payload", "value": "3989ddb98362004ec7365db7ebb8ebc4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915056, "uuid": "c5e8c100-4fb7-4619-9d97-564ddec58b37", "comment": "Malware payload", "value": "09c80d0a37e802ae2fe946c62818466b4184d0ab0f80be77abce10f7d2cb761f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915056, "uuid": "91824851-e2a1-4eeb-91e2-eba5b3c9ab25", "comment": "Malware payload", "value": "28cff7c8d77c03ef208d5eea2111992252f64b48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915056, "uuid": "26641493-63ad-4746-9081-5460a55d1140", "comment": "Malware payload", "value": "a65b4b911206dd0438695cf6d4081def075d82ea96d788cdab943e8096f31bcdf5418695fdccb7297038224e61257eff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915056, "uuid": "fe25756d-63f3-42d3-8b48-5203a9227341", "value": "F53302D2AB13E4D38AFBEAA7085252D4936FDDDC31147C58192A298345FB168C0E77CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915056, "uuid": "e86a7fcf-cd1b-4749-941e-3f95ca02938b", "value": "768:Mo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ScjA6F+m:geKCVQbp4LTaI7ZaiNQMIX4Fnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915056, "uuid": "eba937d8-dc4d-4db1-8309-c9a279a1a49e", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915056, "uuid": "57f66021-7d52-4be5-b8c0-34a49d210e08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915056, "uuid": "d5c0a90a-1812-4ecc-a48d-e979e9d4d1e6", "value": "statistic-1503722077.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a495715-b3a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620882148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882148, "uuid": "2d970cdb-9156-45fb-b55d-bb4e77dde127", "comment": "Malware payload (Dridex)", "value": "3d006cd2d3fa8ddf34de8772787217b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882148, "uuid": "166476e4-6a3c-42d7-8650-f850583e13c9", "comment": "Malware payload (Dridex)", "value": "09cdffb63e4627df479dcba3afdf80e8a8016b059c1ae750763ed9d45da203ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882148, "uuid": "5dbf3950-14bc-4a3b-930b-7e3331ab9ceb", "comment": "Malware payload (Dridex)", "value": "fd78dc8bd7b47508b512c015d40baf20d413a2e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882148, "uuid": "355e43ca-53d6-4f27-9ad7-09d029e8058c", "comment": "Malware payload (Dridex)", "value": "7d40b384bc9a4c28ad1abaf2d2fd276046996d99c86f509e08cdbe011bcb7412362a87183cd95f145e22782eb313f4a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882148, "uuid": "314f8383-1b58-42e9-be55-f145ce94b03a", "value": "B2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882148, "uuid": "e494ba06-f306-4911-9ef6-6e809be2cce2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882148, "uuid": "3b234fff-c494-4c0f-bf48-57dae48069a8", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620882148, "uuid": "67080a6d-528e-46c4-b780-136c4e666dd6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620882148, "uuid": "24aea177-ad7d-4002-a887-4e8890087c8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882148, "uuid": "606e616e-b803-4eab-a868-4c86b5c60eb6", "value": "3d006cd2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48997d35-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873931, "uuid": "6b6d0aeb-94cd-4a0b-a1c7-f10a6787c13c", "comment": "Malware payload", "value": "078b454a199a4d930d8f1e4dcc5fe0ed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873931, "uuid": "2f7cae8b-2633-42fc-9533-5b92bc3cee44", "comment": "Malware payload", "value": "09d785b09a5f1b644c0b7695af55a2575e5a6fa9d47bad073251800820e72453", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873931, "uuid": "42ae29a2-ccdc-4c73-8c49-78b71c831500", "comment": "Malware payload", "value": "92a455dfcc4fd7b76930f03581b4382b0dcecda1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873931, "uuid": "bdfced35-28d0-4357-84e3-387feade9b12", "comment": "Malware payload", "value": "5c8aff692417d2ed6f1f285451dd73b2d78a7ab2068a607494159c3132d4bb9b122a50f10d85b2183b2bc809caab695f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873931, "uuid": "c774a2dd-f232-4bf9-a4a5-2c4d4e616c68", "value": "CF3302E2C312B2BCB643C04989CC1E979377427026658EA2C56DFED1A33D7160B61BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873931, "uuid": "5d0ed469-4b36-4887-be10-5a46874b36e2", "value": "1536:w/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8LXsj:AXKAXh3TCdOi+KSZ4WBRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873931, "uuid": "dd07e625-77da-4738-be5e-58ddbb353b34", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873931, "uuid": "8d1255d4-bc34-4e3b-b59a-b1996be43147", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873931, "uuid": "6a201616-38f2-4738-9714-bd1ab3ade03a", "value": "statistic-467707309.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c2b404-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871381, "uuid": "e84cb689-8e8f-43ee-abf8-3a11f57c2e0e", "comment": "Malware payload", "value": "a647c0a3c4dc3edbbbfcdf070acb2a95", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871381, "uuid": "9b83ff22-451e-43a5-99f6-65319b259789", "comment": "Malware payload", "value": "09da11033e26ca30447851105ef87dbf7fa033383eb6a22534360bebdeeb4bd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871381, "uuid": "11971837-4f29-4630-a805-3bb62129d193", "comment": "Malware payload", "value": "f3353ea7e01d643d81dbd2f8702f1e41f469795b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871381, "uuid": "91ed7843-e1ae-4e25-ba57-3bfead2a8ed0", "comment": "Malware payload", "value": "5a7831e7d5d949d5695316e41783cb06d80b98efc6d3b1959b47ed71982332d89c850e239cededec891732d8b27d7744", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871381, "uuid": "f5d50baa-6b57-4297-9cf2-ca69de1e0a44", "value": "8633029673FDA910C9F1C2B0A4E27188374F3D918D7D5DEE4D88A4793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871381, "uuid": "12b54af3-3159-4437-a290-6faddb5da3e3", "value": "768:L5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoRX:L/czJJSI7r3Pwh8rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871381, "uuid": "d5dbd3bf-fcc0-43fb-9ccf-01858957757a", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871381, "uuid": "406b2acb-f94c-4b01-b008-d8ffa2952f07", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871381, "uuid": "9453c617-175d-460b-b921-0700b5dc2666", "value": "diagram-639468074.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e562b4-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912209, "uuid": "8cb0bf83-366c-4d77-9de0-7065811a2d9a", "comment": "Malware payload", "value": "f72ab9a241f423a2cd29cc6f2a1dcfbd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912209, "uuid": "3deeec1e-6618-4d4c-b517-21b60fd54cc3", "comment": "Malware payload", "value": "09e15b96bbb88bb03be29a40ee36abb4d16f0552c604fe42c20604b3aec6e056", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912209, "uuid": "7a1e27aa-8aa9-4d19-99fc-0bc8d5d39abc", "comment": "Malware payload", "value": "3f85d82a28e0d696e417e9019f2ff62bae931f16", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912209, "uuid": "daf4d5f8-4889-4d63-bca0-737e3f51f9e3", "comment": "Malware payload", "value": "e4978d1bf26a3fc3826893b338a405be458a3c825892561a22132b6a2e70e06f3e115d27e2bfdabccafb2fbfab1024ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912209, "uuid": "41e2e533-e269-488c-b7a6-3d855b8a907f", "value": "FE33F1D132DBD53A80C245F6F82B69DA66A78BCDF930D0D02D9FDE0112D2165AE9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912209, "uuid": "6c9ce7e8-11a0-4651-afe9-bee4e9523762", "value": "1536:hEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYn6:OnBrX5Eg5Enjq3axWIfkNwY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912209, "uuid": "d16d3467-f9ee-4bdd-b272-90f2135e79a9", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912209, "uuid": "174695f2-65c2-489d-8e93-964e6da27bb7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912209, "uuid": "555442e4-a978-4005-89cf-bb37e170df13", "value": "diagram-1459176318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2690fb71-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873015, "uuid": "ceb6be04-e426-44c1-a67d-746da1661ef0", "comment": "Malware payload", "value": "1cf73bf71af2e02a80873bf53e24cdd2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873015, "uuid": "a38742ca-f4c1-4e97-b857-7319b426c0e6", "comment": "Malware payload", "value": "09eefa87835a1b7369d424629620e359f53e65b92fdf8b48131bb9e0fa259c70", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873015, "uuid": "c4b38ad4-fbbd-481c-8a90-406f88ab7d13", "comment": "Malware payload", "value": "71dee2899a5401167c5a8d62147497838161cff5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873015, "uuid": "716cd652-6bfc-4f6c-8a1e-beae2a88440d", "comment": "Malware payload", "value": "8e36456764828e18ca0087c17f355ad37e15d234e2ec71373b2446a38c52d1a22313fe49ed83d1365204bdf635fdeac7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873015, "uuid": "f9ee8c75-5edd-4fd5-96a6-e0e4e3d09a84", "value": "7C331266D243B2BD7143C4898EDC4E6B5237813056689DB1C92DEDE3D23C31E0B4366B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873015, "uuid": "4780ef14-4868-4e0d-8462-1b63f25b5692", "value": "1536:PW/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeIGS:mXKAXh3TCdOi+KSZ4WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873015, "uuid": "e25465c9-839d-44c4-a858-4f08c71cfc0d", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873015, "uuid": "bc9526ff-35ea-47ca-8799-dbd9f24abce6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873015, "uuid": "4e345fbf-4381-4285-a325-57854bc1f8ff", "value": "statistic-1848840708.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f13b8be-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870211, "uuid": "33a640d9-d44e-4d7a-aa40-ae9413fa1005", "comment": "Malware payload", "value": "41f6ce6ece5de673444898f950c906c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870211, "uuid": "6842279f-6582-407e-a507-e7c581caa9a2", "comment": "Malware payload", "value": "09f7921192f089f6d5ea03510669b8ef35dfeaa3ce7a94b811d7bec1a47409a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870211, "uuid": "8ff437a8-eb9d-4cfe-9114-2b8af51171c7", "comment": "Malware payload", "value": "44f786194a8fcdf3d9bc05b6827fa6bf6143f483", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870211, "uuid": "dc406164-8980-479d-afd2-15473b745930", "comment": "Malware payload", "value": "30ec670108bdbf789d78b275fda25bb2fa080d89098b00c6697076a8565aaffd9f6c9444fe77922c5a6ad7f8123e9ffb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870211, "uuid": "949ca351-fe23-4906-937a-39d3d44eaf4b", "value": "B633F19473FED510C6B2C2B0A4A2A589364B3D918D7D6DFA4CD464693F831A4CFE22C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870211, "uuid": "45fbf64c-fb90-4472-8aca-0da2ab9548fa", "value": "768:u5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8SLVIWgG:u/czJJSI7r3Pwh8tv8x8q2nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870211, "uuid": "3a022c9a-f05c-4551-baa3-9b6da9c292d1", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870211, "uuid": "8cf890d7-8987-4687-b337-6b7bd6eba3f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870211, "uuid": "ce7eb8f0-4f88-4288-b8c3-7e8c277fc2c1", "value": "diagram-174009934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7adfa2-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913241, "uuid": "7af53310-c244-4b1f-952b-5266a1c9bf79", "comment": "Malware payload", "value": "b47d0fffc21f83af4b7d1dda44757bcb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913241, "uuid": "409c9375-dce6-4929-a04c-866311cb04d0", "comment": "Malware payload", "value": "0a0d13b002f23523884c6c0aee1a1458a037a74d0daadda20170b7c150e2e76c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913241, "uuid": "b5da32a9-727f-49ed-b773-157b374f2b5c", "comment": "Malware payload", "value": "a0c81318beb71d79ff394a68b02544d7e3da7cf4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913241, "uuid": "da6f6d65-d9ff-478c-86bb-806c7f396279", "comment": "Malware payload", "value": "19192616d76b1cf9e8f0e9b59dfab93e08c6d3edf187480824e81ac0f80626a34f6c7fe12896c581ee07c8dfc6ab330f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913241, "uuid": "4b5950e5-923b-471c-a775-d324aee33a3b", "value": "B13302E232E3D17AC4C509F6F43759DD56A78D98F83080D02E8EDA5122D31B96DA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913241, "uuid": "ad2ce5ad-ea7a-4c9d-8b69-b7a2b9ad0efb", "value": "1536:QEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHVRf:VnBrX5Eg5Enjq3axWIfkNwe1Rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913241, "uuid": "b419a13d-3e8b-43e7-a60e-810462c56875", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913241, "uuid": "ebdd4a4c-5f5d-4fb9-9ae9-2885f28fea22", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913241, "uuid": "aa26d015-a88c-40a5-8bd6-d5155ccfbabc", "value": "diagram-2108753667.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bd592b-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867242, "uuid": "d950e6bf-34e3-4d96-9cf4-ec81c71b5f62", "comment": "Malware payload", "value": "0b2cdde606ce7a1379cb96c053857147", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867242, "uuid": "22176242-f21c-4fd9-ab04-0171e799609e", "comment": "Malware payload", "value": "0a1b4993ffd91d9bcd7d164227a483404831be51800b7d6550f65b0faccbff05", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867242, "uuid": "36a971e8-f52a-4e78-91f2-406d8e3f2e01", "comment": "Malware payload", "value": "af955e17b7f935b26100d557aba060f06abbcdc7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867242, "uuid": "2bf35194-a081-4772-a3d0-949995edae5b", "comment": "Malware payload", "value": "e8587c7ea36a4e69da47a5a9dd4ef858043144caeaaf168bc56eadde91815524362af77893057c7331651cb3ca935657", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867242, "uuid": "e176e5fa-ce04-42b7-a510-de4a7e2dd7b3", "value": "F733F1C4EF1BB858CA837377BC482FD66EAB025464CEE09597C6319D0296E33531427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867242, "uuid": "9f6bfd43-7852-4ee6-adbe-b2b5d5139302", "value": "1536:3AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3n3:wpoAnd9gucKCQaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867242, "uuid": "c61e06e1-98eb-42b8-aa7a-22e1e09dc5c3", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867242, "uuid": "b9eebfc8-505f-4681-b733-e4610d2c9d53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867242, "uuid": "0306e073-3bf5-4120-bc0b-e680621b3cbf", "value": "catalog-1437439215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b476256d-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867669, "uuid": "0955b101-648f-4015-857a-7567df896d3b", "comment": "Malware payload", "value": "0dd51e6a54665ac1400b6ce291c78393", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867669, "uuid": "0f3469c8-4fce-4420-80a6-b7398ab00a59", "comment": "Malware payload", "value": "0a210769c90b5c5c0bccba5680a4cd70b175b64c26846b400094de095e574428", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867669, "uuid": "6b19c0ef-108b-44e6-ad71-f15e795f8e7c", "comment": "Malware payload", "value": "1313021196cef89a01717063f297d1e9f0059163", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867669, "uuid": "942afade-dc74-4c1e-93b4-6b3ce311817d", "comment": "Malware payload", "value": "60e10e2a8851f784ff67668c3d480df50caa84c87f3c262df8a36f854e1767bf890d865eb3e18529bc2833adbc6d9205", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867669, "uuid": "b10129a5-d69e-436e-9000-e4b2d213ed60", "value": "AB33E188EF57E81CC79273BBBC842F976BB7126454DEE59967C2308D4287E33261026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867669, "uuid": "621e417f-3acc-4c52-8f09-e3b347899c9e", "value": "1536:/AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNq/:YpoAnd9gucKCI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867669, "uuid": "e044e5bb-0447-4f57-9fac-79bb40f89264", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867669, "uuid": "794e64a2-20bb-4a54-ad42-79ff5903dfc2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867669, "uuid": "4a4ff2e9-e682-4f28-a757-e44400ba2b81", "value": "catalog-1782806464.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5658bc8-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620917036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917036, "uuid": "f368539b-a334-4edd-a33f-a9ffb3cd8181", "comment": "Malware payload", "value": "74bda93ea5b9cd4ce6b3f9a233fe0952", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917036, "uuid": "e6061ef7-4424-4786-a0a0-bec16777bc86", "comment": "Malware payload", "value": "0a26bed5eb5035f536be2c6b8b31f89f384e9aa01c8008c2e379de2ae5c743eb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917036, "uuid": "da731452-9c1e-4472-83a4-337fefb537cb", "comment": "Malware payload", "value": "73725b4df595bf8e4d78154d9867e90c725d009e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917036, "uuid": "73a2f68d-8663-4f46-8595-8de908f47759", "comment": "Malware payload", "value": "74c142cd1616e3c871ccf7fddf8ea2b9f2ef5c91e4d75adfdcb1fd9ea7e5d2f57cbe4ecde4b8d0ca74fca1f90c9468b0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620917036, "uuid": "8969dfc3-89fe-4e06-92f6-616f8db4da81", "value": "3D3302D6AB23E5D3CAFBEAA708521294936FDDDC31143C54192A198345FB164C0E37CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620917036, "uuid": "463cf77b-cac0-4e2a-aafa-2f6dca80bf5d", "value": "768:mo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6FIR:eeKCVQbp4LTaI7ZaiNQMIXwF1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620917036, "uuid": "65fbfa5f-256a-47b0-99a3-f650f8096904", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620917036, "uuid": "baeeafdb-c674-4925-9f0a-e5a9a182c12c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620917036, "uuid": "17bd7e13-a982-4565-bdc8-5464b6a26db9", "value": "statistic-977471485.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9bdd7c-b3c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620893216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893216, "uuid": "233c3917-8dbc-4b9e-b893-792096d373b5", "comment": "Malware payload (Dridex)", "value": "ec1b1d42f363ab09ed90ea757e78d642", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893216, "uuid": "7620968f-54dc-4f6b-b20c-c6a18ceb1fdf", "comment": "Malware payload (Dridex)", "value": "0a2fdbe9617cb063edc5ceff20166a5f841f1c5b64a42ebf695a927f1abdec34", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893216, "uuid": "4c1830f4-bb6a-4db6-ba14-1a756a963fad", "comment": "Malware payload (Dridex)", "value": "df541e28582fa7019f7dedcfdd7d9a6df546a13c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893216, "uuid": "7a6f5eee-1d07-40f4-92ba-bfd949393cd0", "comment": "Malware payload (Dridex)", "value": "01fa7a2b94a98ca2a40e88f0db6634fa1e283fa05308e6fc1c2bfc6e70b004107d02ae1a4f17ae150856023f77c3dde9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893216, "uuid": "2099114f-0a6e-49f0-9eb8-ae2393191991", "value": "93F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893216, "uuid": "9b743967-e066-422a-927d-51a9339963eb", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893216, "uuid": "70019b2a-547a-427c-9725-afe126abce6e", "value": "3072:nar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Rs4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620893216, "uuid": "eb624b8f-5b03-4d2d-8460-ebd69d8248a1", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620893216, "uuid": "046c9ab1-8cf6-4f85-811f-d4ae4fd61f02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893216, "uuid": "dae43373-05f3-482d-80e6-ac47087c4146", "value": "ec1b1d42_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c3c69a-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910239, "uuid": "5c041cb4-2d3c-4961-932b-e317af7006c2", "comment": "Malware payload", "value": "4c14fbaba7d991546093d74911992401", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910239, "uuid": "232a6844-c55c-4208-b306-09c782f9978d", "comment": "Malware payload", "value": "0a3ced2284cc57b324a7b8aebf4631adfab81a889a5beb9a91b75fefd1895658", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910239, "uuid": "c1ef7de7-6146-477e-af6f-ed5db7782487", "comment": "Malware payload", "value": "eafd79ba7f9bbe0cd0356eb2be7aac55de2a60a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910239, "uuid": "02d28e94-7481-48ae-b8e6-fc0e1391cc6f", "comment": "Malware payload", "value": "32c94286178969857bea4ee624b315d0fc604d6e5cefc12e3fbf6ab147df8c801e36f3e2772a3758c4170a658007b751", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910239, "uuid": "95f18457-5c97-4db4-9bf5-46ef5199b815", "value": "273302DFA014EAA7C2AB57015FB897A306FD7509E230D15CD36AC6E9E5835C2806E8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910239, "uuid": "8e255027-0c61-4546-bc45-a0dbb17d0def", "value": "768:kqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7eI:NxTuDqsF1Cnc3P57oj2+nC6uxkL7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910239, "uuid": "f01e5759-9e29-4b25-853d-b709fbb88f1d", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910239, "uuid": "d2c014b7-e8ac-496d-a25b-cba832ade653", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910239, "uuid": "c5d2468b-c311-4331-bd1f-a6d5e61ff975", "value": "catalog-1852218810.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c665b664-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915374, "uuid": "8ca4455c-d731-4b74-93ac-cd1a44df9dfc", "comment": "Malware payload", "value": "1a08460dbc7c3e8efd944fc737854363", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915374, "uuid": "fa6aa881-80e3-4661-b464-32572cdbe9cb", "comment": "Malware payload", "value": "0a3db6ac9afa2cd36d4dac683107c019e4da4122ac27972574c77b6c35cd699c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915374, "uuid": "e6cee2e1-d48b-4064-8036-0b29d9461eed", "comment": "Malware payload", "value": "8b0ff1faf1dd77258b30c4d0ac12a232d7ecb932", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915374, "uuid": "97a901d0-8dba-4416-837d-a2074f495e24", "comment": "Malware payload", "value": "44aa429b76e0ee546a10c7d974cc175d5585521d5cfe61de70e7d9274e7ab796622dc9889dc3031dfb1d480fe9cd0e85", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915374, "uuid": "318f71c1-11b3-4cc9-8394-f7a5b49768d7", "value": "EA33F1C65B23F9C386EDDA97049923D8A76FC99C30147C596D2B648380BB168D0E7BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915374, "uuid": "db716df7-edd0-4911-b44d-2b54e7afa5d5", "value": "768:eo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S8CIoUuP:GeKCVQbp4LTaI7ZaiNQMIX77Uu4al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915374, "uuid": "12f4bb8f-7a61-410a-9fac-3d214aa325b2", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915374, "uuid": "94435cfc-6b2d-409e-9398-911b6bc4fae5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915374, "uuid": "b6712fa5-60ff-453e-a0ae-6a39f7f4fc71", "value": "statistic-1746403420.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164011d6-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871269, "uuid": "526d18c2-22a3-45f7-aa40-4321b93c9094", "comment": "Malware payload", "value": "4b88e31b551987dc4d2ced30c9a91a58", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871269, "uuid": "bdce25bf-e0e9-449f-96ee-073f51bf7bf3", "comment": "Malware payload", "value": "0a40cdf2965ea6a20fd669f14766c8e4ad162c050f8063048d7c7d30cd8659c6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871269, "uuid": "f9ae9a51-cdef-409a-bc27-e8f328934630", "comment": "Malware payload", "value": "380d6bde966c2e9fc46e02f1efb8c19f27d239ac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871269, "uuid": "60da5a0a-83af-428f-bcde-ffad57056316", "comment": "Malware payload", "value": "b5f3a9bfc1730fc10a0aa83677ee8ca25e489ef6ecb9c4b464c835fd910cd90bb80c898d1216f3e84532f6d32066b9e4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871269, "uuid": "ff76a100-e969-4d92-b928-519249bf3cdd", "value": "DF33F19537FAE910C6F182B0A0E17689274B3D618A695DFA0CC4B6793F931A0CFE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871269, "uuid": "c9d4818c-1057-47d4-8ec4-5b6cbd3dfcd8", "value": "768:55G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJI2t:5/czJJSI7r3Pwh8RK2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871269, "uuid": "2676b3ae-9300-4695-b932-4df29a57952a", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871269, "uuid": "13900dd4-798a-4117-bd29-0adf01a42433", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871269, "uuid": "2066d431-d647-4db9-9039-237e3ae0b998", "value": "diagram-545022792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0caee4-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910580, "uuid": "9251ef8e-3eef-4c32-b89c-fc6b3c7a1e1d", "comment": "Malware payload", "value": "5050db22a14f1e13915d9047179a0682", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910580, "uuid": "d84db988-f890-47a0-bc7d-688f870420d1", "comment": "Malware payload", "value": "0a4ca5706c2b0642f95c377dc86ee7f68defc73efce8261b30b10388c1f9b0ea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910580, "uuid": "9dafea33-854d-4fa6-a044-6f07372141f6", "comment": "Malware payload", "value": "faf26635b92ea880f29c11c49788f4d170750c45", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910580, "uuid": "349b911c-0974-4039-ae7d-dc9c80a78b0a", "comment": "Malware payload", "value": "585173ff8d1c17f800441ef2422529f5c5fdb2c75b830864e11630222e19549e9ccec73b517bd71f156514b8793a6f36", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910580, "uuid": "5b348196-192d-41c0-8a14-09f277b909d3", "value": "513302DFE014FE6BC29B53015FA58AA206FD7909D170D658C32AC1F5F9835C280399EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910580, "uuid": "e00e837e-fdbf-47f3-955c-38f8f64518c1", "value": "768:dqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LpDvNCw:4xTuDqsF1Cnc3P57oj2+nC6uxkLOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910580, "uuid": "6b02e26f-5746-4df5-aa6a-25d0ffd7cd84", "value": 51710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910580, "uuid": "65e45e2f-9902-4287-b49b-9871db072b70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910580, "uuid": "42329710-d0d1-4123-af63-94eeb2650280", "value": "catalog-211036198.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207404d9-b437-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620943442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943442, "uuid": "6c6fda86-2c6b-4a5d-b989-23718ab3abc1", "comment": "Malware payload", "value": "32bbcbadc824ff7f2320d12da768ed24", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943442, "uuid": "0f7a7e8d-2b04-476b-8350-3e4885fdf4ce", "comment": "Malware payload", "value": "0a5cbadbac829ba362a61df14feb3d8a8964f8e0d29627859503d2d0dc6e2ede", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943442, "uuid": "2d1f3ac7-ee0a-4013-9e91-9600282d2958", "comment": "Malware payload", "value": "c73c02523a1c0f327775be2f5e6cf943cc92f40f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620943442, "uuid": "ea1a4a1a-923b-410e-a1f6-03f5f65de234", "comment": "Malware payload", "value": "f8c0efe0a71bf7ac4e6b5c8c8ed55760179c822976605518cf3108c2838bcd4ae0d7e70ab85f9fc3c6a9da3c283f5314", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943442, "uuid": "2946db44-835b-4bf6-9da5-15c798378aa6", "value": "BFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943442, "uuid": "3b2e8f7c-52ac-43ac-bfab-eadde372923b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943442, "uuid": "4de1288f-50ef-4b13-8af0-775688a641ca", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620943442, "uuid": "f2bad977-fcef-4afb-a155-8da9b73412c5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620943442, "uuid": "7ff3e67c-b62d-464e-a688-e01cd423a243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620943442, "uuid": "d2fa5adb-d9db-4a1c-a75b-abd748fb1aaf", "value": "32bbcbad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c359289-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870904, "uuid": "e664d1e2-390e-40e3-b08a-1d8497bdf297", "comment": "Malware payload", "value": "5c2de5dea98619581e031547726403c9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870904, "uuid": "fcba3eb2-e0cc-4294-adff-040859a8a841", "comment": "Malware payload", "value": "0a76e1aeed8de845598b0ca59c95954ca9c88c349d4d97bda2906dc3573c098a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870904, "uuid": "b40a8f52-e571-45bb-8675-b3dc330e1b23", "comment": "Malware payload", "value": "a8f64e5f92296d54f13cc6f9dbb0578d9dbdba63", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870904, "uuid": "9997dee4-6105-4fd6-8812-cbf2abdfba90", "comment": "Malware payload", "value": "fcac24e8c44699eff81776bb523e856ba9b1160815495736009546bdeb5a4370f201879070487f679969372c31d9e894", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870904, "uuid": "2b7e80b0-a4a6-4859-8711-a048d395cc7c", "value": "8C33029673FDA910C9F1C2B0A4E27588374F3DA24E7D5DEE4D8894793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870904, "uuid": "8c92f6d0-8ee5-41fa-882b-0df7dac4d1a0", "value": "768:05G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcf:0/czJJSI7r3Pwh8ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870904, "uuid": "2a7e4d4d-1cb9-4901-aada-cec1b4fb22e6", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870904, "uuid": "98e4fe34-7380-4cbb-acbb-81450d643a42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870904, "uuid": "5eeef175-bb58-4064-a615-0c12b16cf5bd", "value": "diagram-29303498.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f91419-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913850, "uuid": "304c464b-e5c1-46a4-a192-661eb3b0bbca", "comment": "Malware payload", "value": "7bb40e961c549d4f3bb8ef4740a7f5f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913850, "uuid": "5df1a83b-f02c-4c88-9fa1-39dc134cc226", "comment": "Malware payload", "value": "0a799043b4c8df36a0d4a98675c7875dc670c132494e4323d9ab6b72056e6570", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913850, "uuid": "2c909871-b766-4e0a-bb40-54541f5a984e", "comment": "Malware payload", "value": "479a0e5c96cbe4a5c0b1f15ba5d8d0606ccd8217", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913850, "uuid": "08c0d4d3-ad1b-4deb-8aff-05ef0d1e0478", "comment": "Malware payload", "value": "f6da9a525a024cd14d9a404b29e1f7320fd936a75e0da28f18e9a1161a15310e8af688579fa88d9c769452eeb838f04e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913850, "uuid": "e47fcf00-230a-47ea-b4b2-f769a51ec9ca", "value": "E63302E232E3E17AC4C509F6F43759DD65A78D88F93080D02E8EDA5122D31B56D9174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913850, "uuid": "7f074bc6-8c2a-4729-8358-5c0da31e4839", "value": "1536:LEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHDRJ:AnBrX5Eg5Enjq3axWIfkNwejRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913850, "uuid": "b4c9188d-4775-4d4c-93b9-4500b9ccb1d9", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913850, "uuid": "78a25207-a88c-417d-8e31-a6a5fb496ead", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913850, "uuid": "88c9efc1-3412-44ac-8a4c-49b0aca75f8c", "value": "diagram-594330637.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0252f6b2-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869089, "uuid": "a764af34-c78d-40b5-923f-2d53336c3a1c", "comment": "Malware payload", "value": "d0e9feb7a62508b23e469f551fb803ea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869089, "uuid": "9b874e26-9467-4476-bb1e-dfc9110fa6f5", "comment": "Malware payload", "value": "0a79d79536d637bd741b105a32f438fd62a9ca9be2fa323cf661c8847b88fc68", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869089, "uuid": "cc0d80fe-8f63-4136-b880-efe3f29bd3f7", "comment": "Malware payload", "value": "a37d2e5760f7235bbf98a701e4efc34b86c9d8b6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869089, "uuid": "ac051cde-4076-4400-8a60-403a04615291", "comment": "Malware payload", "value": "ea460b8b61b44bb8a97c10914785073a1b5126d0903e10fbaff33c187b29c465c2f7c8875b65eb743bd9edc100323113", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869089, "uuid": "89750b44-f234-4fa3-9079-73b735ec2572", "value": "6233F188AF5BF458CBC373BBAC442F979FB7026459DDD19867C3309D01C2E6316142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869089, "uuid": "f60c8bd8-f896-4177-84ac-8f03acbef506", "value": "1536:qAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSz:5poAnd9gucKCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869089, "uuid": "b716abb6-a581-46d3-95ec-6dcd96e86b87", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869089, "uuid": "c3e80ea2-db0f-4253-825e-c66a5af0658b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869089, "uuid": "9312599c-d778-44a6-aec5-95c4f9d404f7", "value": "catalog-952700665.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6d7d2e-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914875, "uuid": "deece9c5-4ec1-42a4-b29e-32d6bccd20ea", "comment": "Malware payload", "value": "a72239051500b3c66889b5d07259c1e9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914875, "uuid": "2b1ab056-f200-4740-9d96-4b849afea192", "comment": "Malware payload", "value": "0a7ce4e9ed2a8344fd0cd7cf735bb2365babfafee1b166fd7711dbc6c3582cae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914875, "uuid": "303cd2a5-bb3e-493b-a379-90f6c7d67b72", "comment": "Malware payload", "value": "9b5f445d2c63c4fd6913b59916232a1b6ad546ce", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914875, "uuid": "07beb09c-94d6-4045-b319-49298fd09401", "comment": "Malware payload", "value": "17463146741ed2bace6d902eac792dc6696cc48a133dfa205388056b74d618b4256bbe81b4226e3359d32d5b641825f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914875, "uuid": "0d22ff07-b014-4c9a-8e53-7b54f644082a", "value": "8D33F1C65B23F5C6C3E9DA67049673E4635F88DC30243C6CAC2A658380BB158D0E7ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914875, "uuid": "00ce4a20-7e45-47a6-be1b-62683efb549e", "value": "768:mo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK8dwH:eeKCVQbp4LTaI7ZaiNQMIXd1O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914875, "uuid": "75f8e1fb-6639-4f65-b78f-7e343e5aee70", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914875, "uuid": "d08c2efe-6b8a-4c24-ae9c-7eb2b6234cbd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914875, "uuid": "7c7a9d3b-b664-4f93-83a6-6197706c765d", "value": "statistic-1366164099.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959ea368-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868477, "uuid": "ae04407a-1282-4d73-9611-4145bdb23038", "comment": "Malware payload", "value": "19f2aacf8426e9407ef64e6f7024d13f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868477, "uuid": "cf82491d-05d3-4c1d-ba64-d7cabfb7c1a8", "comment": "Malware payload", "value": "0a7d0f675adee5e162fa95b7964b4e35dc97f57041713b94052f857c87b61daf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868477, "uuid": "c1406b57-013c-4546-8330-211f0c819b5a", "comment": "Malware payload", "value": "07a1f6b5f8e0f956666cfc88ab15e34dd17e5b20", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868477, "uuid": "baaeee6c-c21e-444b-94b8-5534ac4bc286", "comment": "Malware payload", "value": "6238f66021cbb3cd9e65dc947d7d06dc78f7b397110ea48f9d0057b069d2433bea7abaaa1a2458c2fcad526f2d7eb62b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868477, "uuid": "0f0f789c-b0a5-4522-9ba5-f28e568729d1", "value": "F233E1C8EF6BF418D793737BBC892F976EAB022455CED19857C3309C0292E66661027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868477, "uuid": "578206c2-132e-4776-9893-64f54fab1eed", "value": "1536:LAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrpPe:MpoAnd9gucKCfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868477, "uuid": "ded6d9b6-100c-4013-b2ef-8a49fa2c2688", "value": 51571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868477, "uuid": "5ed8253d-bd74-4d1c-8f22-8430b4154f57", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868477, "uuid": "74b10bac-555f-4fbd-8561-829161fb8b1a", "value": "catalog-443011676.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3185308c-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912976, "uuid": "0384caab-b422-4afe-b61e-0736d6b2f869", "comment": "Malware payload", "value": "952997ceee332008b041a2e97b1c0d67", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912976, "uuid": "9c2d657f-9cfa-4d03-84e1-6ed4d0e75b0f", "comment": "Malware payload", "value": "0a92e0fd901b6deaa88e720541a61911034193a2951943814baad7e7ae594329", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912976, "uuid": "fc8236a4-8347-4ea4-81c0-f31a2a640531", "comment": "Malware payload", "value": "399d88c8c14f1ef69b07502131df6311fd29f13a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912976, "uuid": "5574729f-f3dc-4fdf-8c1b-99453f3ea4e2", "comment": "Malware payload", "value": "8394e0a567496217e5bef9cff14075759b8fadcb3c1a2b30ce18bd0d744c5509a79bc5af6979490d4feac78f0edcf31d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912976, "uuid": "1be4c017-1a74-4c09-baa6-78514e32309c", "value": "9533F2D133D3913AC08609F6F82B5DEA66778EC9D520D0D06E5FD91112E22797D9170F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912976, "uuid": "dcc04adb-a77d-4173-b889-e89d04362720", "value": "1536:pEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwuW:GnBrX5Eg5Enjq3axWIfkNwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912976, "uuid": "d9834231-6b3b-4e86-99e0-84bc2ee393c0", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912976, "uuid": "343e9de5-34d2-44bb-8043-19947c6105b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912976, "uuid": "16f1a0f0-5c53-4a6e-85dd-94e73138999e", "value": "diagram-1935714325.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7516e609-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867563, "uuid": "0666cedd-e27e-4c9d-a812-b8df7c52735f", "comment": "Malware payload", "value": "876b5852187d127cb5b48d5320572e85", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867563, "uuid": "a6f68e06-3e94-4445-956b-8f71e7a226a5", "comment": "Malware payload", "value": "0a955a6d646c1dc2b7948e7c2ebf6740a0025dbea467404a673ca72d4d865c20", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867563, "uuid": "5ccaf5cb-dbe4-4a35-9e0d-63af99f6da39", "comment": "Malware payload", "value": "d094512fb4782ca20bcffcb3aa12815bb5049937", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867563, "uuid": "094608e9-f332-4dd3-aaff-08ea735e1ebf", "comment": "Malware payload", "value": "070d36bb389343b6cb1a762c228be71b7f3ca5b1f1e13bf06b276a01ce115f836f715a452546dd78ff601845004c9e1b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867563, "uuid": "ebebd5b6-753e-4ae9-b2cd-01caf19866b0", "value": "F133E184DF57F518CB8273BB7C892ED76FAB126454DDE0995BC3319D0282E3256102BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867563, "uuid": "e0767852-4fbd-427a-8682-334e92509856", "value": "1536:7AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqz:cpoAnd9gucKCIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867563, "uuid": "b6d9e94e-68ec-4951-94df-25a6e112c13d", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867563, "uuid": "2ffd6429-8c83-4f82-83d8-492752dfeeaa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867563, "uuid": "6c07fb39-681e-4f1e-9535-3448634bf526", "value": "catalog-1696368828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9166c0d-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909365, "uuid": "bde9f611-fc30-4b3e-9bca-36c8ede29c5f", "comment": "Malware payload", "value": "97f8751585d04287a9232ce963898e32", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909365, "uuid": "c93c5d43-5670-4531-9511-00a53d044440", "comment": "Malware payload", "value": "0a99c62c246ef24fd540c7e9dc91aa62e554940b29a5db5d0629da8e41fe4c49", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909365, "uuid": "f4c65382-9047-4704-b632-50798db3a7a1", "comment": "Malware payload", "value": "142a9b799cc8e3333e84528b0183829bd4031559", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909365, "uuid": "fd4b626e-50ec-4083-81d5-b6e6477b3968", "comment": "Malware payload", "value": "c418b6eea270c372f16f5c304738b58ed2ad7b09347a77bc2e6d15e0727b629eed5d5fa06f835ca4d2a5860b956f1333", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909365, "uuid": "ba44ba33-a4e0-46bb-ab37-8598e52b02cb", "value": "323302EFA800FAE3C59B57025FB19A6102FDBA5DD170D1249399C6F0E9C36C2C03A9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909365, "uuid": "1961a790-812e-430f-8f88-f15b58f97670", "value": "768:mmqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMQBr+:sxTuDqsF1Cnc3P57oj2+nC6uxkLuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909365, "uuid": "d52c7a14-4233-4cfc-9f9b-0ecc9100ddcf", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909365, "uuid": "5627e6a9-dfcc-400f-bd26-b7e2d076d0ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909365, "uuid": "e26f687e-8cac-4159-8917-d73ee102a1ab", "value": "catalog-1205788881.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2c4160-b3fb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620917742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917742, "uuid": "cd5a165e-7e93-4e72-8021-1f1d2075b0d3", "comment": "Malware payload", "value": "b416cd0ec8e8635f7af2c81066b86e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917742, "uuid": "7a958a98-4adb-44f3-80fb-536c1cd31b98", "comment": "Malware payload", "value": "0aa55e65fc353afe07b855cf6ffd190e4b8ad6f883e699fa9aa5250721ce15dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917742, "uuid": "eca875cb-7c38-4a4e-8c6c-e2f05c6890d0", "comment": "Malware payload", "value": "31c65d0b020c3cd499d9a4ef5d82cec5d3b08a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620917742, "uuid": "9f3c7dba-1c0d-4d83-9e69-8dad3cbd3368", "comment": "Malware payload", "value": "c3aa919218c01189361d9846a2031122a536d830c45fe14723a20ad5504851672d1837efdce8997f20bbed7494063eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620917742, "uuid": "83cde852-1b22-4c8e-9926-d95a5c7c03f2", "value": "25159EBC765465F1E35B5D33A7CF0C0642252270A93BAA0F8B6003BD5A67E173E3998D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620917742, "uuid": "f928092d-da58-4fe9-93e1-19427b3882e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620917742, "uuid": "70827cf6-2ec7-439c-a05f-a212f0f94915", "value": "12288:MSQyroLLoS60/K7yh0OtVkwXb0EwamdVSnvmSinzFG/rpSC6szO6b5a29D2cCp9v:+yroLAwCSb0EwxHSvGSnzxx2jXu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620917742, "uuid": "099b4207-5789-44e9-b83c-03505531006d", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620917742, "uuid": "77e05d8b-1431-4d29-b30d-ee58d0716fa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620917742, "uuid": "55abe146-e3fd-45c0-bd73-93682eb1ed8a", "value": "RFQ #17092018A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f529b0e-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896813, "uuid": "5cb4dae9-03c8-4840-a0fe-fcb44f352e97", "comment": "Malware payload (Dridex)", "value": "5a29424b96b960efda595870c40ac650", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896813, "uuid": "88c12b1a-e3a3-4405-a058-5d56031313bc", "comment": "Malware payload (Dridex)", "value": "0aae92f5a414d1b0b7e8873d8f98f7484d50e72658db638d3abf94ec4e4d325d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896813, "uuid": "807d229b-8925-46c2-b06d-913111ca2866", "comment": "Malware payload (Dridex)", "value": "a28981926248aaa8fdcbebfeb5c23a27b0487911", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896813, "uuid": "d85c3ab8-a3fb-4505-87c2-7811ef02e7e4", "comment": "Malware payload (Dridex)", "value": "77a5cee1bd1b17e7815dd8cbce209adb5028327e363df4001e495001188365032773b1cca00fb11bf83c5b435f2656f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896813, "uuid": "dbaa8e71-97ad-4d05-9d3e-f207b14619fc", "value": "7CF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896813, "uuid": "55a04ed4-de16-481b-b589-ad227052b4ca", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896813, "uuid": "e5cc51e5-f085-41b9-87a1-95de79b1b8bb", "value": "3072:xWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:x42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896813, "uuid": "4c0499d8-f129-449a-a365-3b8f042c5c71", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896813, "uuid": "6bf5208a-3f03-4825-8068-e8ee6fe18d1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896813, "uuid": "3334e760-1283-476b-aea0-e9572d52424e", "value": "5a29424b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d419cd4-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871389, "uuid": "2b238db1-b740-472d-9bb8-12eb0a4b1a41", "comment": "Malware payload", "value": "e5a205178a203a03616509351c36d089", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871389, "uuid": "e4471ae9-4ae6-4b27-8e6c-78b797e65826", "comment": "Malware payload", "value": "0ab3657bc4088b6859e43781f9440e01d525ab41a47034f7b137b960d383f0e7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871389, "uuid": "7f3defd3-c3b5-4236-9c4e-53d452709395", "comment": "Malware payload", "value": "ff84e333b8b65792e646cb59e4b105e2b4c6de80", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871389, "uuid": "3e98bf52-c64f-4b2a-b470-64773fd773f8", "comment": "Malware payload", "value": "96686111f0800f54e6d281a96ecdda368a0225d05d664c8e0608762ca8a7aa5d29fbff03884240e87a9819d01f3bd977", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871389, "uuid": "ac3c34ce-278d-4784-b6fc-5ac44c8770a5", "value": "2333F19137FEF510C5F281F0A4E275893B4B3D518E694EEA08D5A5793F921A0CFE62C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871389, "uuid": "995497ab-5427-44cf-877a-2b4b09061bd0", "value": "768:45G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJBJJ4R:4/czJJSI7r3Pwh8RVJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871389, "uuid": "afadfedc-62c0-4f7c-8093-7cbb711c1945", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871389, "uuid": "65cc925f-1f98-4efd-bea2-70f3e20b4f45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871389, "uuid": "a8e0d327-46a8-42a8-ae10-de541b015268", "value": "diagram-646440428.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a085f7c-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870497, "uuid": "f44377a1-3784-41d4-bba5-727c322e1764", "comment": "Malware payload", "value": "cd0f93b41b019633e317e86201045c11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870497, "uuid": "86d31d05-addb-4ba7-934d-81d5b1f96a94", "comment": "Malware payload", "value": "0ab3b67bbdf261a7c29e3df8737ff910d59e692280f1fc4429742f7ca0ac25db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870497, "uuid": "77b66482-4a41-49b2-a8a9-ecbc6ea3c59a", "comment": "Malware payload", "value": "a449ac8d5c8db4386db85c3977fa2f1c7eab0b86", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870497, "uuid": "33239fd3-8668-474e-9c6e-38d989a57e68", "comment": "Malware payload", "value": "783a17a08e37149ccb222c969cb11ddca8db82bae19e24c036e45e5b26215941b2cffeca0a593dfc1ce9dc9ec7f231cc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870497, "uuid": "4573c3f7-6b3e-4b99-8c84-d0f7de7494bd", "value": "7533F1A473FEE510C6B1C2B0A4A2A589364F3D91897D99EA0C9464693F931A4CFE22C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870497, "uuid": "10bba427-a5f1-4e2f-b018-f8084f2b596f", "value": "768:K5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx89CVIWgu:K/czJJSI7r3Pwh8tv8x8E2nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870497, "uuid": "4433bbdb-d1ea-4088-8e90-76e69492b82a", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870497, "uuid": "39d666b8-fa27-4b4a-9c03-26b109a02f9d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870497, "uuid": "8b702f69-d266-4831-a5f3-eb3f81dd65bc", "value": "diagram-1957979414.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279edfd6-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872587, "uuid": "7c5599bc-131e-49ef-8615-f5c728c01323", "comment": "Malware payload", "value": "ffa056c248f4bfc2f3a59272c1bae826", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872587, "uuid": "5522c436-1176-4ffc-8e59-0761e85897d5", "comment": "Malware payload", "value": "0ab40989f0ff3a32aa9081402d63d69dd362a0d512e5f1c82f7d66ab1a359c0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872587, "uuid": "5302dfe9-e5d5-493e-8fbe-d031e6af8422", "comment": "Malware payload", "value": "3e156751aed7b04964a17dee3a639ed0118109af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872587, "uuid": "ed3eb8cf-ef4b-4aeb-bdb6-3fd7f2bf92d3", "comment": "Malware payload", "value": "a666b4cb5b1a9fb444bb400782b6bbe1584100e6369aa8d8cd667389e85a9b0cff325735ea490eb3abba08598dd297de", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872587, "uuid": "02ef0c26-f611-4221-9343-7b7bc5dd0342", "value": "193312F1D203B5ACB903418D4EDC5E6B52374270965D8DB1C54DEFC2D23971A0F90A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872587, "uuid": "fc9f4407-e798-481e-8737-f5c21883ae65", "value": "1536:YQ/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMS:9XKAXh3TCdOi+KSZ4WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872587, "uuid": "12f5933b-d2a0-4f27-978c-f392d77a97c9", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872587, "uuid": "51dd58f3-65a2-4b96-af8c-2e95a82d2ef0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872587, "uuid": "eacffc00-fdd0-43af-9c50-a3264e4214dd", "value": "statistic-1550057601.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929c0a35-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909703, "uuid": "7a0f9877-d024-4601-bf91-48f0a1174b4b", "comment": "Malware payload", "value": "1a34c70d74348fe37bcc3427afbe5279", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909703, "uuid": "5eb746ba-38c5-4841-91bb-22c4ac06691b", "comment": "Malware payload", "value": "0aed2c9841375782e9e315654e388bc9ee9a71a99288a227ef029f39625513d8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909703, "uuid": "7758ad81-2ce4-4a33-99d2-204d3e86ba3d", "comment": "Malware payload", "value": "a0c43cac37cf946114409c3ec4d6bb4e6e468b3d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909703, "uuid": "11872c38-3682-4751-8868-a62da7c43fd6", "comment": "Malware payload", "value": "8689e854c64838282c2bef5ba534f98b25eb39fdfab5bd063ea8b992d960a6052d5446720777a813284dacffa9b16e53", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909703, "uuid": "75222c6d-aae3-40c8-b3ba-1e344a667aea", "value": "4B33029FA404FBA7C1AF9301AEB6975205FD764DE130C0689359C2F1EA836C2857EAD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909703, "uuid": "df0a028c-1550-4d2a-be9f-167a052faeb7", "value": "768:qqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMZc:rxTuDqsF1Cnc3P57oj2+nC6uxkLunc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909703, "uuid": "a77a38ab-a771-47d6-955b-d8037f3ee4ed", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909703, "uuid": "89ef893f-9d33-4d49-abf0-ea455cef4c93", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909703, "uuid": "eaa0107e-4285-48c0-bfa0-5078dcbd1d13", "value": "catalog-1439940358.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77391607-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868855, "uuid": "86081b85-08e2-4830-99ae-f1110b9e67ae", "comment": "Malware payload", "value": "63c4d42fc04d2f7dadad1baa0e7ece41", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868855, "uuid": "956a4173-a319-420c-a612-7d36b9a5e30d", "comment": "Malware payload", "value": "0af4ae01cc38e656da353a1d7e90208e954b0bc47be026a5b9e44093c4b1636e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868855, "uuid": "90e7ae29-cca9-48a2-b877-c043f5d5968c", "comment": "Malware payload", "value": "c52de2317c2abef756a289394a8fffe808fe1abf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868855, "uuid": "3f853b9e-c88b-403e-b9e3-5dbd4450f9be", "comment": "Malware payload", "value": "d28eae951d9db2e43c93a1bab71376b0c63e94ce8ca4628e05ea8b4766656e1f4929fd7aa4f9123fcc6a79ffca6f7f40", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868855, "uuid": "6310f540-911d-4f71-a68c-139bd03d8dc4", "value": "5F33F1C4EF1BF858CA837377BC882FD66EAB126464CED09597C6309D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868855, "uuid": "7c9f03ae-6acd-462b-ac13-56be2876de98", "value": "1536:gAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3jX/:7poAnd9gucKCQaTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868855, "uuid": "b6d64df0-0bc2-4040-903e-ad00198bae8e", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868855, "uuid": "c6b15bd0-71cb-42b5-be1d-912afb8133d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868855, "uuid": "7c845adc-ccfc-4a66-a41a-4a86cf52f207", "value": "catalog-752600536.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733d4b9c-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915234, "uuid": "8398f0b3-83b8-4127-9761-258ddccf5939", "comment": "Malware payload", "value": "be937358b47c38b788cb6e2078f42b7d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915234, "uuid": "a3a00391-e29c-4be2-9cdf-d9ea350a9d65", "comment": "Malware payload", "value": "0b27d28dde6dfc9d8d61ac3c08b21d7061907560f61b22a7ea6316c731d9210b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915234, "uuid": "ae4dd0b2-5f40-4aa0-8062-2c7ee83b0306", "comment": "Malware payload", "value": "2a31294ff5a07adb62c5eff4dc22478c12f82278", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915234, "uuid": "307b9bd3-7597-4e72-bc87-fc7cad3cef2a", "comment": "Malware payload", "value": "a1d88fa74f0052e57a016d7dad055d605e33b209118d54d4fa291fdccc07b9dbfa7aec77b782996c01914ef26afa4c2a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915234, "uuid": "bdc2bc78-4012-4a6d-939f-28b27d77748f", "value": "7C33F1C65B23F5C6C7E9DA67049673D4539F889C30643C6D6C2A658380BB1A8D0E7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915234, "uuid": "8854f8c6-5d36-47de-9755-2f144093aef2", "value": "768:3o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK8bNP:NeKCVQbp4LTaI7ZaiNQMIXd1RP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915234, "uuid": "3ea1a9eb-1bba-4728-b8cc-f45618f3986b", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915234, "uuid": "93f476ad-fc8f-4539-b05f-85ebec17f4b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915234, "uuid": "2d401fe7-d2e7-4d5e-b8ab-e03e3339876a", "value": "statistic-1624537017.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d5c1c9-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871356, "uuid": "d9df5568-5c3f-4c00-a988-447549c41cc8", "comment": "Malware payload", "value": "7210eca6c3a1bcfeee6dba14778e214a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871356, "uuid": "657e6463-122a-4800-a12c-e6133daf7587", "comment": "Malware payload", "value": "0b2f517c6df05fae4e17c770ef551894ba0f8949c0af0f680f50c70b2d051df4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871356, "uuid": "9948c333-2fc4-402b-8365-9965addcb692", "comment": "Malware payload", "value": "b0a6ea3980019e2c66e39f9e438928f5dd1a14d5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871356, "uuid": "3462f4b9-28ed-4140-b488-b1fec707749c", "comment": "Malware payload", "value": "cf2a64dc521fe26cfba9074c242fc5dae6618c965e9a904729c5b12b96cf3359408ee103b2ebf6fc596346a6eef27362", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871356, "uuid": "2185dc02-59fa-4f83-abc7-01fccab57384", "value": "1433F1A537F9B900C6F2C1F060E16699274B3D618D794DEA0C94A5B93F931A4CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871356, "uuid": "235ff67d-95f7-496b-a7e0-f2a58ef0b621", "value": "768:+5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJQV:+/czJJSI7r3Pwh8R+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871356, "uuid": "badf437d-3ce6-4c3e-9612-2f6ea57f3b70", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871356, "uuid": "08fd0595-2ea4-4f0e-8ade-0d0af682aba9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871356, "uuid": "0d5f4332-f4bb-4603-8a7d-4f774db58cdb", "value": "diagram-625452496.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f140734-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909590, "uuid": "e9193a8d-233c-447f-9285-34581b57b342", "comment": "Malware payload", "value": "41d798deb71f3fdcf00cb045e5212188", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909590, "uuid": "9c1c61ac-b30f-4a68-b443-167fbdeed095", "comment": "Malware payload", "value": "0b32d45191f4329eb4abdbe129abe74ff8dbfdb33b6f4e05eeafddc13a231888", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909590, "uuid": "588ce5c8-0446-4819-b5ae-77b0a9caba05", "comment": "Malware payload", "value": "abb6375d0cc3674db14144e1367a55f89f05f104", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909590, "uuid": "5046839e-59ed-4c33-9185-68007a2cb580", "comment": "Malware payload", "value": "12baa55ca4d6504dac84838a46dae1dd2644c89a9cd52eb490205560d6ff5eeca1492a80394be599007a0e8f66097bb6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909590, "uuid": "3563bd56-2bf8-43c1-8f59-424b199abcbb", "value": "913301DFA014FE6BC29B53015FA58AA206FD790DD170D658C32AC1F5F9839C284399EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909590, "uuid": "508c9df8-941f-481a-ace4-be977b1e452d", "value": "768:iqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LpDvNQd:zxTuDqsF1Cnc3P57oj2+nC6uxkL8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909590, "uuid": "60949f54-28b1-454b-af88-bf0ace463d63", "value": 51710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909590, "uuid": "16f11bd1-e78d-4555-a45f-def92ca65dbb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909590, "uuid": "a261b611-02bc-48b4-a8a6-fe16c844ea5f", "value": "catalog-135013568.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1318a9e0-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911207, "uuid": "fd2df8bf-c8bf-473a-9b5f-60de51e2ab1e", "comment": "Malware payload", "value": "16b61cfa483161b9ba7957185a6bec48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911207, "uuid": "45fb876b-09a2-4a02-b43e-23c0d9ce2e5c", "comment": "Malware payload", "value": "0b37d0678bb99c11709df37ebfc5a81f185a7edce8b921cc00eda29f0b462aed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911207, "uuid": "a92153a0-69a2-418a-a6e8-f5d9bd28c17d", "comment": "Malware payload", "value": "30b9926b5659c3130360cdd95f0b64e14e4d2578", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911207, "uuid": "328e21a6-70f9-4694-8db2-39bf47d85149", "comment": "Malware payload", "value": "db2003a31909b4bc2b2a875d158c576ab6ff4ec8e5e2955d993853619653a76c1c0d5e64859a4be9d43e4b0e3459df96", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911207, "uuid": "b526303d-fcbc-429e-9ed7-3b1501291ce6", "value": "1933019FE415EAB7C1EF66014FA59BA306FDB54CE0308628C754C3F8EA835C6853A5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911207, "uuid": "7af45402-1c8a-4338-8fc5-c9b8d7dac8d5", "value": "1536:9xTuDqsF1Cnc3P57oj2+nC6uxkLiO92rI:9xTqqsF41j2PxmidI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911207, "uuid": "11b88e0a-a4cc-46ce-9fb2-86aae6e9fe9c", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911207, "uuid": "857b2032-5ebb-4d3f-8741-92c945d3994b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911207, "uuid": "88e3cd17-cc6f-4011-a5d7-b93b6509c957", "value": "catalog-671107154.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8adf03-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872918, "uuid": "1782ee2a-31fb-48bf-ad4c-378b85fd2e3f", "comment": "Malware payload", "value": "c9de0e141fc22a584261523ca81686b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872918, "uuid": "ae402add-2bd6-4dc1-bc32-d726b728a325", "comment": "Malware payload", "value": "0b42b99031d2944c26be1d1a15d6f7ab1568e646f2e10bf2840101b46a1ec0bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872918, "uuid": "892a6ae1-ddf9-4529-98ea-6607e441766f", "comment": "Malware payload", "value": "f877a3d2e3c4b9b69873cf3ea6f3dc6215dcc2d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872918, "uuid": "fed92849-6a0f-4da3-ad9a-ba25198300d5", "comment": "Malware payload", "value": "34a3207c7c5a09d35d0ccb6261158b5c85453a98cb267496b0abae0d1461f6a60a853601a476291702dfcfc9bfbf0e05", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872918, "uuid": "d01be957-ed81-4369-b117-81c203af1d79", "value": "E73302A2C352A2BCB643C0498DCC1E979377427026658EE2C56DFED1A33D7120B61B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872918, "uuid": "44062a6c-b104-4efc-bdd6-b62bec0f65cf", "value": "1536:2W/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8LKGR:FXKAXh3TCdOi+KSZ4WpRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872918, "uuid": "8254f46b-b26a-4570-836b-4fb90e37c751", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872918, "uuid": "dfd7fc0c-3fb2-4f81-84ed-0d120e048e6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872918, "uuid": "ab0a033b-0bac-47f3-bab4-f3c5f2a0554d", "value": "statistic-1794810459.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35205699-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909976, "uuid": "bf14093c-dc3a-406a-85e2-ab0827a375b5", "comment": "Malware payload", "value": "f3783d51bdbeb4bd2403f7e0f74d3ce8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909976, "uuid": "05037d76-56ed-4113-aab7-05338c4a8d2e", "comment": "Malware payload", "value": "0b4bc79b4b19a3707f45b0a7c1fbbadfda64b2e2865ed383819a447dfca8e69e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909976, "uuid": "f97a194b-0234-422a-a47e-29f9b5eaa31c", "comment": "Malware payload", "value": "a251a734e9cfd918d5cbd7fcc2dcfa72eecef1f6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909976, "uuid": "752f26bf-af60-478e-9be3-6c9c8ba18bf7", "comment": "Malware payload", "value": "2bb5601d44d4479ff6eab78184f0c068be6e705ce2c36eb8dd276dc07b1064b2913ce374574901b6a087e466be963747", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909976, "uuid": "138588a4-83aa-4499-b6a8-80134a234065", "value": "863302DFA014FAA3C19B63015FA997A206FC791DE270D15C835BC6F5E5C35C2853A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909976, "uuid": "db31de70-b374-40e2-86e3-4234a6538db8", "value": "768:7qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L78Lb:+xTuDqsF1Cnc3P57oj2+nC6uxkL78f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909976, "uuid": "f9259f37-4b6a-47ea-89e4-c2c904e0bbeb", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909976, "uuid": "e810006d-4598-4ff0-a5f5-f27178f6ad36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909976, "uuid": "3af958be-b14e-4f55-bca4-8a7a68a50c3e", "value": "catalog-1651430395.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5347d0b0-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910027, "uuid": "21316748-145c-4e21-80fb-933a81de07c3", "comment": "Malware payload", "value": "bf689da1b77613c197ea71b1074a49eb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910027, "uuid": "dd9195d6-d000-4640-a6d0-209809899301", "comment": "Malware payload", "value": "0b5943c2c0d042fbce930168e8a8b7ea401b42871ee186ea731a5bee895a6431", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910027, "uuid": "4da0983d-bf8c-4a71-bab0-fc5641f49c8a", "comment": "Malware payload", "value": "45137fab6f49c283cdff3adfd181bbbf6eef4554", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910027, "uuid": "f2e9e3d8-1b77-4bb9-b29d-56769a9967f5", "comment": "Malware payload", "value": "d4fb59b3ded8fe188778d2b2ea50eb1f5ac10540830926de975291186572c4f08ae36e6235f3384ac09eba1328a862ae", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910027, "uuid": "54a881d0-cf9c-42bd-a847-d531a968520f", "value": "5C33029F9014EAE7C15BA3001FB997A306FCB51DE130D15CD35AC5EAE6836C2817E8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910027, "uuid": "b5765637-ba69-4797-8530-2ccdb6c08149", "value": "768:Sqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7sjg:jxTuDqsF1Cnc3P57oj2+nC6uxkL7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910027, "uuid": "56c2ede9-2b3b-4c85-906b-84e7fabd4a47", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910027, "uuid": "49654beb-a982-4afd-bc2c-4d627dff91bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910027, "uuid": "8fc5300a-a081-4138-8505-dc6b976bf9ef", "value": "catalog-1686243900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5104c64b-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868791, "uuid": "227b138a-4ec9-4544-b74a-49720e6dceb2", "comment": "Malware payload", "value": "c091c08965c324d4e0b220c6ddba9faa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868791, "uuid": "e04b83f4-2075-44db-875a-523082a08157", "comment": "Malware payload", "value": "0b7fd69bfa075907b162aae91d1ee9450b057c2e1576b387699898ee534e24b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868791, "uuid": "0800bd19-b542-4cd4-beca-f2162fb3b3bf", "comment": "Malware payload", "value": "888f88e5beee248a039b84b8ebf0c3e1a8adf16f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868791, "uuid": "92bbf53d-d616-4f3e-9bc7-936f2d034cae", "comment": "Malware payload", "value": "da095487ee0ef99c78ed41c0da9b0d3069ff7ad202c94c2dba6a6ea8684b6488d5572b10dea3119d45b543ab65ec2c0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868791, "uuid": "c0d2e35f-1f89-4fbf-ab29-e32c5040f92f", "value": "4A33E188EF57B81CC79273BBBC842F976BB7126454DED59967C2308D4287E3316102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868791, "uuid": "a52b58db-c0c0-47fa-9e4c-76c13752be11", "value": "1536:TAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNq/:UpoAnd9gucKCI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868791, "uuid": "ec0218bd-a21b-43b8-850d-aca7a14bb642", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868791, "uuid": "f322263a-29a5-4f44-b01d-54a6c8aa1ad3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868791, "uuid": "bb897d2e-315e-40dd-9f43-24dcd2d5794b", "value": "catalog-684827339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c344e3c5-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912362, "uuid": "02ee9b1f-89c4-4170-919c-894ef788f7cf", "comment": "Malware payload", "value": "a67660c67a1fedeaffbf0679c49ead55", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912362, "uuid": "d652cab3-e6b5-403b-a15b-ca2308d82fbd", "comment": "Malware payload", "value": "0ba1de8f3894610cc8e6bd3adb6ae3b79eee5fb124dd8d9ac89820bb03af17b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912362, "uuid": "c559c34b-f949-4bf4-af2c-2c472109806b", "comment": "Malware payload", "value": "3d8267c49d1d1643af90e431d5dd8c6723ad0856", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912362, "uuid": "09673c27-2b7f-4ade-9ffe-d21a0be32df6", "comment": "Malware payload", "value": "292b6097e6386e918dead9be501af9105a439b58145fab460a67aaf68d07b553b46023bc924bdfacd7d9d8e6e5735078", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912362, "uuid": "e5b92963-6fe2-427c-9d13-29a0ff179564", "value": "8D33F1E233D6E13A80C506B5F41B9DDD66778EC9F430A0911A9EE80523E31B5ADA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912362, "uuid": "3db31741-9f7a-4365-952b-f710f3ab365f", "value": "1536:fEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwTL:snBrX5Eg5Enjq3axWIfkNw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912362, "uuid": "cc28340e-015c-44ec-8c74-38469c100065", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912362, "uuid": "f58b599d-9331-4642-bff8-97a4abdd1c26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912362, "uuid": "8a60de3c-ddeb-4471-8805-af8c0988a8e4", "value": "diagram-1565704410.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601fbd21-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872252, "uuid": "373594a3-aefc-4741-b209-c5305f8fbb8b", "comment": "Malware payload", "value": "9bb098d73303622d6bdad50653868ad7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872252, "uuid": "1f229ee8-d957-4c34-9437-a4a96ca947b0", "comment": "Malware payload", "value": "0ba5cec098168d954d2d3b71b369e73d109b5fdc650be8cdecaafe371fa7f89f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872252, "uuid": "6f2b7d26-63a6-4a00-a3a0-d8992c5afb42", "comment": "Malware payload", "value": "b3fda898e945c8fd8b5a655ed434d1bb27236824", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872252, "uuid": "7ef570f4-d5e5-4276-8a24-eb1e56448407", "comment": "Malware payload", "value": "1406709495fa46252652e64600f5072beaf802dae928427e578ad4e0ab1359ba55d4cda10ca63b03db78ee823bbef01c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872252, "uuid": "bb8c3c9b-8096-48e4-b6da-d3ce6213dfb7", "value": "183302A2D312A2BCB643C049C9CC1E979377427026658EE2C56DFED1A23D7120B61B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872252, "uuid": "e437ee5b-9599-475c-8405-47217884c86a", "value": "1536:tt/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8LyNU:7XKAXh3TCdOi+KSZ4WpRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872252, "uuid": "b2e7bccc-2d6e-418f-b731-4ce42b2705d1", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872252, "uuid": "3d3c9f3f-f9c4-40a4-bd4b-949541819247", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872252, "uuid": "0c3f9703-c836-41f5-b1e3-aadfc589f15a", "value": "statistic-1335823356.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa1aa63-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916624, "uuid": "150b0ad7-93fa-4ee0-b2e3-e1ab15a732b3", "comment": "Malware payload", "value": "bb10045b57443049453558f9fda86a50", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916624, "uuid": "0e6e02e8-d46c-4ac1-9eca-3df9cf4303d4", "comment": "Malware payload", "value": "0ba79453745ab485bb776027cf1197f5da527a9f2529fbd555a9ae2e7bb7a7a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916624, "uuid": "2998ffd1-468a-4566-acc7-1d2442505a6f", "comment": "Malware payload", "value": "503976249e6dd6e5dbf17e829b8367e89207bc61", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916624, "uuid": "cdb1f837-51a0-40b1-b283-a435446d7d83", "comment": "Malware payload", "value": "7101d45be42204575862b9b999bceb9d660e72ce9ab44a7dcf4070d4d0fd4eb488307cad218281e0e5ff3ff2e143670d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916624, "uuid": "f8adf328-3196-446c-b920-dc8b2b21b73d", "value": "2133F1C65B23F5C386EDDA97085A63D8A76FC98C30143C596D2B648380BB168D0F77C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916624, "uuid": "b939fe59-de75-48d4-a2be-ce85d45b1de0", "value": "768:Ro4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S8CIoUuV:reKCVQbp4LTaI7ZaiNQMIX77UuIaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916624, "uuid": "aa1f70f1-21d8-406c-a0e2-3ef68c39e799", "value": 51768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916624, "uuid": "2ffaff6b-2ef0-4a25-b7b3-a68197b3ecf4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916624, "uuid": "c83102e1-f9b4-4122-9b4b-1d4a823b9639", "value": "statistic-66182564.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84916da7-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914834, "uuid": "5989a0e9-973a-4b31-8851-65eb7ed95300", "comment": "Malware payload", "value": "92c7db040517e74006e626f315d4db53", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914834, "uuid": "4e185fc2-74e4-4859-8252-346bcd25e4b9", "comment": "Malware payload", "value": "0bacc332ff99d906a89dd7c9e4a1a88eaecf255cd6ded4492a28a57a76ca914b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914834, "uuid": "5cdcc5e7-26ce-4ace-90dd-fa2f02cd3914", "comment": "Malware payload", "value": "2ff400f365b103cba23efce1d74d18aab48115b4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914834, "uuid": "a23155c0-a68e-4dd6-965e-c6e869615473", "comment": "Malware payload", "value": "282617f4d4fb32062bf7e2740ac2549d7be870026fe162673a576c6898830666b1950d0328a34bc8cc46c4ec22c05f84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914834, "uuid": "9cc25877-51be-4a64-ac3a-8c2b041876a0", "value": "803302D69B23E9C28AFADB670C5613D4A36FD89C31143C59092A299384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914834, "uuid": "976b8c4f-bef8-4660-82f6-507597650bd6", "value": "768:rgo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6Fd:rkeKCVQbp4LTaI7ZaiNQMIXAF5BZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914834, "uuid": "b5756745-f1b6-416d-bf9b-e5ba5b9d4ec8", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914834, "uuid": "2cbd05de-4e13-4fa3-88df-209c91a6d135", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914834, "uuid": "ba393f1d-5adb-4da6-8080-5f5b133c519b", "value": "statistic-1341752902.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2014ae-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873934, "uuid": "32686374-779a-4b8a-ae39-90c31668bfe5", "comment": "Malware payload", "value": "f8d7fc4580d9e37f77d1825b8d995860", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873934, "uuid": "1d5e90ea-4c55-4f7b-acba-82dc5e3e1f54", "comment": "Malware payload", "value": "0bb3bc4018b734dbb919b68b7f91980ac651b31fd36205f3d3e74bb274148960", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873934, "uuid": "ee289e48-c0dc-4bc3-9703-d688321a663c", "comment": "Malware payload", "value": "5d262d063dbb2e0107def44b9a8fd1c552fd0932", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873934, "uuid": "25599432-5a2e-4a56-a522-cff1041ce383", "comment": "Malware payload", "value": "be539d24f2e9592013467c9c7e4ce255fbaec4850dee94e1c05c29c6d454dfbfcc155b8066bf1a9cf83590a2b2b803a2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873934, "uuid": "43c42855-4571-469c-8e66-b60867ce95bb", "value": "5C3302F2D243B6FC7643844E4ADC6F76923742B056290EF0C15DFEE2923921E0751AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873934, "uuid": "7b931c16-b311-43bf-b67a-d71605de26d6", "value": "1536:4/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFO:4XKAXh3TCdOi+KSZ4WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873934, "uuid": "9ad265fe-154c-4812-abdc-9c3127be53d4", "value": 51599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873934, "uuid": "60046e6a-a459-4710-9902-f6bfad23150b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873934, "uuid": "3018cc2f-3a32-47f0-82ae-cea5e29d8a96", "value": "statistic-46833044.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f45aa6-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868642, "uuid": "a7254cd9-13f0-44eb-97ce-b2552d6ae505", "comment": "Malware payload", "value": "6463dc7bb091d471b662ebafa1b764c6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868642, "uuid": "cf4aa3e4-fafe-4a78-8d37-cb21097c0ce6", "comment": "Malware payload", "value": "0bb51a35dde14fbc3fb4cbfee0bc4a72d7fbdfca313108a61170c8ba4a7692c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868642, "uuid": "2506ecc5-2c07-4adf-98f4-079a62013df9", "comment": "Malware payload", "value": "02fae427cdcd1cbd8273475b2842c39a8126cdaf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868642, "uuid": "9aecf4aa-2ef7-4bb6-b17a-879b1c6b6dc3", "comment": "Malware payload", "value": "6e5ee9f16422dd8058faf87cbf8653549626268b86a028447c9fc849dc87edcdc7fde1238fbce162c2fffc3fdef47d0f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868642, "uuid": "cd66e0a0-175d-41a1-bcf3-6212b40d2b12", "value": "B533E184EF57F518CB8273BBBC882ED7AFAB125454DED0995BC3319D0286E32561026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868642, "uuid": "630b05ea-9c28-43f7-a6b7-9229edce5699", "value": "1536:oAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNq/:jpoAnd9gucKCI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868642, "uuid": "e113eb4a-ba0b-491d-a8b5-b94cca103f8d", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868642, "uuid": "9ab83859-d3a5-4634-a3ba-2786e24bfdbc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868642, "uuid": "30b67d8b-e9a3-4f4e-8277-73f223efd8dc", "value": "catalog-563821800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58266f82-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870092, "uuid": "3cda31c0-1b32-4ef9-8309-5af66f5d9595", "comment": "Malware payload", "value": "239beed0d2ce06a4f4e9fd6d83493d3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870092, "uuid": "ad2e7c10-b192-44c3-8c8f-18cfcb513142", "comment": "Malware payload", "value": "0bb56690dcfddd4a5b7dc5c550f0ffb869237e083116c6a260f7ddd80c91cd3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870092, "uuid": "0044ce05-0dd5-44a5-8349-792f2ae78c74", "comment": "Malware payload", "value": "71fcd644ed47c449c9b1c8a9d7281dcb233bada4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870092, "uuid": "107cd91b-4b94-41e9-bb00-8f1491b17b41", "comment": "Malware payload", "value": "1fc8797b80def039774d3faf3bfe8a4ee4659b3b7a138c318e0a0f52ba366ac9f3ce19f01d66ed69fcccf8836f673974", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870092, "uuid": "e03b32ad-fbb8-4946-b739-7117528b92fc", "value": "0233F19473FEE510C6B1C2F0A092A5893A4F3D91897D5DFA0CD865693F931A4CFE22C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870092, "uuid": "c58ce48b-64e7-4930-80ef-87ad657218af", "value": "768:s5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8GsVIWg6:s/czJJSI7r3Pwh8tv8x8t2n6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870092, "uuid": "77691680-3feb-4794-a10c-3aeda8341dcc", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870092, "uuid": "a25239e1-16fe-4546-aabf-c0db6bd62fe6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870092, "uuid": "bc47cec7-3bdd-4dd2-bc65-ca3b2c8c9ef4", "value": "diagram-1662911991.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798fa3aa-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867571, "uuid": "06b3c7a9-4344-451c-9237-70b784b79f65", "comment": "Malware payload", "value": "1fb07ee69f05f3e9a2974b21a6de5359", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867571, "uuid": "9136c038-5c9b-4800-8db4-0c1e5369eec7", "comment": "Malware payload", "value": "0bc3f5731d473fcdfb51280c27284a0ad3e62d1b00164360d5ac013e26ba64b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867571, "uuid": "fb98bc8c-6ae2-4be7-bfe7-385b5c2c6e41", "comment": "Malware payload", "value": "bb9b881a26a17c4fba4f2ca38dc776576fb012b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867571, "uuid": "9006ad4b-4ed9-4d88-8d82-2b1b4a3d669f", "comment": "Malware payload", "value": "48fa06023d6710bd22d7eab1f6a7a367e0fcb00d76319a1d542a048d71fb6b2d45d3ab8d10e7f678728d2ff4693d05c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867571, "uuid": "1af852a8-a40d-4955-acfa-ad8d26049508", "value": "3F33E188EF57A81CC79273BBBC842F976B77026455DEE59967C2308D4287E33161026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867571, "uuid": "a6940e8c-7265-40bb-8890-51890ddf541b", "value": "1536:xAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqh:mpoAnd9gucKCIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867571, "uuid": "2a281770-8b28-4e80-8624-80559be2399a", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867571, "uuid": "626eb2ad-338a-4b1e-9e4f-9753971f5a41", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867571, "uuid": "2ce0a2d4-bfb9-4a14-ae7a-6b2fbdb63edf", "value": "catalog-1701467323.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421deca4-b3c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620893247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893247, "uuid": "db3d5207-24f1-4555-8cee-a838a64e144a", "comment": "Malware payload (Dridex)", "value": "741850cb41f01d404f7ef85b4f317086", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893247, "uuid": "14ac1210-e065-454b-bb0e-b2b94ec3691a", "comment": "Malware payload (Dridex)", "value": "0bc7e59df5590a6837b512f73843441a05c5af6c164765846217f6db11a82f92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893247, "uuid": "62eacd0b-ce5d-4c44-a239-ef29461fef6a", "comment": "Malware payload (Dridex)", "value": "0ab03f3963029471061f7ad9f200879205f1c311", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893247, "uuid": "514f79b6-e22a-4ddf-9b73-94b2b182cd57", "comment": "Malware payload (Dridex)", "value": "3326c123977e500aff0094873270353a9834f851596c88b1dee696b814cbbfa93e0411bf738bf4196ffd2a9df268e865", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893247, "uuid": "e1582909-a90e-479b-bb5e-d24fb4626725", "value": "9FF3D0D3E21FD1A4F223063450F4F46ABA7C24C786349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893247, "uuid": "83aeff19-6382-43b4-805d-8dc4dd1372be", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893247, "uuid": "8e1f2665-0365-4f65-a186-e0a8323ba7a7", "value": "3072:b9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:b9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620893247, "uuid": "d508ea19-8844-439d-a16e-c48d2a8bd4da", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620893247, "uuid": "bf64107d-219e-4bb5-bd75-c7b1d85b4b7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893247, "uuid": "e4fb36bc-b246-46e9-b02c-87086f2f296f", "value": "741850cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ab5034-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916879, "uuid": "de57858b-89be-451c-9ee2-90bc250034c3", "comment": "Malware payload", "value": "f13a576f3dced8640c3c187951eef529", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916879, "uuid": "f6ce2f7b-9d4d-417b-af4b-5280d76421a1", "comment": "Malware payload", "value": "0bcaf22a380c86b3af7dc5653023d5c7787cf832e0a331a19b2806ad6afcefb4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916879, "uuid": "5aadb9f4-3100-447f-94e9-55a9777ac431", "comment": "Malware payload", "value": "9be9b4f8ba486d5bbad723461d2ab52cdae912be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916879, "uuid": "a1f24301-73f1-4324-ba2b-934ef26e980d", "comment": "Malware payload", "value": "84802b8e3c6871b568881a2064cfbd405bf8bbe14901ee12bdb4ff54d979ce8a669bbeab6650b14bb94977a7a3671f92", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916879, "uuid": "4cdebdb9-c75d-48dd-a318-6f60929bd6d1", "value": "8233F1C26612F5C78AFADE63048522E9635F988D31283C695D3E758281FB158C4E67CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916879, "uuid": "9ffbd26d-8f91-4237-9ca3-86b9f818a23f", "value": "768:mo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Sk9W:eeKCVQbp4LTaI7ZaiNQMIXU9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916879, "uuid": "7e74998e-9db3-4fec-9114-ccd7bedabb02", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916879, "uuid": "9851f221-a1e5-4217-bdf4-d2a87f95d8f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916879, "uuid": "5c71b0bf-6a4b-4c2f-bbf4-63d6b33418d7", "value": "statistic-856533325.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca9df89-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912270, "uuid": "4f714382-274a-4eb0-bd2d-81ee5d397f7e", "comment": "Malware payload", "value": "3b46c854eb5799532f8c3849406bcb11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912270, "uuid": "5fee63fc-ebe4-421c-9fb9-a98fc9c95ccc", "comment": "Malware payload", "value": "0bd1013c52f27b760bbc558be022f2bb67136f336e38aaf09ff256fcd78014ff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912270, "uuid": "4a9373fc-71b9-4f6e-b242-4b0e0ef724fc", "comment": "Malware payload", "value": "7bb5956f49325b969caec54aa8d0cf065fbb1492", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912270, "uuid": "d4474967-7165-4e8f-a098-8a70c8719eda", "comment": "Malware payload", "value": "322fe619e1a88b55ec1ca63ba129144fd98097baa627ed27e9faa49fe80f007bdd47b8fc5041b00b1b3344902d6a8cad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912270, "uuid": "4b3745bf-5924-4859-84b6-1944369f0ff4", "value": "B833F1D332E6C23EC4C505F1F51B6ED952AB8E98E430E0D11E9FDA4022D31A5ADA178E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912270, "uuid": "06fef539-7842-4d96-9de7-b96bde155e04", "value": "1536:5EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRG:2nBrX5Eg5Enjq3axWIfkNwRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912270, "uuid": "c528cc3f-04a6-4cba-9214-dacbece6a993", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912270, "uuid": "8b208672-c450-4e75-be35-e8d461bfc93a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912270, "uuid": "da0a5c39-2bc1-4f49-b264-520112db77e0", "value": "diagram-1494897415.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e600e2e6-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868182, "uuid": "cee12247-0d0d-4e13-aae6-b9dda9fae466", "comment": "Malware payload", "value": "ab79e77be65fe7deb9ed5ce4c925f1ac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868182, "uuid": "547d7d4d-676e-44a2-acb8-4a97e4472ff2", "comment": "Malware payload", "value": "0be93e74b2f76fa21695c598489ef19a075a89b4c21153a846517dcf3a33ddd3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868182, "uuid": "d4998cd8-499a-4f1d-8894-809dc9f5092b", "comment": "Malware payload", "value": "2307072670546589961f75810493be8b578c6f9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868182, "uuid": "5d196426-d37d-4605-8343-b21144a3f82b", "comment": "Malware payload", "value": "3cc093aa3cf2c2a0a9713cd2e3d9e39146392cb3d3726d867e20ed7f8163d6f913f5f2c5c17d3b1bd5c28cf1ec225f71", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868182, "uuid": "36f8eaf3-3188-403d-b73c-b431af0edbb3", "value": "9933F1859F57F418CA97637BBC482FD77FAB1220648DE0945BC331CD0296D222A242BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868182, "uuid": "4a902dda-cfa8-4809-8985-da4bec08ed17", "value": "1536:aAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiGY:JpoAnd9gucKCGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868182, "uuid": "3a608786-b3f4-4768-b942-1c271f6ecda4", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868182, "uuid": "9f32ec79-7819-4903-9527-34fe91f83c31", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868182, "uuid": "f5f7bebb-b7d2-4ca1-a54b-f182ddba542b", "value": "catalog-216117818.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691d9729-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871409, "uuid": "1ad3049d-83be-496b-a6ce-a956e0209287", "comment": "Malware payload (Dridex)", "value": "a1e45dc1e88149fca8fad32ea72eed64", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871409, "uuid": "536069bf-835d-4cf8-acec-da9a152b138c", "comment": "Malware payload (Dridex)", "value": "0bf570ca43f3602eea21bd0e35805026b9f86b9045f4f4ba6b177e87cf00c9e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871409, "uuid": "702d7bbe-6097-4193-b9b7-85921b05a6ef", "comment": "Malware payload (Dridex)", "value": "984f7e3f4026a36c4b8b441e8e022290ee14fcb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871409, "uuid": "57aaae9c-bee3-4291-bc3c-546cd1a54a8a", "comment": "Malware payload (Dridex)", "value": "d42a96e0b175d49167a35b27c0378aa9d8c85a49d6426826adebfcbef56b839c6782860fef97d3beb726d70b5f5ae231", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871409, "uuid": "c3ef9a47-886b-48b6-8cd1-93125772b92b", "value": "82F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871409, "uuid": "4d22187c-b940-45ad-87d7-52027a948ddf", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871409, "uuid": "9bb20505-dd60-41a5-8c73-533d6cf9fe43", "value": "3072:rar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:ds4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871409, "uuid": "8282f511-9018-41eb-81cf-d295f4130148", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871409, "uuid": "ee877e03-56ce-47d0-aa09-e3883a575e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871409, "uuid": "d4ac7f1c-08d3-402f-a728-af437754476f", "value": "a1e45dc1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d55172-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913807, "uuid": "fcea3376-9adb-4944-b734-6519635fc41a", "comment": "Malware payload", "value": "32a8cc8b56dcd61b5b22174773ad19d7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913807, "uuid": "c218763e-5c5a-4ffb-ad3e-d1600dcad596", "comment": "Malware payload", "value": "0bf60e19e5ad45a933a061907c4e0177d1bf1ad7420957af6e7e2ebfef1b0ed0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913807, "uuid": "7d5e2015-e2de-45b7-9454-3c391434bb56", "comment": "Malware payload", "value": "09feb087979c2d9a051de4446fa451ecc4ec453a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913807, "uuid": "e8af661c-ec58-4de0-b57b-c487f37299dd", "comment": "Malware payload", "value": "ee4d29fcbd55905167189faaca822ae59742539b61cfe9036fab54388711b4721cb7808d356e7f6847385e1d56fd9031", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913807, "uuid": "78650f31-e53c-4ac6-b110-5c581fb8d45f", "value": "DA33F1E132E7D13A84C545F5F82B59DAA6678ECCE530E0D02D9FDE0122E3165AE9260F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913807, "uuid": "c9711e4d-2077-43b0-b3d3-536077482f7a", "value": "1536:2EnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwsnco:jnBrX5Eg5Enjq3axWIfkNwsco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913807, "uuid": "550a2e87-277c-4cbc-bd4f-6b71507b7b75", "value": 51756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913807, "uuid": "d9146dc6-536d-4716-be36-b2acad44536e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913807, "uuid": "825556ba-bb29-422f-a88a-028c7ca001e9", "value": "diagram-55842283.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64be0e6a-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911344, "uuid": "94b89cea-b1e0-4ab9-94a5-78c28f692626", "comment": "Malware payload", "value": "f8adf18973e335ff5d53bb4914df1807", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911344, "uuid": "02e72793-e492-426e-9178-1f7d5c79c31e", "comment": "Malware payload", "value": "0c04edf99421e82a451d013d14a15fc26f3b6bb9bfde9c48b8d68be1d46bdbeb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911344, "uuid": "cfd27e1e-75dd-4de7-83c9-84f253b653d4", "comment": "Malware payload", "value": "c9a1d06cedc1bd349b7e79e457564786599225a4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911344, "uuid": "0a6637b6-8a34-4499-8f41-3edb76e08399", "comment": "Malware payload", "value": "e6c1d422e3c9a6f3c212acb083acd58661fd05cdf76080afcd4d5208b039fd55c82f1fc0d3f9fca7baba75793cf6755c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911344, "uuid": "f5554831-d6b1-4263-9ec8-1b5401e86ec4", "value": "9533029FA404EBA7C1AFA3016FB6979205FD764DE130C0289359C2F1EAC36D2817E9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911344, "uuid": "955001d1-a21d-4b0d-9c81-1121136821f0", "value": "768:Mqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMU2:FxTuDqsF1Cnc3P57oj2+nC6uxkLuK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911344, "uuid": "dc04f9d1-ad8f-4799-8f10-600e0a0cf183", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911344, "uuid": "0dc4aef7-785a-4b84-8d20-d35de46d7285", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911344, "uuid": "3ca827c5-af4d-4a9b-976f-980178a3c24a", "value": "catalog-751287701.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300bbd10-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871313, "uuid": "1c406145-4a2b-4936-837e-9f0125c85f4b", "comment": "Malware payload", "value": "b9a0c116351b32cb735c2b2747f1b49c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871313, "uuid": "cc481ab7-45f8-4d22-a7ff-2cc9bd1b9271", "comment": "Malware payload", "value": "0c088cfc97c57eaff95c4d7099a0f4b96382039195d5a4cf986b11fda6b8c77e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871313, "uuid": "66f03f9e-b9fc-4c8b-a7aa-035a1b7d02e3", "comment": "Malware payload", "value": "fa27ed19b21c3eec95cb25ea98157c74feb3fe66", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871313, "uuid": "8e8274e3-4684-47a7-a67f-1b27f0f9a2e8", "comment": "Malware payload", "value": "3d11b15b8a183714f4a2f589e0865953d1495354ee09e792096b700f38f6e0240c7a1198fe28da1c793e75e7abf36b6c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871313, "uuid": "a6176efc-56e1-4119-afe3-dbc1917493a5", "value": "FC33029673F9A910C5F1C2F0A4E27188374F3D924E7D6DDE4D88A4793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871313, "uuid": "407c581e-e752-4ed2-877b-efebaa71705c", "value": "768:s5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcn:s/czJJSI7r3Pwh8fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871313, "uuid": "63c10c69-0edf-414a-96f1-15e8b1357824", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871313, "uuid": "61d0b942-a9cc-48df-8f3a-ee4575e54b2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871313, "uuid": "360536d2-edf8-4424-bd82-2bc0d7f9bdbe", "value": "diagram-591198314.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8e5882-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868386, "uuid": "4496ad89-8283-4ff8-a957-27311f20a490", "comment": "Malware payload", "value": "f3bb59b51e69f469959d9bcd40c444bd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868386, "uuid": "5be765be-ac59-4dcb-9586-853f3f97b45d", "comment": "Malware payload", "value": "0c1770a1371827173b9c0408c19e1f37aff31e2390840fd7de8e939e1a71e999", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868386, "uuid": "d6228006-c958-41a5-ae40-065a63ed9a29", "comment": "Malware payload", "value": "51ed2145ce8213aac2205e389ac4a8f56be3e4a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868386, "uuid": "a19dd9e9-62af-4f59-82ef-9a091394f904", "comment": "Malware payload", "value": "2d0b7d947fa4d883fa405559925308a3c1aa3600640622179e2b23dc77f01a8cbc0e609965bf70f3f010d55ec2203add", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868386, "uuid": "80a5d3f1-aeb3-4aec-ab43-ac77e4716cc1", "value": "8A33F1C9EF6BF418C79373BB7C892F976EB70224658ED59857C3309C0292E62561027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868386, "uuid": "be9d956c-f218-452b-a5ad-24c0b5f9f5e7", "value": "1536:SAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrlP+:hpoAnd9gucKCfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868386, "uuid": "6ca39de0-7d92-4a40-8ccc-11fb49952b96", "value": 51571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868386, "uuid": "acdd62ba-8a6c-4992-9370-67b51b2bf33c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868386, "uuid": "0135d3ed-4408-4151-8087-a23e4006c16e", "value": "catalog-374706774.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9dc81f-b3c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620893163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893163, "uuid": "5548278b-2fce-4973-920c-47579885c7f6", "comment": "Malware payload (Dridex)", "value": "c557346e104fe4eb71864770fdb68dde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893163, "uuid": "59614188-656f-4763-99f9-2a263edfeebe", "comment": "Malware payload (Dridex)", "value": "0c1bad9c4f7e6c87a61ab98f77b1ed49a8b356a100bb75ce9a8a05af2ba69748", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893163, "uuid": "bcc407dd-f037-48ba-a772-8a0542666b51", "comment": "Malware payload (Dridex)", "value": "eeef686d1becf4223006fb0ff5dbdafd1fddc539", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893163, "uuid": "eb754421-0619-4d56-9c0c-fbcb37b06c7a", "comment": "Malware payload (Dridex)", "value": "dae4a491a1154d61f99b361835463625412a0c301fb51fe46ba85b0d416c08cbe14e53bcb2f4f7768ca645b26a84f2b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893163, "uuid": "5fd3e596-1d9f-42c3-9606-aa9a983f3ff6", "value": "62F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893163, "uuid": "977b5da0-63ec-49b0-a59e-a5334abd80ca", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893163, "uuid": "ef35968f-f3ee-4fd8-a0ae-c446dbd6df7e", "value": "3072:A9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:A9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620893163, "uuid": "bd4babd7-d5ff-4870-93ef-9292c78dbc2c", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620893163, "uuid": "ae863f0f-d145-437d-87a9-18343560275d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893163, "uuid": "baebc244-8240-4cc0-a72c-034629921ec5", "value": "c557346e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f7bd2f-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913793, "uuid": "f14ca8e5-ef4a-4ded-ae3b-68f3dd1ec9a0", "comment": "Malware payload", "value": "f479574538fd9301600cf9cf765e8ed4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913793, "uuid": "eeb6520f-7998-4fa9-b839-865fe7984f94", "comment": "Malware payload", "value": "0c2166318b810875b53d3022ce40f1350028e7ccaf6796dfd13a1f0ec884dfb4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913793, "uuid": "8b00d964-0382-4411-9851-bacff5ca8d6d", "comment": "Malware payload", "value": "05b8be67b95c26d41fc209c2b8d89e2b7e0c4284", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913793, "uuid": "8b5f4d33-49d6-45ba-a450-deabb51d6d0a", "comment": "Malware payload", "value": "65af9240114b987d5398d6e2c126e1570b262131dc742db1c389728026f257db5b9a6e5bd19d0ce7b3bb627454a8d118", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913793, "uuid": "2eeb95ba-ca57-4c78-ad3a-a7d19c5af25c", "value": "1933F1D233E3D139C0C115F2F52759D96A978E88F920D4D06D9EEA4023D316AEDA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913793, "uuid": "a0bd257a-01ab-4d86-8b2b-c61428c04eb8", "value": "1536:2EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMq:jnBrX5Eg5Enjq3axWIfkNwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913793, "uuid": "6b3c3baf-f61c-45df-b2bc-5bdffae64d12", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913793, "uuid": "fba11b34-e579-4260-90d0-afbc45e7cba2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913793, "uuid": "c343e3d0-9058-46a9-b4a8-62656a2b9142", "value": "diagram-549707221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a2ad18-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874436, "uuid": "00eccb11-025d-42f2-b180-181d5f3dd2f2", "comment": "Malware payload", "value": "c81a436981813a32ebb5a721fcb7810e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874436, "uuid": "11bbac77-e307-4f15-917c-863fcf1861da", "comment": "Malware payload", "value": "0c22e3419e7099bd5bf815208c228c96931dc377aa0f000e79860425135a220f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874436, "uuid": "a2463bb6-b127-4e08-bf04-094d0b936455", "comment": "Malware payload", "value": "d98daee9410fcfb30b02e6646213aa83bb9c518d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874436, "uuid": "11ff9c35-ec92-4275-a242-0cd80c6143c2", "comment": "Malware payload", "value": "3500d7f8ddfb9065ee78eaf908cdd7cbbc1010dc8b9a110148e01c9214d96bdfcc9d6ad7178926b1c63beca31ffca617", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874436, "uuid": "4c96a7df-4b0f-4dd8-a92e-b3535bdf7fce", "value": "453302F2D243B6FC7643804E4ACC6F66527742B057691EF0C15DFEE2923921E0781A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874436, "uuid": "6fa65354-0c0a-4ee0-8162-1d426d85bd84", "value": "1536:5/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjF/:JXKAXh3TCdOi+KSZ4WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874436, "uuid": "d98d60c3-9dd9-435a-ba96-9e689115fbb9", "value": 51601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874436, "uuid": "e9ed621d-703d-42e1-8efa-0ac39539e84e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874436, "uuid": "ebce8264-6837-4d20-93ad-fc3e4af3a656", "value": "statistic-874705595.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02645a1c-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911179, "uuid": "e6aaab10-a328-44f1-92de-82a551940203", "comment": "Malware payload", "value": "f7011fda9d681c95e7fa7667f47b3dbd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911179, "uuid": "427559dc-7575-45c7-a535-392b1b62dd81", "comment": "Malware payload", "value": "0c2e01be9b114e11ab7ad583fba8881d3f068f922a0b45d9f62021584ff379d8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911179, "uuid": "c804bf91-b40f-4b5d-b393-4b67239b3b6a", "comment": "Malware payload", "value": "8bff8e9fb1209cf17aa8809174af8c5ce05ba9d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911179, "uuid": "d9b0371e-fbb6-4584-937d-7c5a0379b87d", "comment": "Malware payload", "value": "218651e9e28bf18cdbbf400f6bfc26b8219e82c09478cd3c4c85154c8189ba0a3a40e697331b19e34c98e9c827cc8b59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911179, "uuid": "321ff799-66b0-449a-b77e-9ea00d1b2a74", "value": "AE3302DFE004EBA3C25B93005FF98B9215FD7918E1708168979986F9EA837C2C53D5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911179, "uuid": "3a8a1bea-edda-4c3a-b650-00a117430ed0", "value": "768:Oqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3g2hfvM:/xTuDqsF1Cnc3P57oj2+nC6uxkLYkXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911179, "uuid": "71acf86e-60f1-4f65-b313-444776e3823e", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911179, "uuid": "40b61564-4028-48b1-9491-8947bf9456e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911179, "uuid": "25cf0874-893f-4b9b-bdf7-8d24d5bea75d", "value": "catalog-654064810.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384c81c3-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869179, "uuid": "8bce2893-71e9-4d27-b12a-2bb24af7e423", "comment": "Malware payload", "value": "3b3e09bda2a4d4b43103a7ae35d32451", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869179, "uuid": "5c7896a9-b137-4042-992c-a6abf1d45790", "comment": "Malware payload", "value": "0c3ca95d5331dc0b951c256d41ebc7b25126e10b3609384ec3b09a67d718952d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869179, "uuid": "a28ea289-b3e9-48f9-a69f-a2e7bb01174f", "comment": "Malware payload", "value": "1209df35dc78aec75c9e108e3bdc53d9454cdf4c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869179, "uuid": "11465746-37d2-474e-9d5b-0553a3917405", "comment": "Malware payload", "value": "cbc7dcb805c32fb43a0f0abac4dd3a6cfc8d104e2453a0dc7f44f1b6f21d7c6c9326ac8e7d9bd6798b75334854ce9619", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869179, "uuid": "a06cda9d-5b74-4c67-8c63-c11ad971b476", "value": "F333029473FDE510CAB1C2F05092B6893B4B3D918D7D59FA4C99A4AA3F830A4CFD61C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869179, "uuid": "bdb96f3c-d213-4c00-9e32-282ca3bdc7c9", "value": "768:Uw5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8l1L:Uw/czJJSI7r3Pwh8tv8x8nL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869179, "uuid": "2ea8ed1f-f4de-46fd-ac97-94d9bd13afef", "value": 51598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869179, "uuid": "daebbf80-5589-4692-8d5d-fd776ac97b93", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869179, "uuid": "1fc7fb1e-ec12-4d3d-b4af-3345e011e2a0", "value": "diagram-1017482261.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b33d09-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870485, "uuid": "d4227864-2b8c-42de-bf1b-5fd9f01bfc24", "comment": "Malware payload", "value": "535d7ae6f95a86ca22bdbb5f97ff4de4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870485, "uuid": "accc497f-b0db-4142-a117-5d9395e632c1", "comment": "Malware payload", "value": "0c3e6e4eaee07a3092d61332d483f47f73059c308a2c5306b902d0a1786fae72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870485, "uuid": "b4345f9f-773c-409a-83b9-eb854bbd283c", "comment": "Malware payload", "value": "03e1b252d832298c4fd8d28c87627a8763063e70", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870485, "uuid": "decd2843-f86d-48c9-a0cc-43d7c6b338e0", "comment": "Malware payload", "value": "2209dd52ba060be24b8891b603c39519569058a62db613a06e3b48f8b5d943e5512eaec0401610e10c9235099da92090", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870485, "uuid": "0c734d78-78cf-4f47-9b6c-b74c856d5ef4", "value": "E133F19133FDE510C5B2C2F1A1D272C8365B3C618DBD99EA09D865653FC21B5CED52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870485, "uuid": "9ab46e51-76e0-40c7-a666-51ddac59e3f9", "value": "768:d5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ4tbf9:d/czJJSI7r3Pwh81tb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870485, "uuid": "16084047-90c4-49d8-b520-29dccc9529b0", "value": 51597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870485, "uuid": "508f1724-6361-46ca-b61f-795456722f97", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870485, "uuid": "e6eedea2-7e64-4308-b032-f43544c174db", "value": "diagram-1946260889.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b490a98-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912483, "uuid": "6882c5f2-dd8e-4cdc-b478-c434396b8e01", "comment": "Malware payload", "value": "bdd3063d105cf7a4cdb1fb8d4850e77b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912483, "uuid": "8d1fc2b0-a5a1-4cdf-8661-9ac96002d5dc", "comment": "Malware payload", "value": "0c4e1f164b0df0bdcc84036376a0ec34ad73abc21c7f51558affbf9753773d88", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912483, "uuid": "3316659f-9094-4f3e-8a6e-fcac9ab5ac80", "comment": "Malware payload", "value": "76a2089dfff6db47de44553c859a9387f8de2d2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912483, "uuid": "5519dcab-1fca-4d54-a59e-e7551db560e7", "comment": "Malware payload", "value": "5ec59f840f6a6c4e356062b83004abc758eb2e20cf68b5981d6574f70237e4bc8a6221a984c2261d44c46af0e5ddabe6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912483, "uuid": "efc9ed1f-832b-468c-8a8d-177b66aea4e0", "value": "3E33F1D132D7D13AC0C109F5F91759DAA6679E8CF530E0D01D8FDE0122E3165AE9160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912483, "uuid": "e021cd88-20ca-4993-b6dc-f1d9134c18dc", "value": "1536:XEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwwnrH:UnBrX5Eg5Enjq3axWIfkNwwrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912483, "uuid": "73fe52c7-9597-4bd0-9283-87a0d35ac518", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912483, "uuid": "ac9123bb-bbfb-4656-82db-0fa55e4ddee4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912483, "uuid": "a93110a7-48dd-423e-ac6b-18f693d8cad4", "value": "diagram-1659933636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2739a881-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912100, "uuid": "b63a7ac3-4ded-4de3-a915-4498cc923716", "comment": "Malware payload", "value": "27a0f67e7721154e052820514084c080", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912100, "uuid": "66535724-2c7c-404f-9edc-5c2fcc3423bf", "comment": "Malware payload", "value": "0c558938345d4f2acfbe75c19948278edbce0a5e9cc0bad5996da8fced886c8d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912100, "uuid": "e2f4f3a7-7a73-452c-8e02-23b7bb32c613", "comment": "Malware payload", "value": "fe88481a652ba73567ae445244b9496ed655dbe3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912100, "uuid": "2a629a32-170a-4112-b2e3-026c336bb627", "comment": "Malware payload", "value": "3b2b2b22386616ec3f9cbd9b9d78c94e4797400270bb36537bc51c5a2f8749885eb6a2c148105adbaeada06993f98b01", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912100, "uuid": "aedefac6-fad6-48dd-99db-56fc1d3821f4", "value": "B53302E232E3D17AC4C609F6F43759DD65A78D88F93080D02E8EDA5112D31B96D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912100, "uuid": "fd607ab7-68b4-4aa1-87ee-7ce4571379cc", "value": "1536:OEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHyRm:rnBrX5Eg5Enjq3axWIfkNweSRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912100, "uuid": "23140723-1a62-4fa7-98a5-0f5781b1125a", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912100, "uuid": "cb49eef6-3872-4a59-94aa-898ea83ed91b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912100, "uuid": "91b0193a-6345-4868-8ec9-c055d7b313d1", "value": "diagram-133672309.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac35342c-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911464, "uuid": "8fa7fb9c-648c-4171-88db-07bdcef72a49", "comment": "Malware payload", "value": "6c7ac140bf7aa07ce018c9acfa63ce16", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911464, "uuid": "9ea0efaf-7f6d-41e1-a178-dc05a7e8ff9d", "comment": "Malware payload", "value": "0c6128f068dad34b189ac9d7496a24220d2e6d8717f6111cf9ac4f0d57c44b63", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911464, "uuid": "682f2fd3-9e11-4f44-b5f4-fa48384c4dbe", "comment": "Malware payload", "value": "897f2bf48b15497e1319d15def6b28d41dbbffd3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911464, "uuid": "b14a5195-f6e5-49cc-9866-d981ff662466", "comment": "Malware payload", "value": "9296c256b266e519be03a7f1253ac4910dfd96b82c8c75b525cde284cfec38052674bc367c58f4a41c69da5da81d1e5e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911464, "uuid": "785bcd66-fff3-43a4-8e3f-c036e714fbf1", "value": "753302DFA014FAA3C19B67015FB9D7A206FC7A1DE270D158C35AC6F5E5C35C2812A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911464, "uuid": "4eece53e-5b4a-4d29-9dc8-8e44a3f5abed", "value": "768:8qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7rL5:1xTuDqsF1Cnc3P57oj2+nC6uxkL7rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911464, "uuid": "33965c3f-5b15-4364-8204-08caa2fe0bc8", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911464, "uuid": "8a44ab19-7d37-4b4f-83cc-43c4aa97cf1e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911464, "uuid": "0a882bb4-ea44-4f48-a459-b23dbf20b3be", "value": "catalog-854631403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebc543c-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871955, "uuid": "da37a44a-9335-428c-8db4-748f1877e4e7", "comment": "Malware payload", "value": "398e82fd202c5ee6edfc2d0605280ff7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871955, "uuid": "d1fd9759-6ba1-4494-8d73-423f9806a3f3", "comment": "Malware payload", "value": "0c68e361bf2950232975f84066df0832d1cfb77187a5e9b45d08f1e63da6abd8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871955, "uuid": "a1cbf0e2-6ed6-4c35-8462-142f5e6628bf", "comment": "Malware payload", "value": "a319ba7f1f7f2475dac6c4fe4437de6b3ea1a6ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871955, "uuid": "1a0256f7-b6d3-44ec-b1ef-41169c53c201", "comment": "Malware payload", "value": "130447ef89b04105e932d40779d4128dedccd46ffa10a4bdc327653d15a7fb937cef0c118860eac5553bffaa8e7cd1f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871955, "uuid": "d06bbc5c-670a-463a-b3c6-d6eea6674080", "value": "7D3302F2E682B5BCF542C1859ACC9E1B623F82706A294DB1815CEDD3933C71E0B5169B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871955, "uuid": "1018bb12-89af-48d0-b149-491b627f8199", "value": "1536:lD/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Weih:FXKAXh3TCdOi+KSZ4Wzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871955, "uuid": "f82ac21e-a199-49a1-94b2-8b47291e440b", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871955, "uuid": "855c9f6c-b0be-4eb2-b7d9-ea485545a43e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871955, "uuid": "43dda206-8077-41ae-9224-624851ec8f8d", "value": "statistic-1075768599.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6637df8-b3b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620885712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885712, "uuid": "91493116-4a09-426b-a6bb-423060c3c112", "comment": "Malware payload (Dridex)", "value": "c1ec6cbedc26504ac5bb6dc0f4f6a976", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885712, "uuid": "f0eaf725-5bed-413d-a4c1-f2308e5d9a98", "comment": "Malware payload (Dridex)", "value": "0c6a27995937d0b6d2899e5abf554428ec81e22708fa07752a0d36cf3104382a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885712, "uuid": "fd53f587-0d54-4757-9d48-fcae733f14bc", "comment": "Malware payload (Dridex)", "value": "a351867baa7e3d98386a866c42459dabe58557db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620885712, "uuid": "dec5888a-037e-48d6-af2d-673eba08ae04", "comment": "Malware payload (Dridex)", "value": "87e2cdaf9749d965115ccdb847ef5db69b4321124d0e53d88d9826f49785b8c6d9c1ea181abd60233eaad0dcbe7c1dd2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885712, "uuid": "fd903278-719e-43af-a2bc-99bd1f88454f", "value": "ACF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885712, "uuid": "d1dac9b9-5315-407c-932f-a1ba81b0e267", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885712, "uuid": "a8fef4f5-de82-4b1b-a785-799ceca7311e", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620885712, "uuid": "3d6c0f28-793d-4ce1-920c-f87d935af25e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620885712, "uuid": "2134ed76-9b40-4f3f-b8b8-bd891ce29780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620885712, "uuid": "f8486966-1132-445f-8a20-3ae90c89ed66", "value": "c1ec6cbe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff30d823-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914610, "uuid": "f193ae70-cfe0-4bb0-a8d4-cecab87f3525", "comment": "Malware payload", "value": "f705473c925d1c27763efa270588643d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914610, "uuid": "3ba6b525-4477-4aa9-8a40-c26b98500220", "comment": "Malware payload", "value": "0c903fc70ef5f2bd6a07a3b767fdfc57d6bb9b1d552c5169c4473ebaf5d8ee5b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914610, "uuid": "5edf2cc0-103f-4225-8e49-0d2640bfa0b3", "comment": "Malware payload", "value": "7394d608ad29b3dc31dc63777c77e09099422f1d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914610, "uuid": "923682ec-f4c7-476b-84b0-9a5470925d3c", "comment": "Malware payload", "value": "4ba4f47806f0c970b130c0abcbfaf812d27c8db7de13ad9db17cd1aab8ebf24deb8294bc6a549f12ac5302d91abdb379", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914610, "uuid": "aaa695cb-a973-429b-85bf-7c5d5f95f862", "value": "E233F1E65B23F5C2CAFEDEA3044523E5939BD49D71283C58592F258240FB568C4E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914610, "uuid": "00263362-6611-4e27-bbc3-def55f26d5d6", "value": "768:Ro4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/dL:reKCVQbp4LTaI7ZaiNQMIXvdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914610, "uuid": "a87ae4a1-4121-47a7-a391-e9fca66b230a", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914610, "uuid": "d71f5c73-6dcb-4b1f-9b7e-27b387f521ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914610, "uuid": "1082b767-c758-4c07-9308-b7852a212676", "value": "statistic-1160348147.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d27d8b-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914220, "uuid": "bae7ed68-c568-47dc-a488-247936a4fb01", "comment": "Malware payload", "value": "bfda5952e89f52c3e3390a0838fdbad9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914220, "uuid": "9a5ae22c-a6c5-4731-93df-68ef8638ed8d", "comment": "Malware payload", "value": "0c9879d4fd38931fc0ec28566ed8b84a713e6369da53c04e654d7a8658197fc2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914220, "uuid": "151aea31-ea82-4a9c-aa4c-c8102dbd3338", "comment": "Malware payload", "value": "f1c9a6747351e3fd50fe8f1f42ed024c159e4e74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914220, "uuid": "ee4e6695-3eb0-4afc-b130-778841a2ea95", "comment": "Malware payload", "value": "e846e0eb40449aac8b3073c2e3ef0017acddd173a0826ac16dbb16cc4a3e6e4776dcc9417b0f6c15bc99fb838e549ed4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914220, "uuid": "796427e4-135a-4bd5-9694-1a18fe992e37", "value": "E533F1E232E7D23A80C145F5F92759DAA6678F8CF530E0D02D8FDE0122E3165AE9160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914220, "uuid": "b673192f-4732-4749-92d0-504297b74f34", "value": "1536:gEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwsn9q:FnBrX5Eg5Enjq3axWIfkNws9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914220, "uuid": "952cc4ad-7ed6-4b85-8375-8055960eea2b", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914220, "uuid": "0374affd-ea89-4c71-b9d2-3062b083903d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914220, "uuid": "65891522-cb6c-4259-9524-d28596012966", "value": "diagram-870593690.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b97b0c-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868578, "uuid": "3715a3b6-55f6-4564-8ce7-ac7c8c8bbd2f", "comment": "Malware payload", "value": "87cfa7aa6d2926eb4b73eee9f5774ed9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868578, "uuid": "1d6c9400-9b5b-4d0a-8efe-5a6bcd1378e9", "comment": "Malware payload", "value": "0cbad23b233e1ab94a371b33aef5785cfe3834684a1ddbefc90bfe740cbe7c33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868578, "uuid": "a2eba2d1-afd8-4d94-bc22-30f7aa9fea26", "comment": "Malware payload", "value": "e5e4bdce5be67a0ace8ddaaf8f000727b5be584c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868578, "uuid": "695ced40-259a-4e2f-ba1a-520111b79bc9", "comment": "Malware payload", "value": "6aee834622dc632082f6af774658d1496e07050430df65f55e941cc2319b7876f7e16f0ce4c73d49d17d2491d89af07b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868578, "uuid": "40d47d59-b225-4754-8c3f-eac74c802442", "value": "7F33E188EF57E818C7D273BBBC852F976B77026454DEE5996BC2308D4287E3316102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868578, "uuid": "310b9441-3c75-4b1f-9a7b-76dad584f1f0", "value": "1536:bAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNq0:8poAnd9gucKCI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868578, "uuid": "ff697f50-2b97-4246-a245-089fe3464b76", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868578, "uuid": "23801274-f03b-4158-8607-bcb883c306ba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868578, "uuid": "5d9590e4-8e8b-4b96-b51f-681a6526dcf9", "value": "catalog-521062569.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d844e52c-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915833, "uuid": "075b37a5-8584-4d93-9aa0-451797f0a133", "comment": "Malware payload", "value": "db520a142a70aafa00b1dac1032ebfd8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915833, "uuid": "683bcfbb-8a78-4c16-be91-fc20f2e90d8d", "comment": "Malware payload", "value": "0cccd4a09677739caaa116d78d59411965f2d5315aca9b0ba3e2f2b69483dcd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915833, "uuid": "70e4fcc6-7a6c-4307-a550-6cdb64132b73", "comment": "Malware payload", "value": "dc345ef1c3bd0946b729a36dd252aeb4309ad8f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915833, "uuid": "31052fd5-da7c-4020-8f38-bc2d20315f2f", "comment": "Malware payload", "value": "eb52c396c59f377ee87354820442b4e150f1d03ff253723bafa16af70ff3344617a8479cff7d65d0ebe0dc154b16163f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915833, "uuid": "f72b52de-0bc4-4934-b3be-a17d9c9c3660", "value": "B53302D69B23E9C28AFADA770C5512D4636FD89C31147C59092A299384FF158C0E7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915833, "uuid": "4762d7c9-489d-446c-8451-e1e8d4a04255", "value": "768:So4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6F0S:KeKCVQbp4LTaI7ZaiNQMIXAFht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915833, "uuid": "4fb0d291-9795-4259-ad91-41c51c7a6585", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915833, "uuid": "6c7c1272-2e17-4201-8325-aa622e31b3ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915833, "uuid": "d148c57c-f7c3-4a28-a753-d4a721e8b2bc", "value": "statistic-2096470875.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e3d9f1-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910299, "uuid": "0aaa9966-227a-4a0b-a47e-3ad4711a0393", "comment": "Malware payload", "value": "6ebf668ae415de8bb1cc073235957277", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910299, "uuid": "60d30a55-8c49-4959-bdf4-b8d086172ba8", "comment": "Malware payload", "value": "0ccf820742e05dec0602c3000d2e9b97f2332891a5d42eda4686a38c071ea8a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910299, "uuid": "3dd03902-e141-4015-954a-f76a1d688694", "comment": "Malware payload", "value": "4a48ed09893bad18ffe91d48c29750133a4c5ac5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910299, "uuid": "8a1a3b3c-32ea-4377-ae1b-367be845a958", "comment": "Malware payload", "value": "096bba91025c225abfa6583367dbb15d47fc7ccf8e7b12c585258a2e5abc79912dd1f108b181d27570816e40658fa13a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910299, "uuid": "0c31b578-e044-40dd-9398-0067505beac1", "value": "993302DF9410FAB7C1AB67015FA997A302FD791DE130E198C35AC6E5E5831C2817E8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910299, "uuid": "8b52f529-9aa0-49af-837e-04a43f9952af", "value": "768:Xqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7QLz:axTuDqsF1Cnc3P57oj2+nC6uxkL7Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910299, "uuid": "156884d2-ff7c-4aaa-b6d4-6e2a37ff9e0b", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910299, "uuid": "f4d990b9-3854-4566-89ad-3c4e9eac52e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910299, "uuid": "52a5002a-c071-421f-bc28-87760c31def0", "value": "catalog-1892312138.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3248116-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913731, "uuid": "3f735a2d-8b7c-46df-a5cb-d96e7733bbc5", "comment": "Malware payload", "value": "666ba77fc6ce1280d68679f6443392b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913731, "uuid": "b77ecf80-80ec-43e1-b944-5036f69dc7a1", "comment": "Malware payload", "value": "0cd47c5f83b00bf9c8613e9deb7c070f48a0ff8208f936b50becca9010bc8fd1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913731, "uuid": "033dd3f1-c311-482e-b9a5-0744522afc07", "comment": "Malware payload", "value": "2d597ee1b06e8e73674bdb0e49d002430d18c51e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913731, "uuid": "a72a368a-ece8-4682-bc07-90fd63e5ef8b", "comment": "Malware payload", "value": "1fb0708a594483b8de97f4bf57c0a37b79f066a7f7971e0be9e574771406a25e2fa14e829e8b0f57b7513a2a25c248ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913731, "uuid": "8d2afe5d-90d9-40ff-a6ce-fba01874f56e", "value": "AD33F1E132E7923AC4C145F5F92759DAA6678F8CF530E0D02D9FDE0122E3165AE9260F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913731, "uuid": "e4c71bee-aa77-43f3-b0d8-723781b24ecf", "value": "1536:2EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwwnXa:jnBrX5Eg5Enjq3axWIfkNwwXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913731, "uuid": "6bf78f98-4a2c-49c4-923e-efc31d226381", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913731, "uuid": "7e392b76-c255-4987-b665-8819d41fcad4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913731, "uuid": "f0e0f24f-4450-424a-9d85-304f5f013cbb", "value": "diagram-512372284.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3107a3ab-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913405, "uuid": "cedbbec2-9c03-40f6-a8fa-8ca99883a3a1", "comment": "Malware payload", "value": "26a602236c2c1ad6d8c5eacd9de86a11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913405, "uuid": "1421d1ce-d54e-489f-a851-3becadf7bb1d", "comment": "Malware payload", "value": "0cec31cd28bbc8dbb3d319c3db29c268a4066d8b41732f5c2b5b68120f13f44c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913405, "uuid": "cb4ee48d-4dde-437d-ab32-f897ccc5046b", "comment": "Malware payload", "value": "5d7e945e969c6e1941da2aac5f41e9bf5fdcf0b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913405, "uuid": "3a56db35-a60b-4a13-890b-48810eecad27", "comment": "Malware payload", "value": "4029491a167cb90c4abb923eb481bd38b292b01141c0771f29477da7fb058529387b8fd165581e3bfa22360456e1f4e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913405, "uuid": "55fc24ee-f208-4699-9cde-aa60031bd1a9", "value": "3333F1A232D7C13BC0C546F1F82B5ADA66B78EC9E920E0D11D8FDD1113D3165ADA264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913405, "uuid": "4d08e117-4c41-4eee-b3a6-68d75a197d1a", "value": "1536:WEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwe2RH3:DnBrX5Eg5Enjq3axWIfkNwe2RH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913405, "uuid": "44e5c5cb-7de1-4ead-9b19-c734caa46e6e", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913405, "uuid": "339aafe6-8560-4a5c-94d8-1a6a4b0fdad5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913405, "uuid": "c8b9f99c-fbff-43d2-82e7-6caaff9e9b30", "value": "diagram-309722796.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5560b9f-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872369, "uuid": "aa710830-51ef-4b31-9fae-c2b8a377c46f", "comment": "Malware payload", "value": "3fb59d8da60d714c24d5d73e7cc046c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872369, "uuid": "6c431edc-b2ea-44ee-a9e1-b2b75a385086", "comment": "Malware payload", "value": "0cee04313b7227b9cd42b969bb48d780cdc4a20451299de6950c3308759e8c85", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872369, "uuid": "1b22e4a0-34c6-4230-ba43-599212448f17", "comment": "Malware payload", "value": "49bb36bae3e21d43053518d9684c0ba93bd94dad", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872369, "uuid": "ed7be1af-174b-4b0d-93d9-25209f4419d1", "comment": "Malware payload", "value": "d04fca6be51f332daa6095da746ec6f4f9aaeb4acf385a9d8c671417586040d29fe0dcec0a2d2482b54e181f092f1649", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872369, "uuid": "4b703d32-8a22-4308-8341-f535b83dc714", "value": "963302F7EA41B6BCB543C0C68ACC5E66127B8170556C8D71C11DFED1633E30A0B61A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872369, "uuid": "41fe86e6-8b2d-4b80-9e5d-1c0a1d898792", "value": "1536:gf/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeUuXz:WXKAXh3TCdOi+KSZ4W/8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872369, "uuid": "e0abb4c6-2769-4a1a-95ad-fbbee59b6910", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872369, "uuid": "ee6d7168-8d02-432a-a00b-fb6b83067311", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872369, "uuid": "c796ac3f-3c78-48aa-a313-c71db0bd171a", "value": "statistic-1403536610.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583a4a03-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913041, "uuid": "e9ef954f-6f41-4b49-a9ec-c5761db94cea", "comment": "Malware payload", "value": "1706c45bc302551bbd10e839008d863b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913041, "uuid": "6942745b-a474-4552-ab78-3f8b3054e4ad", "comment": "Malware payload", "value": "0cf2eec8138bf210a740100866061aa27517f9aa9465e1d492ef0170e6cb4b94", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913041, "uuid": "a2dc801f-0a5a-45f7-8008-e5a480860272", "comment": "Malware payload", "value": "6aa3d1b8d4703f40bfd6751d84731b17d36ecbf0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913041, "uuid": "0ad4b4e3-adf3-46d3-bb4a-446545a48b98", "comment": "Malware payload", "value": "a9664709ad5d22659be67761892696aa1fdeca6243a7b0165cf69b9a6e853a49c0406c632efc87bde6a30bac1a31a8d9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913041, "uuid": "3a2be481-4e62-40a6-9215-b77cf2ade05c", "value": "B433F1A232D7C23BC0C506F5F82B5ADA66B78EC9E920E0D11D8FDD1113D3165ADA264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913041, "uuid": "0f1280da-4e01-4a77-945a-212da55ec414", "value": "1536:6EnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwu2sH/:vnBrX5Eg5Enjq3axWIfkNwu2sH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913041, "uuid": "29c9f46e-2c41-4929-8982-78d6e2e46bcb", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913041, "uuid": "114578a5-836a-4172-9d39-2764588b895f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913041, "uuid": "91518334-c329-481a-a8f4-3a1a807905e7", "value": "diagram-1981952081.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcd95f3-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911843, "uuid": "ec1b49ad-b7ab-42ac-9367-6074894ac94a", "comment": "Malware payload", "value": "7556947bd2c2e687ff16c8ed88895fad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911843, "uuid": "ff22894f-8190-4e98-8473-083968de5272", "comment": "Malware payload", "value": "0d05282bb8a103208b05fe93438bf11b37ea2bd991574ab6cd32833001cec5f1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911843, "uuid": "5f97d3e8-1f9a-4e9a-b3b6-5f94a26fba07", "comment": "Malware payload", "value": "0690592611a4163561d14fd41d085ca5d567d89c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911843, "uuid": "7ec333b2-7571-4098-bcf7-2e01ed2b3d17", "comment": "Malware payload", "value": "7cb77c7fdb88d60e0d7914c9dcc98f74b0d5ab2b6bc8161d7b43fd54ad9afb42711f57d5a5d17bed2f40b0ca9658f073", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911843, "uuid": "751287b4-11df-483b-8772-aaa0f09cb616", "value": "B333F2D233E7D239C0C505F5E52B49D969E78E89F530E4C05E8EDE0022E316AADA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911843, "uuid": "7cb07f8d-2bca-4a81-b740-7d58440fb9ff", "value": "1536:4EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwbciMCO:NnBrX5Eg5Enjq3axWIfkNwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911843, "uuid": "eb9228f5-f15d-4b88-b7cf-33698f176c0e", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911843, "uuid": "3b6c86c7-60fc-418a-bd47-c93bdb0ccc77", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911843, "uuid": "7ddb0033-dcd1-42e1-8b5b-5da576ad90ab", "value": "diagram-1114107223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858a05c9-b3c1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620892931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892931, "uuid": "4e69fd3a-5cae-413d-a929-a510e4ddba84", "comment": "Malware payload (Dridex)", "value": "6bf4872bab4d0b5693dfecfc52d40e8f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892931, "uuid": "f1addff1-4a1e-42ca-bc73-a5e827a320b0", "comment": "Malware payload (Dridex)", "value": "0d0c4876caf51ec92d8624356548008b74f162a325b8bce1a3921eb7bf7d7c3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892931, "uuid": "12741ce9-c532-4827-bd5a-567711a38c00", "comment": "Malware payload (Dridex)", "value": "9ac92d8e04b17eb8b454a5c63f40ba9c06ddb6c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620892931, "uuid": "be3b5e72-b3eb-475e-b5ee-5762137caca1", "comment": "Malware payload (Dridex)", "value": "4097387db88e0636da3ac34f333df42d328b7eb1b5093b3e739708f641faca3f761eb5594068b4a5279976aaf451f2e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892931, "uuid": "fce40886-2c76-4ba3-af6b-523020e26f35", "value": "1DF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892931, "uuid": "be4e81a0-5791-4211-9456-7aae376ea8e1", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892931, "uuid": "039e40e7-a3ad-4f6e-ac5b-eca8c75928fd", "value": "3072:g9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:g9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620892931, "uuid": "5776f9fb-65a0-4eeb-9218-b1542c9a3142", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620892931, "uuid": "287e5379-31c1-471e-9fa1-ed2c648af348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620892931, "uuid": "142f0f74-bf74-40d1-bd11-2c59059d941d", "value": "6bf4872b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83ebcca-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866844, "uuid": "ce5f5914-cf36-4d32-ac7e-1d91415b7437", "comment": "Malware payload", "value": "6a1b5ae7fe1b833659f37f43f21805ef", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866844, "uuid": "1519c9f0-80bc-4db1-a9dc-57b827101806", "comment": "Malware payload", "value": "0d0e7b6b22818b541a2b8f62094dacda043cc256185519bf9ae3c15af39375d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866844, "uuid": "8a369010-d27d-40c0-8713-32e7b82e6034", "comment": "Malware payload", "value": "a345db2378ac95793bd313d40c429810e9d53969", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866844, "uuid": "2d15c910-51a9-4b48-ac7b-965c51d29984", "comment": "Malware payload", "value": "bd74aa07e2a08de90006f6290bb18873daa742a91031972082cc28e586308f7dd084e21dba8d54b3ff5942b01fdb4cb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866844, "uuid": "c9d85d8c-c72b-4a34-8a2c-d1a3f162474a", "value": "B233E188EF57A81CC79273BBBC842F976BB7026464DED59967C2308D4287E2356102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866844, "uuid": "d5124b4a-33e1-4496-97e1-e6c5b5bad2a5", "value": "1536:wAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqi:rpoAnd9gucKCIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866844, "uuid": "52fcf922-96bf-4c03-b5f3-339b66b2b0d9", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866844, "uuid": "4da1c0ae-a791-4599-a919-142accb46485", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866844, "uuid": "29d8b152-2444-4028-82d9-25260e01c790", "value": "catalog-1135327003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7783b4c6-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870574, "uuid": "ca3eac63-ce4c-4899-b13d-5d5e158340fb", "comment": "Malware payload", "value": "ea62a54eeb18d9b02dd7966022e30c1b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870574, "uuid": "bdfcc809-a91e-4b04-a194-f56f8c09db55", "comment": "Malware payload", "value": "0d1089fd01f49d07943d7371b1151a32e2c695b856fef1a60ef83950aaa97ed5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870574, "uuid": "f8521bbe-196e-480c-b7a6-9515cedcd00b", "comment": "Malware payload", "value": "71779a66191b9b220db048ece82d43b60bba62de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870574, "uuid": "fa3379d2-05f1-4637-b3ab-3201a5cabb52", "comment": "Malware payload", "value": "8eac9098021de10b39b1d097a414a95772ddcfaa8e03fbadcf3b33381a768adbf0d9d1b57c9842adb335d8ca957cae84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870574, "uuid": "5274a339-0d16-4f6c-a42c-6b3400f2007c", "value": "7933029673FAA900C9F1C2B0A4E275C8374F3D928E7D5EDE4D8894793B92160CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870574, "uuid": "934f39a4-f6f6-44e0-9c74-7293197b0e52", "value": "768:q5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJol:q/czJJSI7r3Pwh8rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870574, "uuid": "1bd579ff-2988-4a05-b452-be294d511d61", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870574, "uuid": "9d8aafff-b780-4dfc-8984-950b76727e26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870574, "uuid": "ea1466ff-efd7-4182-b112-3877d4e7454c", "value": "diagram-2002535778.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c09c63c-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909102, "uuid": "30bdf135-7a50-49ae-b626-cb0ff8d3d937", "comment": "Malware payload", "value": "1b9e0295ef5ea8fc4c60108dcab412b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909102, "uuid": "6d5139f0-7283-4c5e-abdd-6571413e0af1", "comment": "Malware payload", "value": "0d16ba25973ec64c1787f2050145789c145bbc0c3fa4e16d057203dafec4c35d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909102, "uuid": "ea279d05-e315-4156-96f4-3e315129d735", "comment": "Malware payload", "value": "99c3181f8079f3023b80f435cc65326048b7bd52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909102, "uuid": "09ddf5e7-1b97-4e80-8d06-e7af2d53e1e6", "comment": "Malware payload", "value": "3fe37c8849bdc12c0b7abc679c40a4862d63a1a2b06ddc5554b2d014fb57bbeee5e1dd1a00d6da0e025f58e9effaae6c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909102, "uuid": "1a17eece-8081-494b-ba94-133cf2098aa4", "value": "5C33019FA008EAA3C19B93015FF2CA9303FD795DD1709658C369C6FAE5836C5C13A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909102, "uuid": "15756fbf-281e-44bc-afa7-f23b6d2535e0", "value": "768:Cqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0BCu/jE:TxTuDqsF1Cnc3P57oj2+nC6uxkL0BCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909102, "uuid": "2ae9e583-fd7f-4097-a1fa-0e818175c725", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909102, "uuid": "527665bf-6912-4b9b-aa16-c1e82d716268", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909102, "uuid": "e4cf451c-97a9-4295-ade2-dbb31051cd4f", "value": "catalog-1130873518.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186e2a7b-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912075, "uuid": "427ac9dc-eae1-4ea8-927e-fa1dd07951bc", "comment": "Malware payload", "value": "63ab547e6b9ccdffa04e2b4a8bef3ecc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912075, "uuid": "40c0aafd-4342-4e1a-9ec7-58543b6fa2ae", "comment": "Malware payload", "value": "0d3490d1b74a9189d005a8a39089a79af2cb89868659aef78e769f18abff443d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912075, "uuid": "4c77d443-1dd8-42f1-9a5f-6aead24e4734", "comment": "Malware payload", "value": "7d496744efdaa3737a574b5ba728f7883c2b5fd7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912075, "uuid": "35321381-d900-4820-810a-e6740e8bbef8", "comment": "Malware payload", "value": "9d031c4de6de05719af70c3f028454010540fc7461c5c792698db2ee7e14073e830bb73a02e76c4cb6cb6711e3ca698f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912075, "uuid": "05ef4a9a-271f-4a9a-aa32-5236c72ca042", "value": "F233F2D133D3913AC08609F6F82B5DEA26B78ED9D520D0D06E5FD91112E227AAD9270F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912075, "uuid": "03d2ab3c-a634-4167-b3a8-ba135e4c1d5f", "value": "1536:WEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwCN:DnBrX5Eg5Enjq3axWIfkNwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912075, "uuid": "b7091851-659f-4611-9f8c-245d11c61995", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912075, "uuid": "e9ebe10d-de73-461c-a4fb-5db7129de43b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912075, "uuid": "96e81f5a-647b-4aaf-b80e-f603fea06ade", "value": "diagram-1303946331.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55ab572-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866866, "uuid": "ee309153-f040-45c8-9554-ff108e13e2fc", "comment": "Malware payload", "value": "e7b16a5bf5d1351373e06bdea9dd31d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866866, "uuid": "7346a07a-6447-4d22-84c5-b5ce135042ea", "comment": "Malware payload", "value": "0d3e6ec5c5384ab7c963acc27742008fe6fb510c31592980512a82dc8d9bc15b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866866, "uuid": "8b958f3c-aa62-4168-87ad-eeafd171c51a", "comment": "Malware payload", "value": "a3081b184abca9d59b387e2014da41dc19b40287", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866866, "uuid": "3b0d19ec-8825-4830-b85b-b844c7e5951b", "comment": "Malware payload", "value": "bed2c137e49cf968cf59763b7edc01c3db6e4bbc6da1862331b15a49d8dc7b9505b687d0c848eb6798605a0235ee615b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866866, "uuid": "df8422ce-95e1-4020-aa27-e44d06d4ffdf", "value": "4A33E1849F9AF418C7C377BABC882F976FBB116458CEE49466C7318D0397E22561026E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866866, "uuid": "e1288f2c-3989-4189-9c18-c7d75f738976", "value": "1536:yAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHijk8qYUn:BpoAnd9gucKCg8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866866, "uuid": "31f6d58f-f9d0-4920-b87a-105cb0cc0c9c", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866866, "uuid": "7fd58734-783f-49d0-b22f-0996e12ae468", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866866, "uuid": "96d70672-1f0b-4e89-90cf-a203a5ad58fa", "value": "catalog-1149749601.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82ac8a5-b38b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869904, "uuid": "0e415923-ebd2-4f48-a309-24eb501e90c7", "comment": "Malware payload", "value": "e9668729f6f17101ea5d46cda6c82472", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869904, "uuid": "9740d7bc-b8aa-44ca-b475-90c6641307f6", "comment": "Malware payload", "value": "0d4236353ed09e06b436b8af72b3ec9e0ad32db1730f01f5750dd025c0523d36", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869904, "uuid": "eea37128-2450-418e-bce3-a330e1df56be", "comment": "Malware payload", "value": "820ddb52108eb5d6570d25f911f9950c67892a23", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869904, "uuid": "4ee3e438-9b7a-46d9-8870-bdffb2182e5e", "comment": "Malware payload", "value": "b4db32c792a0a3a5d84f2abf992e6a84c648eb954b67cd4af414120e6218ca995d2b975709d9049b5d66e73151425cb5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869904, "uuid": "81f7a501-d6e7-45bd-9fa9-cc88be05c343", "value": "6033029673FAA910C5F1C2F0A4E27588374F3D928E7D5DEE4D88A4793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869904, "uuid": "c8b150f9-4a24-4b02-b35c-de5b5507f073", "value": "768:N5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoK:N/czJJSI7r3Pwh8rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869904, "uuid": "a42d8b29-39b6-460e-a888-b494dc9fc929", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869904, "uuid": "12e4f382-e7e6-4701-8865-f11d98c81d76", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869904, "uuid": "8c931a83-a4db-40c3-8f38-691ba0116eb5", "value": "diagram-1513602555.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaefe5d-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871604, "uuid": "4e1abef7-076e-49ae-9cfb-7f645ca73019", "comment": "Malware payload", "value": "aa89a7b7b5a94fdb6852c1c62520b3f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871604, "uuid": "557e0384-4011-4f01-8d6d-dc19a0caa6c3", "comment": "Malware payload", "value": "0d45d77cebe00cc0462c092ba7a76f71cfffe08fbf361b989ebee385b515cc3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871604, "uuid": "1ef89561-1034-48fe-9f52-35cc4d7bb514", "comment": "Malware payload", "value": "c06d87d72946a06748320ca7a28736f7aaad9d98", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871604, "uuid": "b67252a0-b1eb-4f96-a990-dc6b2e628f1b", "comment": "Malware payload", "value": "616d67473a0969ff416b572d9e53657fbd88b4f1a0eee06b74f230e15ef0d4fc719b65519f255178e5e69d401cc7949d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871604, "uuid": "f8bc6343-9b26-445e-bc76-0c02134bdf31", "value": "6B33029673FAA910C9F1C2B0A4E27588374F3D918E7D5DDE4D8890793F920A5CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871604, "uuid": "f893e3af-68dd-4476-b5e6-8f8cffc30623", "value": "768:c5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcW:c/czJJSI7r3Pwh8fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871604, "uuid": "cef7fc2b-b76e-4583-b924-a1ee9c181416", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871604, "uuid": "f9e26918-246c-402f-8789-44f36afa075d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871604, "uuid": "1a235ad2-b0f7-4fad-b7b6-ee29100a1e27", "value": "diagram-823877780.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7463fb0d-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870998, "uuid": "e3df93c5-8e34-4343-93f8-d0969f3f4d38", "comment": "Malware payload", "value": "6759d1b19a5d13290d7d3ab9f05d0c19", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870998, "uuid": "927a85dc-891d-404a-a72d-df736969d366", "comment": "Malware payload", "value": "0d51f192b0e6ef0d1a5299d42b74f910dd5fdef6d6931a9b7b14949282ce920e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870998, "uuid": "5ce42a98-43df-4671-92c8-b3ae8463e085", "comment": "Malware payload", "value": "bb6cd867a955ab8bdc6a1c85ebb73293f3734b96", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870998, "uuid": "cccac490-6f06-4712-b531-77c0e76afb43", "comment": "Malware payload", "value": "f4d4d3b4fb084b350775e6ca33657491df3dd7cc92d38f1ad5556f151c9521a635811781395d1da70ef4ed335a3c0a7f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870998, "uuid": "a75e08bf-fc7e-4e74-a35c-308a9793a468", "value": "B033029673FAA900C9F1C2F0A4E27589370F3D928D7D5DDE4C88A0793B920A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870998, "uuid": "e65c8777-2602-4d9d-872c-2731ad85d0e7", "value": "768:v5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwF:v/czJJSI7r3Pwh8TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870998, "uuid": "017833fc-4eb2-4284-9da9-f77695dd7141", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870998, "uuid": "9a048671-3420-4f78-8d17-11d830eeea01", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870998, "uuid": "1178e7f8-65b6-4c50-b3a2-071a28885cab", "value": "diagram-356808644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85872c94-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916124, "uuid": "907ea8ba-d7f2-4c41-a47b-ad09ef115bed", "comment": "Malware payload", "value": "971c1a390f185ee64431cacb2cd2fa3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916124, "uuid": "5dc091da-4a5a-41ee-9585-5a4fe1c0fc9b", "comment": "Malware payload", "value": "0d5238a3a9a35b40fcca746a3e880776d3c604b8707ea946659cb4e7474ba74c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916124, "uuid": "f8a0f86c-56ed-4696-8696-21ea0c61db61", "comment": "Malware payload", "value": "9508f3fe9257d7fe7f2713bebb22178b2ff31eff", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916124, "uuid": "1a855ac7-64b3-453d-b77c-3876f08febd4", "comment": "Malware payload", "value": "f32c5839123ed59139561172119fe757614e345ecb699840787575458978b67af4b713b8456b165c04de9652a8629e32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916124, "uuid": "f1df1d33-1474-476b-96ee-9626c8ab881c", "value": "B73302D69B23E9C28AFADB670C5612E4936FD89C31147C59092A299384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916124, "uuid": "061960a8-2375-4a4a-ae94-416faa7f122b", "value": "768:Fo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ScjA6Fp+:feKCVQbp4LTaI7ZaiNQMIX4Fi3cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916124, "uuid": "d08eb562-d019-439a-95d5-24ec0bc6af44", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916124, "uuid": "496bb54a-ba84-457e-b837-21605749b4b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916124, "uuid": "3a7823a3-4fb6-4759-b0c0-43ce769847e7", "value": "statistic-396499622.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefbaab4-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869002, "uuid": "73068bae-0c9e-4d91-a7f7-7caa81857a61", "comment": "Malware payload", "value": "fd06cb875029abc8a3b69e1052aa9924", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869002, "uuid": "7c735560-fab8-4338-abd0-0ac4fbcc9e41", "comment": "Malware payload", "value": "0d582ddd197bf1f47c7e5736ac3b4c97ef8f1b9fc55108ed9a7a14fec89549bc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869002, "uuid": "e89aa995-5930-4bd6-b418-f4f6a66a7ac3", "comment": "Malware payload", "value": "f12f9ccd9ccb3358d9f2f30d7fbb8ebae49f4f12", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869002, "uuid": "bffde484-feba-4652-99ef-b39841efe592", "comment": "Malware payload", "value": "1d4865dd9efc7e42c834e97ae3c42ca92eedd9a361f0007921917e1f547f14d0a8d00c907aecf44963a9bf533855d7d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869002, "uuid": "5869657b-7245-4531-a9a3-f8b1395ab42f", "value": "8E33F1C8EF5BF418CB8273BBBC482F977FB70264648DE1955BC2319C0296E27161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869002, "uuid": "77005c3b-a76e-4c9e-8d25-ea8152b3a1f1", "value": "1536:/AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiAM2Z:YpoAnd9gucKCAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869002, "uuid": "4af8e0a6-bf6b-475c-9a3e-7f07fbfc84e6", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869002, "uuid": "bfcb4d9e-89ae-454a-b347-3ed6a51d56cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869002, "uuid": "7637fab4-67eb-4724-8dc9-f66b018d91d6", "value": "catalog-873230537.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d5fcdc-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911407, "uuid": "0e5d8e5e-ae36-4a8a-8387-51c6fcb838a9", "comment": "Malware payload", "value": "e7d0a672c08465a1bab64da7e3b69f9c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911407, "uuid": "213ba266-4ed8-40be-a597-38cc363a955c", "comment": "Malware payload", "value": "0d60c0eef4257136c4010f8c539a98b7487a35a721bf7604bc10b7132ba8edd8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911407, "uuid": "9a5a2a46-ba66-4adc-be4f-95f161a5b3b2", "comment": "Malware payload", "value": "d4e6a426bd3d1c0ec52c1790d372fa718d569861", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911407, "uuid": "c3e77477-c395-4269-aac3-1ee88bbbd31a", "comment": "Malware payload", "value": "47ad12383d4d774cef94cb9605b286662258586d45283d6a98c3d99ae1d3edeb2ae4dcbcf14929c7f055749907b74a89", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911407, "uuid": "6de3d49d-f6e2-461b-aed3-cc0f6ef4d708", "value": "A433029FA054FAA3C29F56011FA6976106FC7A1DE230D158935AC7F1E9C35C2C03A8E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911407, "uuid": "09eeaf95-3a69-4edc-beb0-d306ab86a2bc", "value": "768:iqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNMLT:zxTuDqsF1Cnc3P57oj2+nC6uxkLTNMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911407, "uuid": "d7faf79e-aaad-4d71-b791-63f2c04983fb", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911407, "uuid": "13d704ac-e4ce-4d91-b656-07dace92b836", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911407, "uuid": "66913bea-36be-4dfb-8e28-4724c2d8b10d", "value": "catalog-805571980.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5057dd16-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912169, "uuid": "5e04c657-36e4-4b25-b858-eff42e5caba5", "comment": "Malware payload", "value": "0685049cdbb1a7e94437134d799ae391", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912169, "uuid": "6279b533-f628-4c8c-a5b0-514295631960", "comment": "Malware payload", "value": "0d70689ad0f4c64a0a8ef2036a9952ce3b0da7da3e30c5be63298d06b6b8f2ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912169, "uuid": "1ff1c1d7-f500-4d6c-8324-a0c2740f9370", "comment": "Malware payload", "value": "83bac0c70399ae2537aa2f94fa1d56a7b3fa0f77", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912169, "uuid": "f967ffec-cbf8-4f7d-9233-85efefa48b5d", "comment": "Malware payload", "value": "3e5fa2626972b5175b6d6b92e18e0e2c527e53b6c44e07a665cd5f6c2df32b71d313069144609e88d05b97f2ea129db6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912169, "uuid": "46bcd40c-4bfc-4d9c-9fb8-8cfa34ff2a4f", "value": "6033F1D232D7E23B80C105F6F92B59D616B78AC9E83090D16EDFCA1213E31766DA170E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912169, "uuid": "cbc3a41a-3aa8-4069-ab5a-697d7475e056", "value": "1536:TEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnXr:4nBrX5Eg5Enjq3axWIfkNwn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912169, "uuid": "1a8a63f7-2660-4697-a366-c23fcef2b95e", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912169, "uuid": "c763a0a6-8ea3-4c5d-aaf9-829e59b9f8bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912169, "uuid": "6df5fc9f-ec62-4499-be4b-8e3a720b8372", "value": "diagram-1426700539.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7d2f8a-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870392, "uuid": "21318ce2-aaba-4527-867d-9522f51f4ead", "comment": "Malware payload", "value": "5f0aadd1494da32fd2e963e6d71ab406", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870392, "uuid": "d746e0d8-503a-449d-ab79-dc3dbd83f1dd", "comment": "Malware payload", "value": "0d757f4f384b9703435a418038d652d271350c2a9de94e70ed3ffeb621971b09", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870392, "uuid": "630d6541-725f-4bc9-9c7d-d641ef50c928", "comment": "Malware payload", "value": "8467432d57686120bb9382913d6d5e51a50504e4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870392, "uuid": "9a25ca14-bef1-4512-ad15-6bc132ac2e05", "comment": "Malware payload", "value": "2a124c692b7233dd57fb966df1324f8788629c089222c3b044582b8f36e58c639dd5a2117f6b9f63cb029597912fc4be", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870392, "uuid": "b821a25a-cdb0-4e73-8415-bf7f7dbd5176", "value": "2333F1A137F9B900C6F2C1F060E27699274B3D518DBD5DEA0C94A5B93F931A4CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870392, "uuid": "bd05b5fd-d697-48e6-9ec6-faae2747ada7", "value": "768:e5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJ8E:e/czJJSI7r3Pwh8RGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870392, "uuid": "4c76c58e-79ea-40f6-bc9e-6edd810f91d2", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870392, "uuid": "a76c5916-dc06-458f-8812-9caaf072d70c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870392, "uuid": "0c0537ff-fd62-4127-b988-410169a7ad7a", "value": "diagram-1873398780.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75ea701-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867674, "uuid": "2742910c-64c0-4a3c-833c-d8c4e4dd1efc", "comment": "Malware payload", "value": "7851ebd8c2cc05d8939f6981d8519eaf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867674, "uuid": "4109f222-f11a-4ef1-90b7-c70efa370a62", "comment": "Malware payload", "value": "0d85711761959cf522a80c32b8d444d259111268c65ec65e4d877ce7ea6b8353", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867674, "uuid": "2bfd0832-a835-4016-9ef1-37afcf0dc134", "comment": "Malware payload", "value": "85ddf69038b3f4feeb8cd548551308ca28bc768e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867674, "uuid": "b1274af0-0850-4c84-8f22-449ceac60f68", "comment": "Malware payload", "value": "ce5ef635f1c989fd63b1ed28b1d33faff81b3184a8926938778702d054f3239c112d54cdb3c8ed68ad38ba02b6d3ff7c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867674, "uuid": "d82ec69d-bdb5-4508-9530-056698bfbe87", "value": "0D33E184EF57E428C7C273ABBC842FA77FBB0264148DE1951BC2319C4297E67561426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867674, "uuid": "9514c310-cb50-4e99-9db3-46a2c9e51a6f", "value": "1536:tAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVZ3:KpoAnd9gucKCoGVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867674, "uuid": "f2c93396-f368-477b-94bc-1a3be3c68eee", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867674, "uuid": "573a17fc-f2b1-4e94-85cb-3d485dcda1e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867674, "uuid": "0f97d24c-e5d8-4b01-aa48-45e3883c890a", "value": "catalog-1786139559.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850cf8ff-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872314, "uuid": "568b2b0f-a0e3-453b-8a24-637c86848fdf", "comment": "Malware payload", "value": "51a07df297cfaff3236e21b081a4df82", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872314, "uuid": "68fb4d50-f8c5-4777-828d-786680591c4c", "comment": "Malware payload", "value": "0d88353224540a41615e23744e7e5d05c2ca245223de71c1d855781375e514c4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872314, "uuid": "74d26d84-cf4f-44e3-adc8-c351ebd1c5bb", "comment": "Malware payload", "value": "01ab37c93fafa89435752e0c8317b511f6d15f30", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872314, "uuid": "ba4e13e3-20cd-4672-9f2f-33e5f004a073", "comment": "Malware payload", "value": "dd90486a06d49ce782319db52f2f5bbbd41f97fb81aa00a3303bdd37e2c34c37fd343ebe297107d2042d1491c55ce2f5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872314, "uuid": "6098c6e8-b64e-4198-9e9c-a83754495bbb", "value": "053302F2E643F6BC794381894BDC1E6B523B4220125D4DB1C55EEEC1923972A0B51AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872314, "uuid": "cfce994f-1ca2-4095-8929-9e59fb393750", "value": "1536:En/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMq3:mXKAXh3TCdOi+KSZ4W03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872314, "uuid": "5ff90b31-74c8-43b0-ad65-07ec2150ec20", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872314, "uuid": "3d776e1c-7ad2-436d-9d48-63ec78946551", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872314, "uuid": "ca01997b-179d-40bb-ad13-607a21094cde", "value": "statistic-1377430169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd276fd-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873111, "uuid": "46f4ded2-6fcd-4476-aed2-50379d86743d", "comment": "Malware payload", "value": "e8f3aaa05d34389995e04d1238abb985", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873111, "uuid": "a41f8b37-b25b-4a1f-94d8-bfb9cad41abd", "comment": "Malware payload", "value": "0d98478670cdfc7e573bce76c04050b8a764aacf244a179a5219a505356c91ec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873111, "uuid": "1e1bb168-0030-4a0a-a41d-a37533eac819", "comment": "Malware payload", "value": "ac3d5283fe99c73d931a33779e5159c7897ce678", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873111, "uuid": "91961dd7-2d7a-4635-97a8-240b3994a181", "comment": "Malware payload", "value": "1210c24857a7e0dcb9b27cb48ad2b167e22841fe6b2e14dc95de975b57c26f7f3a954ec677dea77d836a12ce0e3f424b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873111, "uuid": "5b785fea-e57c-42c0-a10f-a6c3fb351c9e", "value": "583302F2D253B6FC7643805E4ACC6F76927742B046690EF1C15DFEE2923921E0781A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873111, "uuid": "41cf2eaa-020e-46ea-a78d-d3559fa00d47", "value": "1536:HT/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjF3:TXKAXh3TCdOi+KSZ4Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873111, "uuid": "65a75063-0fca-4675-b1a7-359a01a10722", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873111, "uuid": "48c50e75-c641-4889-adce-d693773b162b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873111, "uuid": "a68687fe-4d22-4297-8c3a-58fe584c104b", "value": "statistic-1911061943.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd0892c-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916141, "uuid": "7d65cae5-d829-45e9-af30-e0355e1016ac", "comment": "Malware payload", "value": "91c7a412e4918394c79ce6dd3575f211", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916141, "uuid": "99e8fd49-6071-4bce-a76d-6e06244a4478", "comment": "Malware payload", "value": "0d9e5649653ea318806b59cfc51b4bca3f9fcb491eecb37ce3d0d126ba93ba71", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916141, "uuid": "4872aa9b-b904-4150-9e6a-0673f892e360", "comment": "Malware payload", "value": "a09b9066d5e004d5949ab35d71c93ceb7b473773", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916141, "uuid": "11320711-eb7e-432e-871f-e1e7ff61b2d7", "comment": "Malware payload", "value": "53ed1c4b93a1eb067d306a5b351a6548c82df120e872cda6b64ef3e6635bfd6e6c2108d10a8fad46ffc953b2cc4b5d98", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916141, "uuid": "bd51edc8-c274-4599-b8bf-50a221b58d9b", "value": "CB33F1E61B26F5C2CAFEDEA3084563A4975BD88D35283C98153F258240FB558C4F37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916141, "uuid": "fd184390-0fbd-40a9-9203-9debde20f070", "value": "768:4o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/7e:MeKCVQbp4LTaI7ZaiNQMIXv7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916141, "uuid": "a9edbec2-f0fa-4a75-93bb-8b650b4b125c", "value": 51767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916141, "uuid": "b2ec5b38-1e65-4adb-98bb-1a3708d0b879", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916141, "uuid": "dcc00476-21dc-49d0-b84e-22e7fd0c942c", "value": "statistic-4065820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e34d5c-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869960, "uuid": "88dee1fd-4449-44a5-b778-63e36fd9f72d", "comment": "Malware payload", "value": "d5b7b6728982579697abfede9004b3e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869960, "uuid": "33bd2783-1a62-4643-b8bb-7a8a03299779", "comment": "Malware payload", "value": "0dabfc5bc647ed882fe351023105f922e1c9d817a2268622217e6a9e16b3cbf0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869960, "uuid": "9fdc5820-91f2-4c14-875b-25dac486095c", "comment": "Malware payload", "value": "2ea957c8330c0d87eeb414b43f80805061804bde", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869960, "uuid": "82dad999-6869-40c1-af70-cc1c6fba29c0", "comment": "Malware payload", "value": "2262d56000b2b3a5d4544c70cbc3da489c9fe7ef1276d4a9684a05acaa43e2942246f5d09f0a2c176a871e911dd91714", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869960, "uuid": "e8e91891-1d41-4ead-a563-d665471e9a3d", "value": "7F33029673FAA900C5F1C2F0A4E27588374F3D928D7D6DDE4D88A4793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869960, "uuid": "fbada185-fe31-4c94-8681-079508ed0bb9", "value": "768:M5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcy:M/czJJSI7r3Pwh8fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869960, "uuid": "a34f4dff-e7d2-4dc6-aff2-b9bd672f0613", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869960, "uuid": "0f9d2a4e-b55b-47d9-8073-f1fb5937ce9e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869960, "uuid": "a001e4f3-72e6-49b7-978d-8966c9498022", "value": "diagram-1564132915.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7b290f-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867257, "uuid": "46424068-f84d-4769-a4f6-f1d5df097839", "comment": "Malware payload", "value": "7daeadfd8d814515ac23359009222189", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867257, "uuid": "f1822be4-2fd4-46b9-ab05-14512e98c59d", "comment": "Malware payload", "value": "0dcb158e30de177eb4e7af2e08f4655c3fa4d1420bb0347922bc765433ef86e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867257, "uuid": "00f10db2-f759-48a3-aa92-bc4b8f9c8569", "comment": "Malware payload", "value": "410963244a984e0729c4437f2f46046e8ce05ebb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867257, "uuid": "b9949139-03b3-4acc-976c-68dde4c39993", "comment": "Malware payload", "value": "361efded56e4ffa0a19eb50f61597b2d3e1fd1e488d8bbfff52a3b5684825db66f7aa192db2428c7174e265651297726", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867257, "uuid": "eb668674-b977-4e1b-8b4b-63e0e32786ee", "value": "8033F1C4EF97E428C7C373AABC842FA77FBB0264148DE1D91BC2319C5196E67161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867257, "uuid": "dacb2872-61d8-43c9-a146-34689193852a", "value": "1536:KAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVjS:ZpoAnd9gucKCoGV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867257, "uuid": "b36fd0e3-744d-4028-af0c-5315636f24a1", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867257, "uuid": "55662d0f-5745-488c-b566-610fc3fcbc5c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867257, "uuid": "df61fd18-ea4f-45a8-9fa3-c13fc24b9917", "value": "catalog-1448364847.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87992c1f-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870171, "uuid": "44c56522-7fbd-4668-9429-9880a9f69509", "comment": "Malware payload", "value": "d5d7f1fc97e4d8609ba62472836501a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870171, "uuid": "e5507ca6-3c47-4af6-a35d-99768977d9ee", "comment": "Malware payload", "value": "0dd15b6ce3f9896c71b514ae038279bf87bbf28ed7d3c3d144c07fccadd9f95e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870171, "uuid": "8499491c-5acc-41c3-89f3-da674bf14b70", "comment": "Malware payload", "value": "5f6469dee7579df4754493fb8d3f483eefbb39f9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870171, "uuid": "2975bef0-e849-47a9-b352-7f4f560cf268", "comment": "Malware payload", "value": "5e9d02382e79d36d3de5363cc9d6cf466128cf6be5d0ac1894a27354aeb949bfa3a488e920b39db93107b387d4da552e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870171, "uuid": "930e9ed4-7f18-4d4f-87ae-c71d7b1de99e", "value": "A533029673FAA910C9F1C2B0A4E27188374F7D928D7D5DDE4D88A4793B921B0CEE16C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870171, "uuid": "abc2f189-3da1-4cd3-9347-9747bdb5a708", "value": "768:r5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwh:r/czJJSI7r3Pwh8Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870171, "uuid": "19b6b767-f62b-4bf5-bc23-3a563d3155c1", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870171, "uuid": "3c8cda25-361e-4552-bf0c-37ecada9ac45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870171, "uuid": "cb1d588a-80f1-4fe9-8199-8a18e94d2ede", "value": "diagram-170569820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822d45b6-b3fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620918266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918266, "uuid": "a80d9191-854e-484d-957a-446395cdb5a7", "comment": "Malware payload (Dridex)", "value": "075e072521a14862ba168df71cecd1f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918266, "uuid": "6f87d132-e6c1-4ed0-a133-d82e96df3acc", "comment": "Malware payload (Dridex)", "value": "0ddd7bd25468cfc66fa1d70693dddddadd179cee6632654d82738098dc588f10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918266, "uuid": "71dae904-7db6-45cd-9934-1330e9ea80a4", "comment": "Malware payload (Dridex)", "value": "be802f1d61559c0c518443c1ecc357a7b4921eda", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620918266, "uuid": "6ee937eb-77cc-4633-97f1-aff70380eb4a", "comment": "Malware payload (Dridex)", "value": "d5403dbabd73e38fc06115fce303a46ad4eec5e65b08dc08202d92e2de072b2abcca199ce1c4dc6d8727078fcbf42c58", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918266, "uuid": "bbc9a1a1-9fe2-4dfd-822e-6c0e32451a0b", "value": "B6F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918266, "uuid": "bb5f878e-504a-480c-bbf6-ae133bfe598b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918266, "uuid": "d6ec05be-d067-476c-bc25-5726fa3fd04f", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620918266, "uuid": "37de71d3-2508-43a6-b0c1-9c58db3fe955", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620918266, "uuid": "908cd9b5-008e-40da-800c-1787ca47e99d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620918266, "uuid": "921ec6d8-f885-483d-b3cd-1715ee6c0624", "value": "075e0725_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c33951-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871730, "uuid": "fa87449f-720c-4ae1-8e7f-fc432b4818ac", "comment": "Malware payload (Dridex)", "value": "4ebc60e049d6806614ca6319d44bedb1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871730, "uuid": "92eb3187-03af-424b-b5e1-09ed6c0b2e04", "comment": "Malware payload (Dridex)", "value": "0de47f71596f49f82bf1401e42ccde6fabfffc0f2d26978e54b827b41d0afa04", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871730, "uuid": "1240345d-bbb8-47da-82e3-91cb447f8a26", "comment": "Malware payload (Dridex)", "value": "69930263df9782fe856c36cce0062e812811d898", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871730, "uuid": "31e470e7-c17a-4628-b41c-2f3001190582", "comment": "Malware payload (Dridex)", "value": "58ffdaf64d66ed02ff263ed3e43243fd3827ff31d48327f115fbc54db9d071e83265cdf131a2ce02de438614fd121a4c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871730, "uuid": "0f82c45c-c8c9-4607-89e0-210a9ccb6b90", "value": "6BF3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871730, "uuid": "9dac3116-98ea-4ff8-8f26-e8285dd5ed00", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871730, "uuid": "b0fa9f31-8a79-4d59-bd0d-e5f7d6a16c12", "value": "3072:0ar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Gs4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871730, "uuid": "5f8a0552-d64d-43f9-920a-6661b21ad7b6", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871730, "uuid": "509997d7-0640-4105-9440-ae001eeee06d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871730, "uuid": "5596fd35-f2ba-4df7-b00c-aa6a58d736e1", "value": "4ebc60e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32942cd4-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913837, "uuid": "6da185b7-cac0-4395-8275-7b9d230f8136", "comment": "Malware payload", "value": "6b2bc97590b4d37648290ecba7fa3bcd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913837, "uuid": "54969a8f-3087-4819-b734-baeecb361d9f", "comment": "Malware payload", "value": "0df31fa5b5524b6b1f985a2db41ab980a522ff357a702bfd28328ea7562129e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913837, "uuid": "5747426e-6d3f-41e8-ba34-d46c20387abd", "comment": "Malware payload", "value": "67c99ffe7ee7951ad6c3040df806ae3cb7d18ff9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913837, "uuid": "4a546dd1-31b1-4652-a001-4f18fdc3a25a", "comment": "Malware payload", "value": "78a483abfae828a775391a717ae580f71aae9db63286e75db613bf59e4c286699c436ae98739044a150e5c7ee161f53b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913837, "uuid": "2dda9dc6-4d4c-44d3-9bf2-fbeebb0c7025", "value": "4733F1E132E7913AC0C549F5F92769DAA6678ECCE530E0D06D8EDE0122E3165AE9160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913837, "uuid": "cf3369f7-61bb-4754-ab18-40831169c8b4", "value": "1536:aEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwsnyy:PnBrX5Eg5Enjq3axWIfkNwsyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913837, "uuid": "6965dd59-eb9f-4fbd-9c39-f09b23eca521", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913837, "uuid": "2d5888dd-fc68-4788-be7a-57c083e23e6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913837, "uuid": "c39eb6fc-edab-44ff-8655-f896cada6267", "value": "diagram-583778024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9c708b-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871466, "uuid": "a0c58bb7-b4ee-4647-8bf7-ef752c900fc3", "comment": "Malware payload", "value": "4761e29d78768be3e5bd012668ee90d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871466, "uuid": "9682586c-b6c7-4308-a989-c55c0d43f59e", "comment": "Malware payload", "value": "0e010152c2219d283097f16d1448c1ed092bcd346161ea1e3dc58cc8b86d1c01", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871466, "uuid": "67b73291-4102-42c9-8c4c-2843fc5b5b2c", "comment": "Malware payload", "value": "3a4f141bb2c540f544ca5990b43d4694a5e3d175", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871466, "uuid": "56ad0bd8-1b4e-48ab-a55f-ae310f72424a", "comment": "Malware payload", "value": "9635ff23a52e25b64d0fa6e21c395cf4a81a3aa24a0a84d0b61c5e737fdea037502717a88c8c2a7039158f53a8d65792", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871466, "uuid": "3df10c49-95d8-4fb2-bd28-cadb81ed448d", "value": "FC33F19533FED910E6B2C2B090D275863B4A3D91493D9DEA0CD4A5B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871466, "uuid": "4ba0ca23-df86-43c7-a453-b48c9b681289", "value": "768:L5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccI54:L/czJJSI7r3Pwh8v4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871466, "uuid": "ded37da7-eb96-4d02-a7d9-4d90b091a1ff", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871466, "uuid": "4781aa11-0e6f-4276-93b9-5ddca6a8531b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871466, "uuid": "56afddb8-d9da-4634-8e8b-1dce079b7830", "value": "diagram-692779940.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cab899-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911396, "uuid": "a20170ad-aa43-493b-8676-93efddd17ea5", "comment": "Malware payload", "value": "75b31b782a82f16f6bb1d785f0011444", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911396, "uuid": "4fab1a38-f555-429c-be2e-a473801297a2", "comment": "Malware payload", "value": "0e03c68f1f614ef048b2e0d4c2318f2f103ff66171c3c83acf7d89aa1cdaa3b5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911396, "uuid": "93f8faa8-6e95-4492-92f3-5e8ed41109da", "comment": "Malware payload", "value": "aa651934417c02968bde9a7152a3cb76d0f30c60", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911396, "uuid": "fd656503-536e-4200-803f-b516bc2c168d", "comment": "Malware payload", "value": "a823c5be7f67d9b011ce6a37199044a8ad2d8ebce6d1064c50cd713c2c6be1838881ed92eedbb6ba0c65a6464ad6efc5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911396, "uuid": "ad81e216-6576-4492-a503-3b1fb11dbcd0", "value": "F733029FA454F9A3C19F96011FA6D76216FC7A1DE2309158C35AC7F1E9C36C2C02A8E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911396, "uuid": "999c8467-30cf-4680-ab84-d9e8893963a9", "value": "768:Jqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNBLQYt:UxTuDqsF1Cnc3P57oj2+nC6uxkLTNBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911396, "uuid": "f94cf402-4883-4a0f-bf6c-bdb515820e20", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911396, "uuid": "436fd505-026a-48e1-88ab-1ca4d5fdde4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911396, "uuid": "f0542bbc-dc91-4a19-8f11-9b5c8fabcf8b", "value": "catalog-800380698.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d43522-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868715, "uuid": "8439b52c-1f72-4664-b856-bedb9d881738", "comment": "Malware payload", "value": "3242b3cae75870b617f25760e5b4b40f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868715, "uuid": "8304325f-6f15-413a-88b1-4cf1eb88036b", "comment": "Malware payload", "value": "0e208cb76159c49958cf314bf6abbdabbf3da519a09b881e2e16fe4784c76241", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868715, "uuid": "6e0fbc48-71d0-4222-8cd0-8ca74ae010ae", "comment": "Malware payload", "value": "241224d61beaf54a0cca160f9c2bad56a718aa19", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868715, "uuid": "154cf15b-bd47-4bcb-b6bd-a3d625a0855b", "comment": "Malware payload", "value": "300cfe7feaa11e232dde882f480944e4d26158e06224f45aecf47ddc46d15e96c32c526ba2d39213033fd253b5694fa4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868715, "uuid": "22c8c977-1098-413a-bb6a-9f0444ab39b0", "value": "D533F1C8AF57F418CB8373BBAC882F976EBB0354649DE0955AC7319C0292D37561036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868715, "uuid": "fdd34fa0-f29f-4fb5-bf95-d574a2ff40ba", "value": "1536:PAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHidDW:IpoAnd9gucKCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868715, "uuid": "7278d40e-0131-4293-b694-773c64bca9d6", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868715, "uuid": "289caab5-1bc5-4431-8b5c-16d259618e82", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868715, "uuid": "37aea07a-9a22-4d07-946b-3e4798afaa69", "value": "catalog-617488607.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe92b30-b40e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620925993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620925993, "uuid": "d3be2f55-250d-4173-994e-5dac7c1a0fe4", "comment": "Malware payload", "value": "cd0b803f6c450e7e943f95274f6ec38b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620925993, "uuid": "0a047e62-d63d-4ce7-8b0f-3c80d6c1c446", "comment": "Malware payload", "value": "0e21464e4754d90033485e903861622eb9909f27ff415b5f7821ae050e9d3158", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620925993, "uuid": "e0bc6089-a998-4b9f-af35-71e611523fc5", "comment": "Malware payload", "value": "620cdd3e7f7b147121d202b3565d7c91a20c5e6b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620925993, "uuid": "3fb84fb4-1735-45cd-8b18-af82aeccbdb2", "comment": "Malware payload", "value": "7c17bc5c434ff77bdfd51afc3b88d6751646e3ca4358b7b2a9ce4e5e06176969262c657f00b49d7e9d952ccd33193a24", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620925993, "uuid": "498d2b68-34e1-4907-b0d4-6289c64e17fa", "value": "34A5AEB875047DD6E66F566BCA96BDEC03B636239ACBA4CC8064B7C30563375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620925993, "uuid": "183c8aee-4de7-4b70-8a0e-8c198300d0d9", "value": "24576:tksUBorAxfBVyjI/MIYBlv1zTvFvJ18LLNUHQjpuDENJSkaqTFNsxpeY7pZKiets:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620925993, "uuid": "1128ff96-cab3-4ab5-affa-e3f31d5365ab", "value": 2070134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620925993, "uuid": "3fbfc5d5-ecf4-4c4f-901a-85c3158bf5c9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620925993, "uuid": "7672618d-03cd-4edb-9b11-33c84e25cf8e", "value": "Oug-PO-130521-scancopy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fda18fc-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911282, "uuid": "efefcb80-ecb3-489f-b643-bb37c26d95bc", "comment": "Malware payload", "value": "2ad475438cb1702d05b48057472a0090", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911282, "uuid": "08a1d4e5-6819-49e5-b707-3ecbb4585e06", "comment": "Malware payload", "value": "0e22c4440b38f6549f2b6807b95053677238c748c2d37ceb3745c920f51f3fc9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911282, "uuid": "e7994f3b-e758-4054-a083-3721929dd215", "comment": "Malware payload", "value": "d9eafe136e81389bb860a80529e3483682379414", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911282, "uuid": "5a95bb5b-0c68-440e-ab5a-c4fea9e57156", "comment": "Malware payload", "value": "c2802a2ef24fc9833068a1727c47eca1de5d94cc4e97be446e82c26db9579b847ca0043575d005d775f708773c89b81a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911282, "uuid": "8e439393-faab-40e1-94a5-02b3878e6c59", "value": "DB3302DFA014F6A3C19B67015FAAD7A206FC761DE270D158C35AC6F5E5C36C2C12A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911282, "uuid": "1d895c17-7f0d-4151-95fa-5d8a46493893", "value": "768:aqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7qLw:bxTuDqsF1Cnc3P57oj2+nC6uxkL7q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911282, "uuid": "971bcba8-34eb-4b0d-b3f7-e2e95b50b7e8", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911282, "uuid": "d3be473e-1326-4b8e-a8b0-e973536a779b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911282, "uuid": "c3d1ffb5-ad44-4b45-b262-05fe10dfa9fb", "value": "catalog-712020429.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33aa9d11-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872178, "uuid": "79430f2c-2787-4d88-8fcf-5e368bcd827d", "comment": "Malware payload", "value": "094d3098896d845946cbf8b869b37f5c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872178, "uuid": "8615d482-fbba-4cfc-8e09-2d5f561759a9", "comment": "Malware payload", "value": "0e28c50b916c2dd197652fa4cd92d547a436ae6b6ba7f7cc3f619bce9cef150e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872178, "uuid": "1e70ed52-3cec-4538-8522-fd2a75e0be28", "comment": "Malware payload", "value": "f55f775dd0f0c35599a93cc26636fe986b37bdf2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872178, "uuid": "12a690ae-eb2a-41e4-ab29-68f9cc6e876a", "comment": "Malware payload", "value": "b7f479d751bf8f6b6f35df5a1e0b25687caac75c3337781f751cd5b52c51817db3f2964006bae7073bf32a38b1ed702d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872178, "uuid": "ea57ab10-465e-41a7-b00b-5dcc3208487e", "value": "6B3312F3D602B2ACB64381494E8C5F57923B817067685EF18219EFA1D33D7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872178, "uuid": "c6b0914e-883a-41df-86f4-2d1e049d34e6", "value": "1536:7W/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeeAc:KXKAXh3TCdOi+KSZ4W7Ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872178, "uuid": "0d89cbf6-5d91-4c2f-b9da-5f946e02bf97", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872178, "uuid": "a6cf7cbc-e711-4e58-a01f-f06eb6db2594", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872178, "uuid": "d70ac806-44ac-47f2-8250-3e15e50ced88", "value": "statistic-1274903338.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93015ba-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868966, "uuid": "cd0ce464-3c89-4427-8475-92e7ea41afdb", "comment": "Malware payload", "value": "31a8c9c0c158117ba41764729cc13b40", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868966, "uuid": "68548bd4-fddd-46c5-a39c-f824ce4c3f68", "comment": "Malware payload", "value": "0e2f0c6336070c04265015f2d88689444e3567ad6d2f070803faf6633618ad2f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868966, "uuid": "79ce1cb3-6437-40a1-a1fd-fdb09ed6de18", "comment": "Malware payload", "value": "2e22d0218653595c7a4550b23b79bcc905def10f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868966, "uuid": "9ead6b7f-1654-4c8f-aa46-9c05711b9754", "comment": "Malware payload", "value": "8e1a492aa7a1268ab7db349f56b3ca7b5ae09cffae1dde4238e8ded1400cad0627701719417a6a83732693e6583a5ca4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868966, "uuid": "cbc77cb4-6219-4b11-9325-2090e1d8b95a", "value": "EC33E1889F5BF458CB83737BBC442FD79FB7026459DDD29867C3309D01C2E6616142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868966, "uuid": "4af3d6f7-cae1-4574-a13b-872364963704", "value": "1536:HAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSm:gpoAnd9gucKCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868966, "uuid": "3c34331c-f07b-44e1-9ee0-15b26da7002c", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868966, "uuid": "1fc73c99-ee2b-46d8-b438-c612c1c27fe6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868966, "uuid": "53a909fc-ac35-499c-a6d2-7d9a4795d254", "value": "catalog-850277556.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ba0d73-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915242, "uuid": "0b04f69e-7ab9-4966-8d91-0d71d2f48839", "comment": "Malware payload", "value": "9ccd87179be5d5823e7c374fa6b6e245", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915242, "uuid": "42fa795e-befa-4e1c-b5f0-77aa6072f66c", "comment": "Malware payload", "value": "0e31e17d498d550792be55600e19a6ce8e0bb0619383a6949c2de51ba6e4ec3a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915242, "uuid": "789fa236-f612-428b-8730-5d287793d214", "comment": "Malware payload", "value": "6264fb2b9265b40549b48f4ca413d1010b83911d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915242, "uuid": "9e3f2193-acb1-4b82-8d14-c2a1d381df13", "comment": "Malware payload", "value": "4436ad54c7ea437b669b2cc7b52ce5624f96c8cec68abe26b1b0aff0478f917a43c3bfbd5c956a68fa13829e035315fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915242, "uuid": "eb7b4bf4-c079-41c8-9f21-9b54290c512b", "value": "4F33F2C26612F5C78AFADE63148523E9635F98CD32283C695D3E758281FB158C4E27CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915242, "uuid": "bc239b8c-3e52-4bfe-9339-cab4f44302bd", "value": "768:Ho4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkPq2:9eKCVQbp4LTaI7ZaiNQMIXUC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915242, "uuid": "10c1d433-610b-4c8a-9ff0-cc8f73d8b3d3", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915242, "uuid": "c9abf86e-f488-4c0d-b881-6afc61d509f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915242, "uuid": "16fe0016-70d7-44d3-93b7-59fe3e9a716c", "value": "statistic-1636169741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35346d5d-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911694, "uuid": "037449cb-18ba-47f0-92b0-dd6ad447e04b", "comment": "Malware payload", "value": "7bb28cdc7648f19e5e715d6d160eae0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911694, "uuid": "22bb5739-a1db-4baa-a43d-e99c872c4071", "comment": "Malware payload", "value": "0e336c50f100da6366f9e67ad2a74d63a5eb96b138d434f16e68d1126e36d364", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911694, "uuid": "f56e47b8-2ccc-434b-91aa-f41105c35e42", "comment": "Malware payload", "value": "f630cc2df1437aea32537b45199fa2697568d6be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911694, "uuid": "6d5873fc-ca80-49c5-ad97-2a4aa973ef9d", "comment": "Malware payload", "value": "70bc72e9289bc5e486cb5a79dcb39ce815425b8f8d09ccd12007a9480fc502b3313e66b55a038560855f5e8f5d6955d3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911694, "uuid": "bac3874f-9ed3-4bfe-9623-87f8b463d124", "value": "0D33F1D233D3D63AC0C205F1F5275ADA69A78E89F920D4D02D5EDD4022E31B9ADE174E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911694, "uuid": "5b9a2f4f-21ab-4938-8c62-660845420818", "value": "1536:OEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwbciM9L:rnBrX5Eg5Enjq3axWIfkNw8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911694, "uuid": "7edaed6b-a1ab-4f52-bdb0-6323d18e11a4", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911694, "uuid": "8c0768df-640d-474e-bfdc-6f8ac5dbae94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911694, "uuid": "ef87ce87-8ab0-4540-a7d5-493d471bf466", "value": "diagram-1010145213.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c78400-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869440, "uuid": "97eeafa1-53f7-4ffa-baa5-5272739ee30e", "comment": "Malware payload", "value": "b4efef10c7cf7f76818e8d819e5a6953", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869440, "uuid": "17854452-8d2a-4f81-bbcc-13de9473f726", "comment": "Malware payload", "value": "0e34fca6181e08e68bc7d98b4eadb8fc45f588ea1bdc1714f8a17b13f2691326", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869440, "uuid": "7740f970-434f-4b13-8f97-5f23eca7f881", "comment": "Malware payload", "value": "620570d35f0780981f43f3efb6119bc9ce805afa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869440, "uuid": "21df4d78-b88e-4b78-9332-aeee30380a27", "comment": "Malware payload", "value": "f1f3e34fb055524a74e3ea71366572a438e01f5790cd43e134095351b4ea4e8a834f2ebb8fdd418e789c19d750bd6350", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869440, "uuid": "dcc9cb8b-d9a6-4fde-ba13-4f3c9521e91b", "value": "BD33029673FAA900C5F1C2B0A4E27189374F3D928E7D5DDE4D8894793B920B1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869440, "uuid": "fa05aa56-909f-4da4-95b1-91a77f3e92fe", "value": "768:q5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJo5:q/czJJSI7r3Pwh8r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869440, "uuid": "67630208-8d8d-4c77-891a-e9ca329a5635", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869440, "uuid": "8c88821b-8959-4bb9-8dd4-348c92a170d6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869440, "uuid": "de2153d4-3b8c-459b-bbf2-a131432eee4e", "value": "diagram-123968574.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec954c0-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916408, "uuid": "d15d1525-8ffc-4869-ad07-ad1c5ea7f333", "comment": "Malware payload", "value": "f6f437984126977c5e733ef70c14fc23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916408, "uuid": "240c093f-2a33-4d3a-ad2b-9d70487e01c9", "comment": "Malware payload", "value": "0e37d3be9ebb24247164644246cb9fa28431abd9191852cbd2d5b6cf5ba9086f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916408, "uuid": "06ddc465-8ae5-4e4c-b959-f61d84a97338", "comment": "Malware payload", "value": "db076a351f42139778027aa0ed5c011741273baa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916408, "uuid": "eac3a341-7445-4741-b7e2-47cf3b59c6e5", "comment": "Malware payload", "value": "32f26358d4b0691c9f6d48696c933dbb71696d5971d32796e7abad69c3fc3c117f62cb65f50b1adf5f0572d5c19b8772", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916408, "uuid": "4242f325-4fed-4050-8a9d-bbb82968470c", "value": "303302D2AB13E5D38AFBEBA7085252D4936FDDDC32147C58192A298345FB164C0E37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916408, "uuid": "ad5b6e4f-78f4-4194-a228-5833f9404107", "value": "768:Uqo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ScjA6FH:UyeKCVQbp4LTaI7ZaiNQMIX4FXkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916408, "uuid": "295063b3-304e-4c77-83b0-4d43a5518182", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916408, "uuid": "a7b24024-d4d9-4bb7-a505-db239ee13324", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916408, "uuid": "1f8183b1-2868-401c-b0c8-f480e9782d94", "value": "statistic-592016181.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcc5a53-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871789, "uuid": "22730fe9-10d5-4c04-baa4-53d6dc01184f", "comment": "Malware payload", "value": "5e1014182dcc63a906b887bc93901d2a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871789, "uuid": "ace4ffa9-0690-41ee-bf77-f174e5df4731", "comment": "Malware payload", "value": "0e3cb12d5afc7c82e7325e2d90d0b29c471c989d0caded29e35f860b3bfc32ad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871789, "uuid": "4f2610d2-4419-4399-b43f-7431f6a676b0", "comment": "Malware payload", "value": "bc7181b5e425e4a5c7594b4aa93f35c2ddc9cd19", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871789, "uuid": "7ad8e6a3-b72d-46e6-b2c5-2471d31d06c1", "comment": "Malware payload", "value": "e75789dd4154e4596dc41a26bf03f14b5f27e91a5ef4d7c2885902c9583110a1fe8093ef474b98e1409dafde430bb1da", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871789, "uuid": "62d733aa-74a9-4b87-883e-80942d3b6312", "value": "3333F19537FAF91086F182B060E1B689274F3D518A695EFA0CC476793F931A0CFE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871789, "uuid": "718c081e-80da-4e4b-9a1e-6016a7f3b1fc", "value": "768:05G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJV21:0/czJJSI7r3Pwh8Rv21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871789, "uuid": "e45e9a6e-bf57-4789-84ea-cef858c7c019", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871789, "uuid": "a9b336ae-3c2c-443c-98af-e33fca65f12c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871789, "uuid": "7214c9bb-4fc5-4817-a51c-43d5df5831db", "value": "diagram-966631895.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562e8202-b3a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620882544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882544, "uuid": "fc3e9e0f-9b84-4d45-9b66-47471002562c", "comment": "Malware payload (Dridex)", "value": "2a71d07d2558a0bb9ab701c68b2b7009", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882544, "uuid": "fbbc429b-9364-4b28-9b95-a3c0384ec6ed", "comment": "Malware payload (Dridex)", "value": "0e3d0e409a4a46dec0ba0c9e15aff19f75b3b70d41997a9e56f89e97ee64e614", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882544, "uuid": "ad28b08f-96b2-47b6-a004-72d6a374d9e7", "comment": "Malware payload (Dridex)", "value": "0515ca7e2258c364699bbaa6cd1ac7931cd092a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620882544, "uuid": "994d0f00-3e75-4078-8c7d-fccc513739a7", "comment": "Malware payload (Dridex)", "value": "b2596d15fce18f03b38dc8aa594c0b192da5fd66c0b693d1c65ec48c50bb4b56e734807253c81f6d7b902acb5b6be4ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882544, "uuid": "883a0a4b-805c-44c5-88d0-d108cbdc2350", "value": "EDF3D0D3E21FD1A4F223063450F4F46ABA7C24C786349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882544, "uuid": "3f3ff480-d3be-458f-852f-721f1d19e447", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882544, "uuid": "a8920c81-7cfd-4b1e-89f8-9134a634358d", "value": "3072:x9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:x9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620882544, "uuid": "52fa05ff-7b25-4bae-8cc5-9b4112f3685e", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620882544, "uuid": "c920c8a5-642b-4adf-845f-05e22c5dae93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620882544, "uuid": "5118e3be-3b99-457f-9f4a-98ace6d1783d", "value": "2a71d07d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231c8aaf-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872580, "uuid": "24b9abc4-ac04-44ae-96cb-b839e0f93a92", "comment": "Malware payload", "value": "98e7427508835f551844e506e4fa5612", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872580, "uuid": "9c1438d5-6530-491c-bb8e-31d1fd9fb3fb", "comment": "Malware payload", "value": "0e4a5d1cac862f87e24f4387db54f045f80c27ec42427c6e16499a513a4d27f9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872580, "uuid": "c991c59b-aa7c-4a8a-a76b-a622c9779e99", "comment": "Malware payload", "value": "55dc87f9aa1142ab7bfa71c0830b47441bd7ba91", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872580, "uuid": "43253748-908a-4c54-875f-d9c32297e8e0", "comment": "Malware payload", "value": "0ef020864c3eec46b52d3d980a06db6bd37d96fadc97d59c86133fbd272d9e7707c43910fa6df0a8438f04597a80033d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872580, "uuid": "4bb4ccd4-9f58-4d59-8027-575828b20496", "value": "953302E3D312A2BCB643C04989CC1E979377427026658EA2C56DFED1A33D7160B61BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872580, "uuid": "b4f14169-0874-4768-9c31-e0642b9a91fd", "value": "1536:GD/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8L30y:wXKAXh3TCdOi+KSZ4WBRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872580, "uuid": "49d5152c-0bfa-4965-aca3-dc73fa557065", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872580, "uuid": "b5eb6c8c-339e-4ce3-9bb1-f34aa23cc985", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872580, "uuid": "4e2f04c5-c7c6-4728-a16c-2e6fc2d8ac11", "value": "statistic-1544826287.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dec4c3b-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915547, "uuid": "eb007ba6-10e6-4341-a181-08b5be1add42", "comment": "Malware payload", "value": "f089529ca78766e273bd4c402ad36ec0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915547, "uuid": "bdd99a1d-7b1b-4d71-bab5-51547e2bc527", "comment": "Malware payload", "value": "0e4bb23a427c316c31bec15fa1532b86ece600ead398b53432d9ec3ec26b3739", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915547, "uuid": "4329828c-609c-498b-822f-afc7bf66e3a2", "comment": "Malware payload", "value": "6cfb8a09c66342ed329b3ef03da0e2602aa18b20", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915547, "uuid": "1226a803-ae7b-49d0-8b0c-daa5f0ca2882", "comment": "Malware payload", "value": "f908fb0160fe6f11e9241cc509043fb68da6de043fffb65307b10f26551fa8f583c36c905a4434f00b221fb745761f10", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915547, "uuid": "dd19604f-8ff5-4428-90b0-019dc86e77a4", "value": "A933F1E61B26F5C2CAFEEE63084563E4975B998D35283C98053F258241FB558C4F37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915547, "uuid": "6abaa24a-9287-4ec8-9731-53720e5ed74d", "value": "768:Ko4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/rq:SeKCVQbp4LTaI7ZaiNQMIXvrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915547, "uuid": "a225b863-b8a2-4ad2-ad73-655b8601640a", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915547, "uuid": "5b990656-ce89-4d81-9928-b9619189c7ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915547, "uuid": "653d1540-4a09-4909-b959-81d4b3c09bfa", "value": "statistic-1883767640.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee11e93-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915952, "uuid": "46c3b0e5-515c-4df3-a6ae-8dcf1ac973ad", "comment": "Malware payload", "value": "142353ecffe228ae1f3d12f45d40da92", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915952, "uuid": "270bc5b5-a300-4853-982b-aa46b9f1495c", "comment": "Malware payload", "value": "0e533e6870f171877d4bed0c3562086bc952b5a6380f7ca9ac24468e2432fc4c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915952, "uuid": "c360759b-e8a6-4fd7-b079-74223e1b44ca", "comment": "Malware payload", "value": "b8e800101a4552a813f011967c9eb39fc88dc4f3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915952, "uuid": "5204f278-51d8-4497-a7a7-895cb852ad9f", "comment": "Malware payload", "value": "d39d4b15f68fd42a1cf8dc6ffdf8754235fb808a4d7e388047391ec759a26f1fd3dcf4383dce5fbaa9396aa4a3aec79c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915952, "uuid": "eec469b2-54bf-4906-95bb-400e89cb5c49", "value": "DF33F1E66B23F5C2CAFEDEA3044523E5939BD49D31283C58552F258240FB568C4E7BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915952, "uuid": "f47cafcb-5a8f-498c-857c-765b111b7af1", "value": "768:3o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/uA:NeKCVQbp4LTaI7ZaiNQMIXvuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915952, "uuid": "07818ae0-d3f4-4212-9995-e6fdbbd4eaee", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915952, "uuid": "de08417d-4ee8-4095-a67f-cf0a1843375f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915952, "uuid": "19a0a629-b815-4bab-ad54-8aaad9b3191e", "value": "statistic-250508219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc2b1b1-b3e6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909021, "uuid": "d54d889c-0304-49a7-9bf5-50102aa2554b", "comment": "Malware payload", "value": "89ec68caf7976e16399551b670e00c46", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909021, "uuid": "5ab796ad-84a6-4fd8-b19b-bd0341af5fc0", "comment": "Malware payload", "value": "0e603566c79f1c47d2135f0e9d252cc618cdf9b766b1eea4e16b63aa22b189d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909021, "uuid": "e268a5fa-9a81-422d-98e9-37f29065d441", "comment": "Malware payload", "value": "635d0c4f7d58b7ebb5cc35eadfe3bef849d03b50", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909021, "uuid": "b3af99d0-e9c2-4da0-b6bb-a8c7fd731f5c", "comment": "Malware payload", "value": "2bb73ada20b658a7d7088b7da7e1fc1a8cc3a5060d27a84c232142a85d1e3291a6f04bb990ea5926d1c2e2ca6b954e10", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909021, "uuid": "6f289b33-eccf-484c-b558-2432bde2f006", "value": "C03302DFA004EBA3C25F93005FE987A215FD7958E1708168979A86F9EA833C2C53D5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909021, "uuid": "2915b98f-cd85-4ec2-9595-657ed057c405", "value": "768:Sqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3gshfvx:jxTuDqsF1Cnc3P57oj2+nC6uxkLYCXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909021, "uuid": "4acbb84a-50b2-464b-b319-6e23c278474c", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909021, "uuid": "df261bdd-02d9-4e5f-aa68-65f4a3019809", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909021, "uuid": "437b57af-569f-41fe-8cfe-58de38fecd0e", "value": "catalog-1066696522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8eccd5a-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913714, "uuid": "e9b09b52-dd76-4876-82fa-f297d1379b95", "comment": "Malware payload", "value": "ce4436df798eaa9bcc0fbd87be899232", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913714, "uuid": "aee400be-abe6-4ce9-8026-1ce65d3af79a", "comment": "Malware payload", "value": "0e63746f56a659220f1bd1c7c681c7f7d8bab512d2af50bb17296a56cc30d5a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913714, "uuid": "24096093-7640-4c65-9ed9-0a7e84fed265", "comment": "Malware payload", "value": "87bf2dda8113e377881e2490d3ff179981dba15c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913714, "uuid": "dc2bb843-883d-4c1c-b19c-877a074d8cf7", "comment": "Malware payload", "value": "618029f1d4a94a7a456fedf0afaec7dafcd05b5de1898c61704e3e09f50dbf4c55ee05c32d393f7e199237b828c0ccce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913714, "uuid": "086a6d8d-b3ae-4007-a41a-6d8bf6cc2f3e", "value": "6B33F2D232D7E23B80C506F6F52B99D726779AC4E83094D16D8FCA1213E31666DA170E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913714, "uuid": "fa9774a5-81e4-4636-b18a-11b55ecce4d7", "value": "1536:zEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnwV:YnBrX5Eg5Enjq3axWIfkNwns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913714, "uuid": "71390f16-438a-47f2-8491-4d992f2613c2", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913714, "uuid": "f71c3e2e-99b6-4acb-ba12-38748b944abd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913714, "uuid": "916e205f-c62b-4e20-b7c3-2a70004d54e0", "value": "diagram-503181887.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105a8a38-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910344, "uuid": "622d8879-8435-4bfc-bd5a-6538915559f3", "comment": "Malware payload", "value": "dd90ea72ce41faa650749323d8b968cd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910344, "uuid": "6c64f8c5-4046-4db1-be05-815215a3a11f", "comment": "Malware payload", "value": "0e664c5d32244e8d023cd96b33bba38fbadc379cdff4fefe3b9a354c32ebb0e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910344, "uuid": "64e732b0-6180-42ee-a120-69916d07ec46", "comment": "Malware payload", "value": "9a173e061d51bd002d06f90915da0936cbda3359", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910344, "uuid": "16662768-2ec0-43b9-8890-ccfdc2f5b2c0", "comment": "Malware payload", "value": "c672e1547f51cf447423989d15886d1ab99c58cf82f015f9a31841f808baf2e84249afb3a171feb3a84a7d6d81671f2e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910344, "uuid": "db793d32-234d-49bd-a2b8-e566f5c0a38a", "value": "0633029FA054F9B3C29F86016FB59B6306FD790DD2309158D31AC6F5EA836C1807E8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910344, "uuid": "4f567478-9cda-420f-b2f2-7965524c804c", "value": "768:aqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNRi:bxTuDqsF1Cnc3P57oj2+nC6uxkLTNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910344, "uuid": "8767a065-1f16-43a5-9d4c-4f7ae8817a45", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910344, "uuid": "dfd4d944-ad6b-4b3a-a692-aecf9a0e0b1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910344, "uuid": "b50fb38c-c513-491a-8d3f-83b57a702cc6", "value": "catalog-1940891734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f601eb5-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873432, "uuid": "0b3953ee-9417-46d7-981e-0ace06426c5d", "comment": "Malware payload", "value": "f1788d8aeab93344f1e8d8c32bbc4ade", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873432, "uuid": "271ebffe-df86-47c3-b950-687075a189ee", "comment": "Malware payload", "value": "0e679a57d3e63ef798805dd15292eedb411e7e45fa9f9825cade8647c6b57120", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873432, "uuid": "85663f0a-c0d3-4291-8267-5884225dd44e", "comment": "Malware payload", "value": "43d81d4495757c6c0ec1cbb6b87ef406eeea4fd7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873432, "uuid": "a2a46d74-2755-48dc-8935-c4991f7a5687", "comment": "Malware payload", "value": "b11236c5a877a08583c6529eabc6a715fe47c66d3e6b5fc1baad66dbc276a03e067b9b0d9401b6d49c12f3c42911fb16", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873432, "uuid": "d2ef5d41-4462-4196-a760-172b6a20f7bd", "value": "DD3312B3E643B1EC7703C58E49CC5D1B423B427056B88EB1CA1DDEA1923972617517AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873432, "uuid": "1f1476ab-aaa7-4fb3-8135-ab50b38323d7", "value": "1536:Rr/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexH57:FXKAXh3TCdOi+KSZ4WU57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873432, "uuid": "abefd1d7-8dd1-49ce-8be6-57cb174c6af1", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873432, "uuid": "bb1f167c-8802-463d-9eec-d2c548dcca82", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873432, "uuid": "8c6294b6-b689-4a02-bb2e-083da125a417", "value": "statistic-2030694047.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1371bb8-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914050, "uuid": "f2d58357-e898-4018-9044-f81ee6aaf709", "comment": "Malware payload", "value": "d20ddb6a2574ce72fe5458440ffd0061", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914050, "uuid": "0a41e237-1944-4b0b-9650-4095a4c6cec6", "comment": "Malware payload", "value": "0e69f5bcc3f26f1f29738e5239c7ef6486ebf9020012797b3c781e38ee76f6ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914050, "uuid": "c2131bdd-51ee-4a52-9b91-dd2eac42cd7d", "comment": "Malware payload", "value": "a84da894b1ff4f07f4f4f3481e6154d39a3d3eb3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914050, "uuid": "f4b5e96e-92d2-4915-8c1c-b133a6fd71ab", "comment": "Malware payload", "value": "6be09d607721bcfcac0e37596c487519526ff42569513edee2acffee91ade049a4e647cc11b729a1bf5736454290668f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914050, "uuid": "591621ec-4779-4049-a22a-4d81e337fe66", "value": "733302D232D3E23F80C645F7F52B5ADA56B78A98E83090C12E9ECD5113E31656DA134E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914050, "uuid": "58e9c1c8-8b31-4717-8069-e0e88884673b", "value": "1536:gEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnE:FnBrX5Eg5Enjq3axWIfkNwnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914050, "uuid": "a441acc7-d83e-4843-aeed-437c5aced664", "value": 51756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914050, "uuid": "5b7ef819-d31a-44ed-a934-b503c18a5bbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914050, "uuid": "914f629c-668a-492a-9c82-228208edf88f", "value": "diagram-750342704.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765f17fe-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911374, "uuid": "4058f116-bfa1-4e8f-a7cd-3b02fb4510df", "comment": "Malware payload", "value": "0b6a6bb08655bab6ad65555a9e4d5a26", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911374, "uuid": "a73b5bb4-5efb-41c7-8204-f3fd2119d33c", "comment": "Malware payload", "value": "0e6ca800de87828e9cd312db44ec31ec45186fea5ef2eecc39176d9acd160f44", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911374, "uuid": "2e8be97b-f641-4565-936c-0680d99b3eec", "comment": "Malware payload", "value": "36fef8990dc6284904c33269a3b092a7cb56e089", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911374, "uuid": "92385c49-eeda-4713-ab80-8f169e5d8520", "comment": "Malware payload", "value": "a3df5d041568fa6f9a9178fc5bb4f4d1579905301c3a30de4b0798c8e803123e45d25e0e9d3d805391ea0ed76174e856", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911374, "uuid": "98cc64b1-8b02-4819-ad66-e2e6984926d1", "value": "213302DFE415EAB7C1EB56014FA59AA306FDB64CE0308628C754C7F8EA835C2853E5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911374, "uuid": "370166ed-61b7-4dbd-b1f7-92deef131dfc", "value": "1536:dxTuDqsF1Cnc3P57oj2+nC6uxkLiO9Mr0:dxTqqsF41j2Pxmi30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911374, "uuid": "3cefcedb-2160-497f-8556-16785811879b", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911374, "uuid": "1627ac13-5b7d-4933-9e32-246cff040162", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911374, "uuid": "f6addfa8-a96c-4b8e-9549-abd9f4b9f42e", "value": "catalog-772039939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825af2b2-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871451, "uuid": "02efc12c-7e5f-471a-96db-23fece5a497f", "comment": "Malware payload", "value": "317551ca037ddb2a4e71d2fc3a012c1d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871451, "uuid": "607ec72a-5119-47cb-ad0f-1322e0d10c91", "comment": "Malware payload", "value": "0e8d756400d16a23a4b4219cee58068d05fed4fd407c34f5ea1fe2f86f0d0f02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871451, "uuid": "a274f7d6-6661-429a-8483-4deb87c8a86f", "comment": "Malware payload", "value": "5fee2033a81663aecee6033816c24f3df400a0a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871451, "uuid": "51693662-0f2a-422e-afb0-919c7011c337", "comment": "Malware payload", "value": "0122044e211b85ef9b56fe0cf8cb23432f54ac05892b4547b3335c1ebb3bee0bc6490372d6db582f25b1c9cdd10c4aec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871451, "uuid": "df015877-d03a-4d38-8805-bfaa2b354a3e", "value": "3F33029673FAA910C9F1C2B0A4E275C8374F3D928E7D5DEE4D8864793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871451, "uuid": "10e25e28-8c13-42e6-852d-1f9d5943d090", "value": "768:c5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoA:c/czJJSI7r3Pwh8rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871451, "uuid": "ca4d5b0f-46c0-4808-9f0e-e96c8f225554", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871451, "uuid": "c23c9adb-37ab-4dd6-90b7-e88e09e6290d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871451, "uuid": "cdba0a25-ea38-4708-ac70-72694c92bc56", "value": "diagram-682850632.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717559cc-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870993, "uuid": "4fdc7c87-942e-408d-9b13-7109efb83541", "comment": "Malware payload", "value": "938f49d9c1bedf8986a151136179966c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870993, "uuid": "705a5ca2-c67f-4d96-9baa-f20cce33b081", "comment": "Malware payload", "value": "0e98131d08f0f1c52311615374742593caa993612570a9f6440f56aa817a473a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870993, "uuid": "42016ad2-c933-459b-b91f-35d762da2493", "comment": "Malware payload", "value": "db76def9eec7a1ad8239aa2636853cde72ad2cec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870993, "uuid": "2b3983e1-a68c-49dd-bc85-3fb48c927196", "comment": "Malware payload", "value": "4ca692ba4e7afa66937d422a30bcef46c28c4ba230f45a8fabb9d380038549600be06a0e004173155e21d60a9d795833", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870993, "uuid": "8e8f773b-d26b-4436-9f05-1508807bfa46", "value": "6D33029673FAA910C5F1C2B0A4E27599370F3D928E7D5DEE4D88A0793B920B0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870993, "uuid": "7e70a0df-7e08-4869-b202-4813c288b67a", "value": "768:x5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcg:x/czJJSI7r3Pwh8fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870993, "uuid": "f8c2d263-024d-43b3-ba20-e97d79e0dc61", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870993, "uuid": "79f3f7ad-67a1-43a6-b7d3-784022b05828", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870993, "uuid": "7e572d76-f2ab-4130-93a0-d55857dc50c0", "value": "diagram-351694344.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491d401e-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911728, "uuid": "3f2d9275-677b-47c9-922e-b3349aaf66d5", "comment": "Malware payload", "value": "01b1d7fea09bab4f718a129663e8cfbf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911728, "uuid": "9e79356a-7037-49b3-a07b-2f57e26d37cc", "comment": "Malware payload", "value": "0ebefbeb07458bc005b2c56715be9754fb2cd32f92041d5a0edc80d76e3f3032", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911728, "uuid": "51fc5192-14b8-4aa2-8947-36be6e99365b", "comment": "Malware payload", "value": "038f1bfa199a7d6cabdd8f063c25ef5c009292f7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911728, "uuid": "716df626-1ac0-4569-b0ca-4a6a13de1cd8", "comment": "Malware payload", "value": "afaa965fd5d762b130b57d39cef6080ceb08318646144eaea3687e320a58334a2f5a5246d1469d9254b967011684486b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911728, "uuid": "8a1e9d82-a361-458b-a70d-cf9fc6924a80", "value": "8333F1E232E7853AC0C405F1F52B5AC966B39EC9E530A4D01D9EE91223D327A6DA174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911728, "uuid": "7fc7e15b-4cce-4d2f-9087-201d0e4962d3", "value": "1536:ZEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwi6zq6ft:WnBrX5Eg5Enjq3axWIfkNw/Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911728, "uuid": "368ca88c-2bc9-4504-a73f-63f850d82941", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911728, "uuid": "8d422651-3c2d-4add-9732-c485a45f4ae6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911728, "uuid": "fc749a61-59f5-4c59-bc56-9a18a6b6fd13", "value": "diagram-1027608507.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f2635e-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910169, "uuid": "0a737b6d-f824-4e06-af53-d1d85ead3180", "comment": "Malware payload", "value": "ed59d7967c6f03084a5bb84835edb36d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910169, "uuid": "3cca5756-4d73-403a-9cbe-3cef5698e9a6", "comment": "Malware payload", "value": "0ec02f9f5aa8e906b4583de38fbf653b535a18d0005238f6f0e2083cb7821e8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910169, "uuid": "b568aa4f-7a3e-44e2-a8be-f60499c3b987", "comment": "Malware payload", "value": "e29d4dc92fa09fb785accbae421f43451f17389d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910169, "uuid": "79b34064-7170-48a7-93df-b816fe0bff28", "comment": "Malware payload", "value": "f02254410935754c4a3ef57904e484ad18c6c97e141977bf133410c9581f09a2fb79fc32bdfdd5c6a6e7ccaacf1be4fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910169, "uuid": "306d019c-1cb9-4b27-ace3-db877e866ea0", "value": "AD3302DFA414F9E3C19F96011FA6976216FC7A1DE2309158C35AC7F1E9C35C2C42A8E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910169, "uuid": "1c525c6b-cc8a-4e53-aff6-66e565dadebc", "value": "768:Nqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNrLo:oxTuDqsF1Cnc3P57oj2+nC6uxkLTNrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910169, "uuid": "317de02a-1881-493e-9b4c-f385fd0fe46c", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910169, "uuid": "125faa6a-baa0-432f-ba4a-7b53736fd47d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910169, "uuid": "4363bf71-a8dc-4ffc-a431-1667fc3013f3", "value": "catalog-1801347700.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04467bb-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874078, "uuid": "e11d5db0-2051-4046-bf41-e5d505d54289", "comment": "Malware payload", "value": "2f353f46c76e60458c8f1517c9c17c33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874078, "uuid": "c76c815f-e1b7-44a6-92e9-20f0d6fa8e11", "comment": "Malware payload", "value": "0ed030e2470268e55a98780f0ad576fadd033422dbe0b81f36e21c53c72bc27d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874078, "uuid": "3395536a-ee08-4272-834e-f1fa7d1b1cd0", "comment": "Malware payload", "value": "136ba548a149d194a73358dd190d4b667b75c3b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874078, "uuid": "8f0f0713-cb40-4889-9015-f0d58a403a40", "comment": "Malware payload", "value": "44efb029f4b40c4be865d59efd3907d2d6805e4fc83d05fb98f05a3aac791b8892fdd0319f90c6158d3f142c2d42b4a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874078, "uuid": "31fa2e66-e19a-45e3-9b3b-a08fc30df049", "value": "BC3302F1D603B6ACB903418D4EDC5E2B523743709A5D8DB1855DEEC2D23971A0F90AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874078, "uuid": "53d93723-e9aa-4f14-b218-620f5c9b2f2b", "value": "1536:A/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMB:QXKAXh3TCdOi+KSZ4Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874078, "uuid": "ca1fdf3c-4f88-4824-98c1-80cb60c6c163", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874078, "uuid": "b7ee1ea1-5c87-465f-a4b6-97408e37fd45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874078, "uuid": "4259494d-674a-43ae-9ca2-7a13bd00e589", "value": "statistic-568050615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec457490-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909854, "uuid": "e10cb4b5-7d7e-4bc7-85e8-1c0a767d37c9", "comment": "Malware payload", "value": "7f6094567a9002627fc6b75dbe905873", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909854, "uuid": "84dad8aa-d777-472a-a149-7bc111410c55", "comment": "Malware payload", "value": "0ee286b210a4734e34995231c9fec21cf8c4bbfbe697212db7774fbe2a6dd6bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909854, "uuid": "c1290cb8-4dc6-401a-ac30-38202fcfc988", "comment": "Malware payload", "value": "575906da61f48e5a68f62955e93134a42e88c7d1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909854, "uuid": "d03cdb40-b567-4614-aeeb-4cdd03d5b741", "comment": "Malware payload", "value": "20a413d7445681373fd78ee4642d2de1f825c7d6da72e4e752c162e693228d3ca836ebc9e7059e6fcc4cc44c39c57ddb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909854, "uuid": "ad74de89-3660-4044-bc7e-27407614b3a8", "value": "183302DFA414EEA3C19B67015FA9E6A206FC761DE230D15CC35AC6F5E6836C2802E5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909854, "uuid": "ad2f58f9-fc5b-45d8-a2bc-a1280e7477af", "value": "768:tqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7mOzzObaz:IxTuDqsF1Cnc3P57oj2+nC6uxkL7H2Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909854, "uuid": "98abe27d-0571-4c91-90f7-dfbe25816e44", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909854, "uuid": "0aa8fbd2-966c-48b3-8399-c15e68e57c87", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909854, "uuid": "fc891c16-444d-4659-b53c-cfaf7d79d9bc", "value": "catalog-1565027727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44074b8b-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867051, "uuid": "43973c69-988d-4440-b73a-cfa8a81208d5", "comment": "Malware payload", "value": "a132f7a81bdfae614f652acd97f1948b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867051, "uuid": "3672114a-04b6-417d-bf1f-aead82ea8a18", "comment": "Malware payload", "value": "0f07e67ef6514a008951c22d1898973d333b80c2d39548fd7609052a6e1c7758", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867051, "uuid": "c43a157c-3bc1-40dd-82c3-b63a29d7fcef", "comment": "Malware payload", "value": "1e60fee50f203f2ca5132054246e02d6929fb8f5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867051, "uuid": "b42e1073-d3fe-4e2d-a3d7-b011b8bfa747", "comment": "Malware payload", "value": "c6593973cccbd5b598897f64f02eec310edfab7b1635e4e746caaeaadeb7389683f4e8308fd6728ab422338e246181dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867051, "uuid": "21b67547-23f4-45c1-9f82-1ce17a4e72c1", "value": "DD33E188EF57F518CB8273BB7C882FD7AFAB025454DEE4995BC3319D0286E32561026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867051, "uuid": "f05f1b7a-a1a8-487b-ab22-ca82ed8a5cad", "value": "1536:uAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqb:FpoAnd9gucKCIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867051, "uuid": "71209bc8-8c59-4f4e-873a-f40c48dbf851", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867051, "uuid": "8780495d-6a1f-46bf-95bd-43d36c525ec3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867051, "uuid": "352d2a73-6747-4bc6-96f6-bdd35d3723af", "value": "catalog-1277709987.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83dc152-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910196, "uuid": "c8c32402-2413-4ddc-a6a6-7fe605d3dd39", "comment": "Malware payload", "value": "74c432dcdcc2a2b2319811f4d6d728f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910196, "uuid": "8f91f684-beb2-46da-9550-fdd432efa98f", "comment": "Malware payload", "value": "0f0965732f3871eb43aa96aa1c271f3ac3bf43c5eb97b5f9c45df8cd4333aef4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910196, "uuid": "87002427-01ca-44e7-a0df-6af5dbca9c31", "comment": "Malware payload", "value": "4f6959db1f614e6b65b98a566eb644c7af839753", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910196, "uuid": "97cec2d2-4da3-433f-af82-faedfa75a3e5", "comment": "Malware payload", "value": "5a7c60ded891c5e52b3b5f7224be96d8098d450ead0df07f8fa95d4ea28b27a92f26df65b71dac1e3dc97c6a2b18efa6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910196, "uuid": "03e90977-8b57-4d71-935b-b0fd9d51790b", "value": "093302DFE004E9A7C29753015FB59A6206FE760CD270A5A49399C6F5EA832D3D03D8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910196, "uuid": "221eb0ec-83e6-4658-b5ad-228558e196d6", "value": "768:bqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/Lsyx2iM:exTuDqsF1Cnc3P57oj2+nC6uxkLsyx29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910196, "uuid": "ae0f0faa-782f-4221-914f-48d1fcdd8452", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910196, "uuid": "e5f67078-2275-487b-9ada-bb0b22a05901", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910196, "uuid": "fe0b9868-7c96-4241-b795-014d1e14c2d0", "value": "catalog-1824311496.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19bd12b-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868067, "uuid": "43745403-e67b-4b08-981c-8ae098ff40de", "comment": "Malware payload", "value": "e7808dfdb35e42e967610bc7500a1f85", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868067, "uuid": "14d56fa9-e471-4394-bd38-4f9bf7b0e060", "comment": "Malware payload", "value": "0f0979cd423db153bad2ca37fc5e4c30843befea7b9a5fe4e2fb069a8c27e35d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868067, "uuid": "6e5612cc-f045-4a38-88bd-e89e375bdd69", "comment": "Malware payload", "value": "797282cab7009aea7431b281b1628d2820895e34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868067, "uuid": "5ad2731b-8476-4661-9157-d8d8e0a4a04c", "comment": "Malware payload", "value": "c24111573674479a0a223f0588f519db65503b1520c32ed428c78452b7749b3116198a219731d8ad0dd35c679f3df57b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868067, "uuid": "d9f5ce41-07fb-41b6-9eb4-7ce7ab2a12a7", "value": "A233E1C8EF5BF418CB9273BBBC482F977FB70264648DE1955BC1319C0296E27161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868067, "uuid": "a4b1bc02-7d11-4915-a2f2-1bf72b53de7c", "value": "1536:HAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiAMy8:gpoAnd9gucKCAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868067, "uuid": "40cd58dd-f5e5-4e6c-9a17-109dd7e719e7", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868067, "uuid": "dd05fe37-bcc8-4424-807d-80127ac5eb8c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868067, "uuid": "37e1ad00-db07-4f45-97cb-be7ce87d3944", "value": "catalog-2079571618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcee88f-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915708, "uuid": "45e50785-e2c8-43e1-bfb2-60142dc1974f", "comment": "Malware payload", "value": "ff603234f55452e52ec64d266999d293", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915708, "uuid": "b3e0d421-bd7b-4ce2-9373-1245bd50f4c2", "comment": "Malware payload", "value": "0f13517a4919dac0da9e8a0e836b09d6e6e313c9d4eaa0c81faf4d2805c1d071", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915708, "uuid": "109abfbd-7f48-43dd-bd35-18604e63538e", "comment": "Malware payload", "value": "95994bb1352887d14a162ba5136035b0d643954e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915708, "uuid": "82baa5c8-824d-42e1-9585-29f07c653b59", "comment": "Malware payload", "value": "07eca7b9540a8aa0f1d69265cfcdf3538b1467d565169fc38b4d7f1167c6bf60bdbc91319a6c799d7de30a1667f2c1b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915708, "uuid": "a9c81e05-2fe1-4c88-9c32-7838f7112bfc", "value": "E23302C5AA13F4D2CAFDEE67045633E5939B889D30187C691C3B648284FB168D0E6BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915708, "uuid": "1db11eee-8aad-4ae7-8987-1828ec3aac61", "value": "768:wo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SeQ9AXP4:UeKCVQbp4LTaI7ZaiNQMIXOpXP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915708, "uuid": "e1e2e777-451f-4fb7-ba99-979793841697", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915708, "uuid": "fa91dfc7-a2ae-4970-93ab-c526b67fdc7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915708, "uuid": "12285531-620b-4936-b868-f496d1e6eb17", "value": "statistic-2011454170.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9b6f9b-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915200, "uuid": "03aea283-253e-445c-a3ca-c0adc2f31da4", "comment": "Malware payload", "value": "b5b5dba16c2424fa9d7113e39462381a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915200, "uuid": "da702f21-54a6-4a64-9d0a-8e4da3a6a369", "comment": "Malware payload", "value": "0f2129f79aba32a251d60f64031efa48411c188e1a3c4ee18f75b481c3a71acd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915200, "uuid": "6869a43d-ea93-412b-b0c8-5ab51160f87c", "comment": "Malware payload", "value": "1c941510fd1ddad7c600276791fbdefcafd5dfd6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915200, "uuid": "e7aad67e-dad5-4b13-ad4f-2ff90ad3f70a", "comment": "Malware payload", "value": "beff48b32abb27de91d07f234063e9e660628814274ef9a5bf1e83fcc14c1171219a02aec7580beebc2952a35207ea9f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915200, "uuid": "f2f0d641-d198-4c4c-9f0d-aa0a63e22fc2", "value": "EC3302D56A23F5D2C6F9CAA7045622E9575F88DD31283C98093E218281FB158C4F7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915200, "uuid": "2f2d62b1-6c05-4a05-be96-6a87fe16b9f7", "value": "768:ho4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Sm7:beKCVQbp4LTaI7ZaiNQMIXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915200, "uuid": "063dc73a-5d8f-4df9-ae40-2c18c4a0f284", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915200, "uuid": "f29baf6d-1a8a-4fac-b02b-52b33c77dbed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915200, "uuid": "76541432-04ed-41bd-84f3-b4ecfec590cd", "value": "statistic-1580781246.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a4ee08-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871614, "uuid": "36a3f6cb-98d0-4f2e-b825-a5f28b3f021d", "comment": "Malware payload", "value": "355c2466ed628ff7a2c708b9fef8817f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871614, "uuid": "8aafd0f2-826d-49e6-9274-8936eb10f39e", "comment": "Malware payload", "value": "0f26662a0ce98ee6196a67bcb1f2a344a68b56ec165f0f90405138e2b48afe10", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871614, "uuid": "3290e58a-3659-4158-b1c3-654f70b658dd", "comment": "Malware payload", "value": "29d6663d92a5f2d75fc072a9589890e0411981b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871614, "uuid": "0cf6ff74-e1e3-4165-8274-f5a87bcbb608", "comment": "Malware payload", "value": "77e1f31679204a2b9c05949fef70f23a1f30695855e356ddb2393bfe39dcf101ce8e664449b707d5df66fea7d5ddb0c5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871614, "uuid": "daca4f3a-10a2-43ba-afba-7c501969320a", "value": "1733029673FAA900C9F1C2B0A4E27588374F3D924E7D5EEE4D8894793B921B0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871614, "uuid": "077305cb-dee9-48f8-bf9f-bfe1e24024fe", "value": "768:x5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcV:x/czJJSI7r3Pwh8fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871614, "uuid": "6c5ee786-f9bb-4b3b-b704-203d2cd52b1a", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871614, "uuid": "686233ed-976b-4a29-953e-a334a49a894d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871614, "uuid": "68b281f3-e449-4958-8ff1-038f0919aef0", "value": "diagram-83189308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f10916-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869472, "uuid": "617200ab-be11-4e66-91e0-73867892dc99", "comment": "Malware payload", "value": "b160d5bc767bf2ef16757ff4288c7664", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869472, "uuid": "f80aba77-6242-4073-9cb4-bb2899b864dd", "comment": "Malware payload", "value": "0f336068c2691f78114ffae018ebe157aa330adce72708bc9eeca73e38d9dfcb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869472, "uuid": "b1d1b2bc-807e-4453-873f-61180352cbdb", "comment": "Malware payload", "value": "258949e34e85a1c6e04d1d79ac6e61c25e4bb1f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869472, "uuid": "ce3f49b6-a73a-46ce-ae9e-fe600ea5e8d7", "comment": "Malware payload", "value": "7144f3f84e9a6b4e65f067d1a2d3fb1dc926b69e5725f39783a2829c458c0a3da7bf89d74afb0a6a059c45e027524263", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869472, "uuid": "fc02ab00-af89-4488-b2bf-00324c6e2b90", "value": "8233F2A473FED510C6B2C2B0A4A3B589364B3D91897D5DEA0CD464693F931A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869472, "uuid": "21c73428-15af-4819-8d28-4693354490d8", "value": "768:W5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8k5VIWgu:W/czJJSI7r3Pwh8tv8x822nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869472, "uuid": "f4496f95-5a78-4caa-a793-2beaedd5a832", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869472, "uuid": "1798288f-120f-4223-9d8a-26116e1fcaad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869472, "uuid": "33203070-3d75-435a-90a3-7a523045f07d", "value": "diagram-127388799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a75c2d-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910994, "uuid": "5eef0c0c-5494-459e-99b7-640cf7dc1782", "comment": "Malware payload", "value": "c1adb96fadf51c74b3cef92f43c3d2ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910994, "uuid": "7106b503-c6ef-4c1e-9b66-deeab033aa97", "comment": "Malware payload", "value": "0f3e39037b123a49dbf1a18e8265d38bccfccca4b9214247462f8cb8637823ac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910994, "uuid": "98d4db18-73fa-4f18-90cf-5e52e494432c", "comment": "Malware payload", "value": "0a0eb69e8e366374d6f300b36cdae9ad4618330d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910994, "uuid": "8f91b574-d421-47ed-911c-1f56429cb3c9", "comment": "Malware payload", "value": "3898b39178e1b2dbaf406db5bf3b8bfa9128b300f4b34c35e234fc1830e0e786f8c991294550d79de7f7854a4f8e9165", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910994, "uuid": "0845897f-4bdb-4bf8-9375-4b569630ea59", "value": "473302DFA014FE67C29B53015FA58BA207FD7949D170D658C32AC2F5F9835C280399EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910994, "uuid": "9261b154-74b3-4053-ba87-4014c0bd0de2", "value": "768:Qqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LpDvNJI:JxTuDqsF1Cnc3P57oj2+nC6uxkLVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910994, "uuid": "3589e0fd-8d98-4b56-b68b-b2a9871b1d63", "value": 51710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910994, "uuid": "3ebe7ca6-aa4f-4de0-bf09-387d2aba19b9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910994, "uuid": "8b4156b1-d442-479a-aad3-543cd1d266c0", "value": "catalog-512893523.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9309a46-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868214, "uuid": "7aeea1f7-597a-457b-ae2a-0534e6fc621b", "comment": "Malware payload", "value": "aa31b152f6abb87303c67709ed9cd068", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868214, "uuid": "3e9bcd61-bae8-485a-bd16-4504522e4c20", "comment": "Malware payload", "value": "0f412efcfce72a2b3ad1390c2ba9d9f1cd0f4858718d78b3498fae3386bee19b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868214, "uuid": "27406c92-c91b-4a9b-ad80-88843982e483", "comment": "Malware payload", "value": "cfb62310fdec883467a2a59dc3000fd8d542a9ea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868214, "uuid": "c2e39f54-a94a-4313-88f9-79c3e6115994", "comment": "Malware payload", "value": "44ca12927d11e9b43d3ad2d61ac0f04341c573f7de13cf6f71cf6fcdb3d0feb0cf39728ae7450fc44d151296640e8631", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868214, "uuid": "d2e9a28d-4401-4ce6-a331-7e4417f5e2d8", "value": "9633F188AF5BF458CB83737BAC442F97AFB7026459DDE19867C3309D01C3E6716142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868214, "uuid": "2a5bd632-6b7e-4f54-8f00-db1f58ad88b5", "value": "1536:hAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSN:2poAnd9gucKC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868214, "uuid": "3dfc7878-b62e-4204-a628-d2a2180becbc", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868214, "uuid": "82c9d729-b065-4fe1-951f-a0b866ec5639", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868214, "uuid": "3fd21a7a-1e1e-4aad-b797-fdcaa879d2b8", "value": "catalog-235808898.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6664f8e-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910730, "uuid": "b6da9e19-b8e7-4b8e-ae6b-8f54264ad12d", "comment": "Malware payload", "value": "f9d401be07c3018ea1b46d4fe0f5ebac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910730, "uuid": "63e0a2fd-1636-4e97-8b93-49a11ff26bfe", "comment": "Malware payload", "value": "0f428abfaa00d7f658bc89dbaa2bb3054c96645eecbb0632023eb4e291a93d69", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910730, "uuid": "55bb6282-07b4-4400-8eef-b6b60414306b", "comment": "Malware payload", "value": "e32ab353ec6638e54febb3c7c277407ea009684f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910730, "uuid": "1dbc0cac-1de9-4961-be32-70317b09ce82", "comment": "Malware payload", "value": "0690a990ecc163013952e48059274cc7ffbf17a312180880f1a6f7710e2474b5e7f82c108cde0088cf46dfc0c7aff5c4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910730, "uuid": "e8ed3387-a540-42c4-a23f-56c451e9656b", "value": "A433019FA008EEB3C19B93015FB2CA9303FD795DD1709658C369C6FAE5836C1C12A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910730, "uuid": "38020870-50ac-46bc-80fa-7c8c71a47ccc", "value": "768:xqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0BCu/Qu:sxTuDqsF1Cnc3P57oj2+nC6uxkL0BCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910730, "uuid": "e58b5c4b-d68a-49b4-9169-ea65b1b46c9e", "value": 51711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910730, "uuid": "92112605-0f66-4c74-b00a-6b0ba0e646bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910730, "uuid": "151c0907-da6c-4e8e-a95f-baac6b17506f", "value": "catalog-29880784.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49f6293-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911532, "uuid": "eba70c58-8a87-4c00-a159-64e44073c0be", "comment": "Malware payload", "value": "729bc75fd5b97d5f800c36fcb35fc8e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911532, "uuid": "7091b09f-4ef2-4f4c-9bb5-3fa1f3835a57", "comment": "Malware payload", "value": "0f512b4d0323b00cdb557559bf827703d74b9979742a5fccc6e6f50ac5dd7e98", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911532, "uuid": "e671aad1-1573-40f3-9b98-ce2e22a9e386", "comment": "Malware payload", "value": "2fabde11af93513d29b963650ab6b158942ccbb7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911532, "uuid": "8bacf74d-edc3-458b-a227-b421496d2139", "comment": "Malware payload", "value": "2a107217a0816d67a78a8ff1046c2b793d055a37c5240b634b5ed475067e4deabcec2945dd26f4e9e1aec97117960005", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911532, "uuid": "4a1f1d80-c90b-43d9-be90-d805d4f0e571", "value": "893302CFA044BA63C29F93015FA59AA316FC791DE170C15C8369C6F9E9836C1C43A9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911532, "uuid": "8bbe8b62-ad21-4801-b886-115841ab7e56", "value": "768:Jqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0CxfS:UxTuDqsF1Cnc3P57oj2+nC6uxkLlfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911532, "uuid": "f2e80208-4edc-4d36-9981-ed89fa23f578", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911532, "uuid": "e737b415-8f27-4fb7-aec4-5d2b01e008f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911532, "uuid": "b2ad193b-17a5-4ccf-86d7-5e9502ae75b5", "value": "catalog-894646242.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f2fee8-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911026, "uuid": "898c4a40-e118-4105-90ee-dc00541be3a2", "comment": "Malware payload", "value": "be01043222607c5f2fe4b8722fffb739", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911026, "uuid": "eb284e3a-b308-4a2a-8153-4fbf3d574cd0", "comment": "Malware payload", "value": "0f54d7ae9e354a01ad8af95e697b9533b2eee03e60ffd6dda416fe49024d0f42", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911026, "uuid": "dbb00706-3a63-4708-a93c-446a0e419a7c", "comment": "Malware payload", "value": "c44cc05f9636f8b9e9c91ac1facda64f98dd8f1a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911026, "uuid": "2265a3e3-c840-4529-93a2-b536040989ea", "comment": "Malware payload", "value": "971015d9e7b7510d0da94644b60c868b952c39d440a36e3cfdc35e4ce9a8d4d20bedf4c8f4d370f698f101b4364fc72d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911026, "uuid": "0817bc72-3d7f-45cb-9f47-a3875ec79c17", "value": "5133019FE048EAA3C19B93015FF2C69303FD795DD1709658C369C6FAE6836C5C02A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911026, "uuid": "03ec3590-eff8-4980-949b-2296cb7288ef", "value": "768:bqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0BCu/cf:exTuDqsF1Cnc3P57oj2+nC6uxkL0BCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911026, "uuid": "af9220ba-e5c1-4f24-ad7e-97250390e5ef", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911026, "uuid": "4509e6be-706d-4c5d-990e-9c1dd56e060e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911026, "uuid": "e4386c1a-7687-4367-aedf-3faebb92c641", "value": "catalog-525574650.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da33e7ab-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867303, "uuid": "d67f0580-e9cd-448d-b556-3d22280a85bf", "comment": "Malware payload", "value": "01eb24b6613b1da83f0790e297ad2fe8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867303, "uuid": "11283354-66bc-49a9-915b-5a79bc0ba43a", "comment": "Malware payload", "value": "0f66c4264fd5ed743d7103579a5e525beb59f17dafe997b5295e7a55affbc01f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867303, "uuid": "089ad595-ad6c-451c-acb5-5be5359f40ac", "comment": "Malware payload", "value": "8a61df0caa1d21b1f57bbec81266ca15e8a5d226", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867303, "uuid": "4b67ce63-4226-4807-8bed-01a5aa6e4123", "comment": "Malware payload", "value": "8940792e74ba960da1c923873ce9458b9a7ded2b0c43e032e2f87ae977f5b07eaa98c51cbf0fc023950f746ba23c4f5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867303, "uuid": "fcc18b46-caeb-4543-ac80-cf5554cd4ec9", "value": "C833E184EF5BF818DB82737BBC892F977EAB0274608DD45917C2349D0296E3356102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867303, "uuid": "ecff126a-325d-4b7e-abac-42fc95f91d3a", "value": "1536:0AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiqz+Zp:npoAnd9gucKC62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867303, "uuid": "9e59ae27-26cb-4f08-b019-458bb8f03edb", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867303, "uuid": "22935f53-213c-4956-b937-59786f2c60aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867303, "uuid": "68eef4ce-ddbb-48a7-bc00-84ecd9ebcc8b", "value": "catalog-1480072885.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612143bd-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873543, "uuid": "733ad3c4-2a38-4b96-82a8-d03b91e42a97", "comment": "Malware payload", "value": "def4d73295f20af46afa3192ae50d981", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873543, "uuid": "c8e8943e-248f-43e0-ab3e-c71a230bb53d", "comment": "Malware payload", "value": "0f7445c165bd4ce2136feadb787b73088f64fdaec05c4c2db0a857c936a03ce3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873543, "uuid": "344bdd7d-1c6a-4a99-b96e-13c2e07118e7", "comment": "Malware payload", "value": "8e0e9a7df6394b548ebf582c522b47a4618b4b2d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873543, "uuid": "f8d9b444-5a9f-45ea-b1f2-d1ee2b4498d6", "comment": "Malware payload", "value": "3afc270d4a577dba9ada9fa4d93134b6772f3f24bd64535cbc034310e8412470c64643f0023c6da62dc8a43537500f4c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873543, "uuid": "3c3473e5-90dc-4143-879b-6560c63737d4", "value": "893312B3E643B1AC7703C5CA49CC5E1B423B427057688EB1CA1EDEA192397161B517EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873543, "uuid": "fc0527b6-3cb1-4497-b52b-6c7ca188ad77", "value": "1536:lE/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexHlX:uXKAXh3TCdOi+KSZ4WUlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873543, "uuid": "aebd31ca-2006-4f55-8601-2571f9416fd7", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873543, "uuid": "aabeb1a0-9e08-4d64-9aa7-cb8595c75ce8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873543, "uuid": "0a192a34-e970-44cf-808c-67c3e030a1b6", "value": "statistic-2106778175.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c548de-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913121, "uuid": "869f453d-43c2-4776-b1a9-67468d33c3b7", "comment": "Malware payload", "value": "8c4d90704d213fc714964d45b9ad20b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913121, "uuid": "256dec94-74b1-4324-80e7-5d8dd6b7de3b", "comment": "Malware payload", "value": "0f805c5b50445e5afa4fb9818e52a5ddb48518f21ec38c19310f5e2021ad84da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913121, "uuid": "4f159f80-f356-4197-bc73-fbb2ddc4f9b2", "comment": "Malware payload", "value": "ab63e6e284d590e198fe0424a87a20bb9504031e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913121, "uuid": "f1197c96-0e04-4014-9636-9412d45bf63b", "comment": "Malware payload", "value": "1a0bdea59054cce0fe9aa977b4e5037674036d50ee030095afce02ba17b42f416b9ca1a5dbea9c1a3f9f2251802f78fd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913121, "uuid": "36c9a5ac-f97d-4bb4-a660-ace7e762c470", "value": "5933F1D233E3D13AC4C505F2E5275EDE65AB8ED9F420D4D02D8EDA4022D319AEDA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913121, "uuid": "690b2fbe-a976-4692-b83d-bc6161cdba63", "value": "1536:1EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciM7:qnBrX5Eg5Enjq3axWIfkNwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913121, "uuid": "1d346da7-a7f2-4961-bec6-5241ef27463e", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913121, "uuid": "f0fe7c13-f6e7-4b83-80d1-fc9991db8e70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913121, "uuid": "084e7193-8466-4aa4-81ab-17cdb6cfadb5", "value": "diagram-2026779823.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddb4d73-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873430, "uuid": "acee8502-4434-4693-8ab0-731e45e6a167", "comment": "Malware payload", "value": "ead2bfcb512a8984a43121d18d408d06", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873430, "uuid": "b4868096-47d0-4a25-bbc6-e33926d3e40f", "comment": "Malware payload", "value": "0f8407be7c1a6fb3d4f5e866277b12f35cf0646c505c1467355d467535e0b1c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873430, "uuid": "8c16ce31-5396-4eb1-a6c4-e1b9f048bc20", "comment": "Malware payload", "value": "6b1af3bd7c987cfa8eba1c7c693c1565c1f2103e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873430, "uuid": "c8994610-539f-4ee7-904e-40694256e385", "comment": "Malware payload", "value": "34ec26d585399a994bc66d4005a7208d4108dfad88489d241e388bfa85007eb4cdf82d309e5a41c3c626a89115194b8f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873430, "uuid": "92ab680a-8ff8-4530-b251-f00bfab02a21", "value": "F03312F3D602B2ACB64381494E8C5B479237817067595EF18219EFA1D33D7170B52E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873430, "uuid": "39a68d4b-3a2f-4acf-9582-21baa76c820e", "value": "1536:6u/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBDk:ZXKAXh3TCdOi+KSZ4WcDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873430, "uuid": "0a577577-b64d-4494-9b02-b06db807c4d7", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873430, "uuid": "256e5332-361b-4b63-a9f0-18117497afe9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873430, "uuid": "4263c171-3305-49e7-8cf6-3c6ea61d8aff", "value": "statistic-2026929927.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90416299-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871474, "uuid": "baeb8625-879b-4c66-894e-02433cb6bdcb", "comment": "Malware payload", "value": "e6917a388a8fbe19ab51d332e15399db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871474, "uuid": "d87a92b6-fe6d-42db-bf01-4eb9ae81a3e6", "comment": "Malware payload", "value": "0f849b72796f67881be64762ca0fed9991aeeace0bf599bd81f06358a734758f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871474, "uuid": "45c2d1ea-5d1f-4881-9705-f2eb86516aa3", "comment": "Malware payload", "value": "eac5f6e0d5c4cd2c5a2ffb5e52fa91ebde245f46", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871474, "uuid": "263b5f17-f82d-4e74-8dd5-bf4c98869694", "comment": "Malware payload", "value": "c8b0380fdff7a91ba45d764360654cf0e2cae9054f073ebcb0a4698f92869f73f7ba8e53d9a6a0ab50bc5f7927ef8d70", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871474, "uuid": "b100b61f-0b48-45ee-bd1d-2d1393cb8487", "value": "F733029673FEA910C9F1C2B0A4E27589374F3D924E7D5DEE4D88A0793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871474, "uuid": "8786c2a1-6a14-4432-9241-f4e8ae7d7b04", "value": "768:P5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJck:P/czJJSI7r3Pwh8fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871474, "uuid": "a9e572f6-972a-46c7-a130-5c6385343c71", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871474, "uuid": "029f30e8-6bbd-4da4-a409-56452e63d863", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871474, "uuid": "2d3d30ce-d887-44b8-81ba-dcad950d85c4", "value": "diagram-697608472.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b356f9-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914052, "uuid": "f7373757-b55f-46bb-b408-4275035e85a6", "comment": "Malware payload", "value": "c7d20780ba82903d832808c938c8e3a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914052, "uuid": "ec91d1f1-c5f0-42a9-b95f-2d629f422fdb", "comment": "Malware payload", "value": "0f8650dec844240f76bde151b115096faeb5bdd44c2393621e4588dc64a13c8f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914052, "uuid": "82247d57-bf4b-437f-8e0e-aee42d1536a5", "comment": "Malware payload", "value": "8a79645dc8bac701a7fd814f9589d18cf9dc7453", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914052, "uuid": "c6701e8e-1edc-4fb6-bec5-1b3af1c60192", "comment": "Malware payload", "value": "b4536b10ff50b433a050adbbbfdd5246e730ebc0ea5608f36e51add3bf0bbe39be6ad9536e3300ff255726c13f66265d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914052, "uuid": "f7007822-ca83-4e4a-83b5-80d15771b2a6", "value": "6733F1D232E6823AC0C505F5E52BADD656778ECCF030A0C05E5FDA4122E2165ADE279F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914052, "uuid": "3370b204-4c74-4be7-9740-dd15292637e1", "value": "1536:NEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwR2d:ynBrX5Eg5Enjq3axWIfkNwRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914052, "uuid": "d1684c7f-a1f6-409b-9dc4-20f05376793c", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914052, "uuid": "6b90b0d3-c3a9-443e-b5aa-4ecf0436a059", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914052, "uuid": "33d15bfa-80d9-4c33-bb69-a82b5ec104af", "value": "diagram-751557043.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db384119-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866875, "uuid": "7ff80415-0255-4825-924f-486d31f873bc", "comment": "Malware payload", "value": "4f098520d793886b49166159c7056676", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866875, "uuid": "f035e426-7aec-465e-8f49-d123f4e4eaa1", "comment": "Malware payload", "value": "0f8c6a5bcd1347d5e6cf6e47904d80229981f70428459b42a85d13c19cffd1d9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866875, "uuid": "4fbfce24-047d-41b1-804d-6324ff4fb533", "comment": "Malware payload", "value": "b4c6bfe14829f18de70c705cbc2abcec030400ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866875, "uuid": "a5a0e0cc-b9df-4fb8-9a4b-619744511a63", "comment": "Malware payload", "value": "901d1fc48d5d02d1d13dccccdabcb3c59373814c294667d123f53c6960fd03d834d5d0efa47dab57efc72bf6897ab630", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866875, "uuid": "e102beff-8cfe-4b40-95d8-5fdfbf6ccfcb", "value": "2133F184EF5BF818DB82737BBC892F977EBB0264648DD45917C230DD0292E3766102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866875, "uuid": "1c50a10d-326a-414b-a7b4-33bd3617075c", "value": "1536:dAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiqz+e8:apoAnd9gucKC6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866875, "uuid": "197833d0-d666-4980-a8f3-0f4bd046cedf", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866875, "uuid": "c55e3aa9-862d-4214-ba2c-29e25b414586", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866875, "uuid": "a78bbf96-5af9-4394-bb08-0e42ef8899e0", "value": "catalog-1157078179.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd72e30d-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914124, "uuid": "657060aa-28f4-414a-8818-e87063fdbcfc", "comment": "Malware payload", "value": "75daca0b2f32006d999b38c96affbbf8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914124, "uuid": "4611e54d-8a3e-4837-899c-c02cc699afc8", "comment": "Malware payload", "value": "0f9024c79340083cdd71ab6e318b6561ab1a11e06f38ff551d08c5b70b07058d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914124, "uuid": "a819a3c5-ea8d-419c-b3e2-05331a6141db", "comment": "Malware payload", "value": "b834b8d260090c31838cdf765e1727a0a1284f0b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914124, "uuid": "c3fe07ae-6cf4-44f5-8767-d37f1c42cdb7", "comment": "Malware payload", "value": "fd85036d1550fc832094ab9dcdbcb641c5f4c9ec7f38543b9b26fb7266e8f23a5e717042f3772c61a9bdf8b64b387c0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914124, "uuid": "57496963-3165-4f1e-8346-55f6e2ed5dc5", "value": "6F3302D232D7E23F80C605F7F52F5ADB16B78A99E83090C12E9EDD0112E3165ADA134E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914124, "uuid": "ae4943e6-7aa8-46f6-accd-1205c0b0dca6", "value": "1536:6EnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwnz:vnBrX5Eg5Enjq3axWIfkNwnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914124, "uuid": "2dcecf4b-744f-4da6-aec8-417ee3454c76", "value": 51756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914124, "uuid": "d3a994b4-1b0d-478e-9af8-f949b7454453", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914124, "uuid": "cfe34a5b-ce8e-4b7d-bc98-1b1bdc39beb0", "value": "diagram-795906552.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d429e83-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868892, "uuid": "b3ad2599-e885-4e44-be71-847540508194", "comment": "Malware payload", "value": "39305f6d9bb24b8d662ab7b8e435fa4a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868892, "uuid": "9ad4a9b6-8186-4e76-99fb-f02f97b58d99", "comment": "Malware payload", "value": "0f90e63f32d31a856b6de2b0cab24e1e9e8ee1f6c82c319c29db7b29aa78df80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868892, "uuid": "10e0dbc2-0a6f-455c-9b64-cce46bd68465", "comment": "Malware payload", "value": "7dfd15e1133d25a72d2f067aed87d112db955390", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868892, "uuid": "06bdf384-910a-4fc3-8191-7537314e48eb", "comment": "Malware payload", "value": "fb52703f51d40a27b813c48af73b403f4397d94537615209859f9e4b5203c33ee22b681d57321df99a7256fe242f385c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868892, "uuid": "30141f40-8c23-4a58-82b2-94b3d2b84a50", "value": "A533E184EF97E428C7C273BABC842FA77FBB0264148DE1D95BC2319C0196E67561426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868892, "uuid": "8ae0d890-f09f-45f1-b0b0-cc0f4f8026a9", "value": "1536:bAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVXV:8poAnd9gucKCoGVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868892, "uuid": "d4d6f8af-174e-4aba-888e-61c13eee151c", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868892, "uuid": "134b0522-b48c-479b-9857-ea9f5585e458", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868892, "uuid": "46045585-ec84-4abc-b3e1-72a61ea97a78", "value": "catalog-784019917.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca3279f-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868381, "uuid": "6fe36354-3c3f-4c91-b341-846601b46e89", "comment": "Malware payload", "value": "96eed3da4d87a9c03528ff7186286665", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868381, "uuid": "b67d201d-be64-4ff6-8582-cc8d8c3d2108", "comment": "Malware payload", "value": "0f940985f99041c0c867a08fe707a14a8976a781bdaeb40bca9d823933999b49", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868381, "uuid": "246af816-f4b1-45c0-b04b-b99dc160b332", "comment": "Malware payload", "value": "d798decbd56b73f99c6d5e9eeb9bcbe03ac3a6c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868381, "uuid": "fe3407d9-dfa9-4861-83de-24cb20c36c25", "comment": "Malware payload", "value": "9a9b8dc5b20df3d3b58f5e89e2919f02b15102d650c799cc829ea151c3327051612553d9a3b03ce002b8a19d2fbf5514", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868381, "uuid": "ac0e7f0e-a0e1-4da9-a83b-4a8caa02a100", "value": "EB33E184DF57F518CB8273BB7C882ED76FAB025454DED0995BC3319D0292E32561026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868381, "uuid": "2e819dfd-8c47-410e-aa99-5e5248a34aaf", "value": "1536:IAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqe:DpoAnd9gucKCIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868381, "uuid": "80e2fa2d-46e8-43ba-a4a3-81bd0a08b4dc", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868381, "uuid": "9298cdad-48ed-495c-b0ea-aa3509b81096", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868381, "uuid": "277846d0-2121-4b19-8d00-a0f2f39404b2", "value": "catalog-370846404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e49208b-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869135, "uuid": "bdb5e04c-de5e-419d-957a-11fda4602e98", "comment": "Malware payload", "value": "c684548aef312fc9915dc20f63823115", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869135, "uuid": "6d01fe58-494f-4687-8d3c-59fe8f1a4770", "comment": "Malware payload", "value": "0fa22de1e988fc39753185be6f3fcc545ab0ed08b76274faea91ae2f8f83bddb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869135, "uuid": "9b0eece0-f5c7-49ad-b31e-e2db5c84b841", "comment": "Malware payload", "value": "5274cbda4addeea0a5e0594214e602458fbab132", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869135, "uuid": "7a7600c4-8f6e-479f-992d-31776d1686ca", "comment": "Malware payload", "value": "28620b6d7995f91dbf227c56f396e650e80745b77b9daccfbebfbe8266d559a4265cb50c12c01b7ddf01df2715bc70f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869135, "uuid": "3bf67969-0bcc-43c4-8e7e-1d465510e965", "value": "C333E188AF5BF458CB8373BBAC442FD79FB7026459DDD19867C3309D01C3E6616142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869135, "uuid": "fb091853-4f8f-4712-ab02-51e51d907d69", "value": "1536:8AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSm:vpoAnd9gucKCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869135, "uuid": "8e697dac-9547-4478-817c-49d6cad78c09", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869135, "uuid": "aac3bb08-1a95-43cb-b939-374ad869adf7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869135, "uuid": "390147c6-c4b2-4e0f-9ddf-3d850d432205", "value": "catalog-979550674.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fbd73a-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913897, "uuid": "fc03f74f-90f8-4d0c-9bbc-c83e14566031", "comment": "Malware payload", "value": "6ad1f7dd283965f7c325948bf7fdde02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913897, "uuid": "0be6c247-94fa-4d3f-90c3-0321d383792f", "comment": "Malware payload", "value": "0fafb2eb6283b3e741ae0dd6ac790557961954ea5356945ffeecee311b208643", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913897, "uuid": "01f31619-a9f2-4309-af31-655aa9565edb", "comment": "Malware payload", "value": "5fdb6f34766463523f7bcea6ec80583b0286bf11", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913897, "uuid": "a89be106-e7a6-4e0d-8594-7e179c54e54c", "comment": "Malware payload", "value": "a5362f30ebb10abb060eaf04a38862f376b29b359a89b98f7034afc36e367f23f9cf47169bcfb7c912e82902f9253b95", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913897, "uuid": "311aba5f-4111-4507-98b5-5b4c7a0495fd", "value": "8833F1D132E7D13AC0C505F5F82B69DAA6678FCCE530E0D06D8EDE0122E3165AEA164F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913897, "uuid": "94c5fa4f-1255-4ec1-a5c6-9b448ba2c917", "value": "1536:SEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwwns5:3nBrX5Eg5Enjq3axWIfkNwws5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913897, "uuid": "01831cc9-29ad-4eba-a877-7b1c2c59ab7e", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913897, "uuid": "6d701e58-2166-4e3e-8d09-e82d77b945d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913897, "uuid": "734c2805-c2f1-4491-b417-7a53d0519a5c", "value": "diagram-634335833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5a47e9-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868055, "uuid": "4d08fbe6-b60a-4721-a19c-e9faa60392ea", "comment": "Malware payload", "value": "37b3b66e007c47817a2bd71098f45bf6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868055, "uuid": "6fc5eb53-b77a-4a42-964f-7bd7b97e4c86", "comment": "Malware payload", "value": "0fb67a7e300c59e8c373ebb49e417a1af49645d39eae296b85021007d4ef87d7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868055, "uuid": "077963d6-e340-4db5-a2f6-cd685ee4ed67", "comment": "Malware payload", "value": "bff075997efcf2fc617e47dc0e48612e8a8a8689", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868055, "uuid": "1151e7c3-70fd-4353-b885-c3153f16ead3", "comment": "Malware payload", "value": "40b22f5571c840de89d51d4218d0aa5326bad5797c8c35157ec94a47e9037d152e1c40694ffa33a547300b6121c6b5b1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868055, "uuid": "0429ffd2-ee26-4cdd-ae56-5814d0222d2c", "value": "3C33E1C8EF5BF818D793737B7C892F976FA70224658ED19857C3309C0292E6666102BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868055, "uuid": "3531f606-fc37-4dd5-87af-ea64445eb76a", "value": "1536:VAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrTPA:SpoAnd9gucKCfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868055, "uuid": "76cc5d9c-2d71-45c1-8998-48a218d8356e", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868055, "uuid": "ee724f63-4a01-48e1-a9e4-42195fbd5af7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868055, "uuid": "e4c14635-c82a-4cbd-81ae-fab1e2895205", "value": "catalog-207411385.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a99e83a-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913555, "uuid": "d323fd05-00cd-453a-8857-585af98a79c5", "comment": "Malware payload", "value": "f924359326b04d3883148c9e8871c231", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913555, "uuid": "00dbb1d8-5689-4f9d-ae76-8a741cb16763", "comment": "Malware payload", "value": "0fb813e5b3ae1fd69f49aca88c1289fcf6964cd5fbfbdb1cf277be4866363116", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913555, "uuid": "f9d32d7e-3d90-4add-a35b-06d504ad66ca", "comment": "Malware payload", "value": "08ee1590ecbd76367648818bfa5424496b62f756", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913555, "uuid": "b55053a8-cc19-406c-a3b9-9fdd2fe13f04", "comment": "Malware payload", "value": "50a5afa84850ed1d93879561e8ba97a2ae821d6c6930b04aeea377aa160d73cdae736427373e653a8e8ceac856baf818", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913555, "uuid": "f849e358-fc1a-4d94-b9e7-b98e95e6a3cf", "value": "2E33F2D232E6D63AC4C505F5F92B5AC962AB8EDCF43090C01D4FDA4012E31A6ADE274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913555, "uuid": "7051c14c-ec1d-4f26-9005-75bcbe4b9b2d", "value": "1536:jEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRSl:onBrX5Eg5Enjq3axWIfkNwRSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913555, "uuid": "c54fa431-3942-4f23-97a4-8c2a2ecb5c49", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913555, "uuid": "53e523c2-ee1c-4db4-bbd8-e8d109570a0a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913555, "uuid": "d111fea8-855e-4225-9768-e02f9cf2f811", "value": "diagram-404448223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d635540-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868919, "uuid": "138fe6aa-6c5f-4aea-86d9-43122b198b54", "comment": "Malware payload", "value": "6e3647744412b14fe9b38c38dffde8f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868919, "uuid": "0fe9ee63-35e8-4885-bcf5-7c51f0180fa7", "comment": "Malware payload", "value": "0fb9cb0ab23ce2fd5a13022bd781b80ce74b566ebbc4de088d6224f0b4592001", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868919, "uuid": "d6696bd5-13b2-4376-94f8-5d98ec5d3624", "comment": "Malware payload", "value": "89054073c0699f3a124bef4e6edcb9f2f9b5ef05", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868919, "uuid": "786fdb59-d508-49fc-8ba1-19afc4d54e89", "comment": "Malware payload", "value": "b0ffe838412674ff10d00a6a9be097927cdeb552fad7676e9777a22715f206c749607459fbc77ca7f4eda61ef6412898", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868919, "uuid": "0dfbeaa1-2137-4615-9964-6c35c07fcd81", "value": "0133F1C4EF5BF858CA837377BC882FD66EAB125064CEE09597C6309D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868919, "uuid": "b3738191-8555-4416-b6e8-83ad3dd8a245", "value": "1536:rAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3jJ:spoAnd9gucKCQaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868919, "uuid": "3ff55649-d7f9-479f-b36b-bcc8df0f43f7", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868919, "uuid": "da770786-5d1e-4f19-aa10-342ea8dd1cc8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868919, "uuid": "52123144-166a-465e-b029-a91b26df007f", "value": "catalog-806438825.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27526f75-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870010, "uuid": "ee75af0d-7115-451a-8722-e0811074932a", "comment": "Malware payload", "value": "e0445ae9bc5e67ae8135f52b71fbc05f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870010, "uuid": "76b29288-4318-4818-b7c4-12afe28d64c0", "comment": "Malware payload", "value": "0fc88a16fca1d1443068008e92b6287c179d55ed06c4b14d1d749d0001dbf1d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870010, "uuid": "787e795c-374e-4e7d-8d8e-bb759321cc81", "comment": "Malware payload", "value": "d4790b8d03160b809bad4636f5125425cd9567ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870010, "uuid": "9197d5b1-dce8-4d9e-bd03-dfc813a46ea1", "comment": "Malware payload", "value": "911bc94e7572240ec78136be4613ac9740b000aa3b7e8b7df18fa5812d6ac54971b7a1bde6fca2c6d5904fa8ff12a020", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870010, "uuid": "c993eee7-6527-4e43-b003-3621df4e8db4", "value": "A333F19573FDD510DAB1C2B0A093B6893B4B3CD28D6D59FA0DD964A93F920A4CFD22C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870010, "uuid": "68f59c1d-9e61-4645-8a1e-df5ca09c9a53", "value": "768:G5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8nPmGZ:G/czJJSI7r3Pwh8tv8x8ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870010, "uuid": "0d47b02f-06b8-49b9-b771-33fe1432e493", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870010, "uuid": "b0b62b86-ca17-414a-922f-3a8b142c0bfe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870010, "uuid": "d9375202-761c-43c6-8651-fd197c2d6b71", "value": "diagram-1587386502.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee3714b-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872519, "uuid": "8630935c-e65f-4596-97f9-d0fa6d706032", "comment": "Malware payload", "value": "e91a571881b76ebf92959bf781b89ea2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872519, "uuid": "8b27ba2b-27ec-43c8-b595-cd96d083f5dc", "comment": "Malware payload", "value": "0fcbcd1a47cb2f2f727a4c943243229a0d385f75d1cbac4d3af69c29323c2f58", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872519, "uuid": "9b28c194-9a6f-47c3-be7f-39cf95855931", "comment": "Malware payload", "value": "f2cdc6a935824c50dcaa0cc5a29f645408102b7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872519, "uuid": "bf9d16b0-9c85-4cb0-a813-ccde7c8fba26", "comment": "Malware payload", "value": "ed2a1b5981c56f64c0476ff8355267f7c44dfcf5c2a4ad7dce67cdaae4f765e27c6cf19178c7c99176a74a025888ec6a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872519, "uuid": "0e115098-f166-467a-a7df-8871fb86ae00", "value": "733312B3D202B2ACB64381494E8C9F47923B817066585EF18219EFA1D33D7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872519, "uuid": "16b024e0-5f18-48ac-be37-4b8890da9a8f", "value": "1536:My/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBxK:XXKAXh3TCdOi+KSZ4WcxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872519, "uuid": "7379361b-2fc0-478d-8111-d9bcfe374b98", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872519, "uuid": "d431860f-41c2-4fc4-9e1d-a49f2c4c9b4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872519, "uuid": "93d24b0d-2e2d-4dfe-be4f-8adb185984da", "value": "statistic-1500200808.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ec2c16-b3e4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620907858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907858, "uuid": "be4996a6-9a8f-4354-ab68-eba106a7f89a", "comment": "Malware payload", "value": "4380cc8844ef6335abb5a13352ba18ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907858, "uuid": "0ef8d966-f501-4803-990c-6100dce446ea", "comment": "Malware payload", "value": "0fd398a019936f487fc831d48a3786f76348090374b6805d2b4b74f02cbd75cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907858, "uuid": "d885dd60-74f5-40f2-b498-752141e0cd7c", "comment": "Malware payload", "value": "ec32c90e8056472d9cb4a320d3689f2cb9c210cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907858, "uuid": "52190fdf-b82e-45e4-affa-b1fd0f025c46", "comment": "Malware payload", "value": "33dd954afaec3e0b55fae0c6259c3e86c6dba4968eb830a35827ad64825f9ec594045524d2f5282933c5c3276618d3e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907858, "uuid": "e4c6047b-f2e1-4448-9a57-449e683792a2", "value": "82349E045F24C956C1378970ECAE8640912D8CBA2D39BED668B6358D5DF6BBBBC03173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907858, "uuid": "0d74de0d-4f96-4130-ba00-96ce9dd5566d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907858, "uuid": "9a0b13ac-696d-4da9-b7e3-e28e39cb6929", "value": "6144:RCmnFFn2rhh/m0ZBYGXEZUMMMMMMuMMMMgMkpB:RnGrDjZaGXEZUMMMMMMuMMMMgMkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620907858, "uuid": "3cc08bd1-97d2-4618-90f9-4b617a17c33f", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620907858, "uuid": "e4a54fce-8d30-43d5-9fbd-1287bd6e92da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907858, "uuid": "917005a0-05d6-47a8-a0e0-d3431f0d4bba", "value": "4380cc8844ef6335abb5a13352ba18ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47ade38-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873360, "uuid": "f276ca65-bf38-49b3-890b-92f3a537e1e0", "comment": "Malware payload", "value": "5375b64b0ff1d45751d64c76c6465447", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873360, "uuid": "f5d91598-8566-4de6-8d58-58c5f438891e", "comment": "Malware payload", "value": "0fefb90fad8063895afaa6337eb7718f1fbcafad834a26d711d6a4bcd7b840c1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873360, "uuid": "87702a5f-b6f8-44ac-b6f7-7347a113c86a", "comment": "Malware payload", "value": "c6e815b3d5648290ec374720975c92cd1192325f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873360, "uuid": "a0c7efca-7872-44c5-a816-805f65fd3a46", "comment": "Malware payload", "value": "b220857a64c4544cf39d23b13206bb47fd641eef9c0914ab06973f8902b72abbd1dbe3514ae1246ae44835d29e59b1ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873360, "uuid": "f5a727a0-0886-44f4-9e96-b16775b16c02", "value": "BF3312B3EA93B1FCBA43848949CC5E5B423F42305658CEB1C61DDEA6933D7160B417AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873360, "uuid": "d325f081-8437-46f8-8ccd-24714755d43a", "value": "1536:q3/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexHm1:UXKAXh3TCdOi+KSZ4WUm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873360, "uuid": "08123643-b526-4ef1-830b-7f535b6378a0", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873360, "uuid": "1bd906d6-5d54-4bd6-ac22-4f7f0cebb7f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873360, "uuid": "0ce4ff26-21b0-40b4-a9db-9236146a5fea", "value": "statistic-1980306855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc30086a-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867736, "uuid": "4ea4ccbf-5f0f-4e58-bd8e-e10691bd4975", "comment": "Malware payload", "value": "189c6a3a9a9fbceffb744e3e92262433", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867736, "uuid": "51163d0f-3b25-4eb3-b3df-71a284f13acf", "comment": "Malware payload", "value": "0ff23297e792ddcf200b6e211763bb776e19f91fa91df0b577149849245c3546", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867736, "uuid": "4b3391b5-6412-44d2-bb6c-343e1c34d9a9", "comment": "Malware payload", "value": "67f9feb9d6194ee6abdb178156de995207f9f529", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867736, "uuid": "f222c79d-1792-4be2-8651-bc02338b83d5", "comment": "Malware payload", "value": "2dfad23edff965682edafb77191a95e0d415c5c50015b06981fc166b77eb443779803ecd9f0b1eabdfe10a3987b8aeb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867736, "uuid": "24227f2f-d9c0-42ba-bbf3-7d6112b9b75e", "value": "7C33F184EF5BF818DB83737BBC892F977EBB0264608DD45917C234DD0296E2766102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867736, "uuid": "a0683c62-a633-4852-a067-898950ccda3a", "value": "1536:sAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiqz+Rk:/poAnd9gucKC6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867736, "uuid": "374cfcab-c5c3-4ed3-aa69-3beedfd9c567", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867736, "uuid": "a2496d2d-84d6-41ea-9533-77f45141de28", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867736, "uuid": "a8cc8cf3-a3b9-4d40-8654-92f7afe641af", "value": "catalog-1832127608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8adef3c-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896855, "uuid": "66ab1a09-adf8-43f8-b339-70e59b967b41", "comment": "Malware payload (Dridex)", "value": "a04307b70360465ea51ac8bc4031460f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896855, "uuid": "7e70d17e-7cb0-4fcf-8dbf-401652b1b307", "comment": "Malware payload (Dridex)", "value": "0ff575b3c70ffcbc93571053992f9e16cc5aacb2015940d3f65166fcf49bfe6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896855, "uuid": "b909b249-6a4a-4f13-af6a-714c993399a8", "comment": "Malware payload (Dridex)", "value": "fa763f505a89a23717459d9cb153d53ece901201", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896855, "uuid": "250ed693-3b9f-4875-be7d-12770dd2c96d", "comment": "Malware payload (Dridex)", "value": "a585d90ed834818f459372054a41d83f23dc4202b107d7e34f7487837a042c40e27cd09b9e7df3fa395b716a00672a35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896855, "uuid": "ef7f0284-799d-4817-993d-cc6453905378", "value": "13F3AE93E16FD1E4F6234A3040F5F47B7A7C248B86389D28C7408E7E95EBE29C06E615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896855, "uuid": "abf69bd6-f885-4a35-a686-521f33b5f9c9", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896855, "uuid": "26ce4c7c-35b2-4f9c-9796-035f814d612d", "value": "3072:T3b4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:T3XvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896855, "uuid": "9d1dee32-0866-4eeb-9cf0-3bd57c6b0dd0", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896855, "uuid": "f3cdb99f-d573-436f-b0b6-4ca35de96d74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896855, "uuid": "dd5e799c-5531-4080-bc1d-965e36bc0d71", "value": "a04307b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a924bda-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870847, "uuid": "8e393697-c323-4198-ab3f-d519698c444c", "comment": "Malware payload", "value": "bd4e868463c1ea452ebda9c19426414e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870847, "uuid": "a22f16ba-2ef8-4fcf-810a-9531b54140f3", "comment": "Malware payload", "value": "0ff5af8d12735c30bf9733d29122fdf6df071232ab44afa6970100295fc07819", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870847, "uuid": "24f13761-47fa-4cd5-9349-94d65e73eb3e", "comment": "Malware payload", "value": "60bd56929398d53be8edd2b81e0062cf3e3d5b26", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870847, "uuid": "243cca39-f3cf-4576-b5fe-d31a7cdb2e19", "comment": "Malware payload", "value": "d275e35bc3703aea043c94cf4d8013e17b3625728ed343854eedc1425bc6925d0b939a3825fdaebea838aa8ec9ad476c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870847, "uuid": "c1a386ee-99e9-4318-930b-be9de7dd27a0", "value": "0E33029673FEA900C9F1C2B0A4E27589374F3D924E7D5DDE4D8894793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870847, "uuid": "4867e0ea-382d-4fbd-a853-4ed403a26f0c", "value": "768:I5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcW:I/czJJSI7r3Pwh8fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870847, "uuid": "29cc6e0e-7146-485f-a936-31299e296347", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870847, "uuid": "a31c5463-920e-4292-a0c6-a004f3ec784f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870847, "uuid": "5c336e67-1688-4bc0-a91d-9525a24c7404", "value": "diagram-257465583.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4527187-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872501, "uuid": "0b9378eb-a3a7-4aff-82a1-1c193febdd5a", "comment": "Malware payload", "value": "87d6c5f5921e19935cd8529593496903", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872501, "uuid": "b6ce4137-586d-468b-9a46-7bca602e4e08", "comment": "Malware payload", "value": "10087f343eb242b87fa0faf94f310fd7e10d2ba0d85daff481c2c1622bbd7fba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872501, "uuid": "40c44055-1427-44af-8a22-13afb3e83872", "comment": "Malware payload", "value": "e2a863ae21ed752a2afb29aafe195b2e5eb3a2fa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872501, "uuid": "7c8e9e86-51f4-4d61-ab9e-ee7b3dece353", "comment": "Malware payload", "value": "d7402557fcb80d9faf4ae3b8d4493deaed8680ebbc6c095e0cdc77edea96fb3a9cd61d7b757ed0fff4589bff96561220", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872501, "uuid": "9ff901ee-08a6-440c-9c54-06d54dfb680e", "value": "083302F3E643F6BC7543818D4BDC1E6B423B4220525D8CA1C55EEEC2823932A0F51BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872501, "uuid": "b47da0c9-7cc9-4759-b55a-1c08523e62a3", "value": "1536:AJ/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMu:0XKAXh3TCdOi+KSZ4Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872501, "uuid": "a0236d25-1579-4944-a189-aa45c79e921c", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872501, "uuid": "dfa386d8-0674-444d-9b79-97eb17ce19e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872501, "uuid": "25853dce-2d6b-4c04-a35d-2cde0aafb0d2", "value": "statistic-1488730440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea3c4c1-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909724, "uuid": "fa1642d2-4e6c-44d9-bbca-648409188e6e", "comment": "Malware payload", "value": "6fa5bf74da529a42bfaaaefc6a005abc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909724, "uuid": "9c1ed267-a161-45f8-b337-4bb3ae9dd576", "comment": "Malware payload", "value": "1014a62bca210edf67285476931c08cc8e1dd3cf76efd93e59c59ac3e6f104bb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909724, "uuid": "e5e3cd83-4f63-44b2-8c67-b09285460d24", "comment": "Malware payload", "value": "723350096f42c8819e3bac1824e0c8c177801d72", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909724, "uuid": "c54af6b6-c7ea-474f-9e89-2e390791c4f5", "comment": "Malware payload", "value": "0f6c71e993dbfc7d6c0b6972bc9d9b9c1daf8f0f6b5857e0c76fe4db236a823a93259f2b2049be08752f635928370a65", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909724, "uuid": "94fb21bf-7dcc-4b94-a874-b5d97cf30c5c", "value": "D83302CFE044AA63C29F93015FA59AA307FC792CE170C15C8369C6F9E9836C1C43A9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909724, "uuid": "0fa506a1-626f-4232-b239-170ef7da56d5", "value": "768:aqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0Cxfn:bxTuDqsF1Cnc3P57oj2+nC6uxkLlfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909724, "uuid": "122d55fe-d934-4e33-be56-1e878ccda446", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909724, "uuid": "6fe07b79-8b06-49d6-a981-e90a14ca5426", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909724, "uuid": "e818d6af-f37c-4a66-8f0a-45affc7adb10", "value": "catalog-1453784264.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0a0ad9-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871175, "uuid": "528b3485-6526-44d6-b02e-39786af94de9", "comment": "Malware payload", "value": "4814aa05f02c1fadeed77de543e245fc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871175, "uuid": "82848e48-7ac9-43ba-a58d-5c50d5461c66", "comment": "Malware payload", "value": "10161c90deda352431e0e8f516b8f8fbfb6f0a15e25a0af9af6efdf87d1c6900", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871175, "uuid": "43f8500c-6dcc-4d74-b03b-aebe0034da8a", "comment": "Malware payload", "value": "0c9fb9fe417980682f83e6ef0cf6678d6090b7ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871175, "uuid": "59ce0c44-32ab-48d6-816f-f4d8a97c0770", "comment": "Malware payload", "value": "8f5218ee26e08f4dfc86dafc4319ffa9eb1b74b073a18c8afd827774481624ba29614b4aa35c8606038f8337bc85adbc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871175, "uuid": "21aaf251-0453-4105-bd67-a4004373b8c0", "value": "6433029133FDE510C5F2C2F1A1E27288369B3C618DBD99EA09D865653FC21B4CED52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871175, "uuid": "4b0f1627-89b6-4bcc-9712-f8ca312a6396", "value": "768:Y5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ4tbBc:Y/czJJSI7r3Pwh81tb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871175, "uuid": "2e04c93f-afec-48cc-bf5a-e7b8b0ca3b4b", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871175, "uuid": "be807716-b220-4e9d-8127-24149436733a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871175, "uuid": "8d96bbfb-65bb-4189-9c91-b4cadf508c93", "value": "diagram-479002039.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5f5d65-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867230, "uuid": "8f3d0e98-3895-49df-b9ac-4903eba5cf78", "comment": "Malware payload", "value": "e9a3cbf60d6017ddbe1473a7faf00d27", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867230, "uuid": "a984e256-87e7-46df-8ae4-55f5278c9aff", "comment": "Malware payload", "value": "101bc126a9b6da1e829b3aeb2065a026e4b1808ea386c50ead00b41bb5af0685", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867230, "uuid": "a2b15bbf-a391-4fb3-89ef-7f7296312b50", "comment": "Malware payload", "value": "2098667694baf44af66b6dd2547f1014fe164d2e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867230, "uuid": "69dae65a-b545-4aeb-8383-052135405286", "comment": "Malware payload", "value": "3611dfa43c09d8b92b0377299fc424afd9e8d75dd713256b5a340feea54997e8f3a046be184b6a49fe37ce55239dd53e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867230, "uuid": "9778b6ec-ad22-41ee-a9e1-23de12cd59ed", "value": "7133F188EF57F418CB93737B7C8C2F976FAB0254648EE19517C3319C0296E6266202BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867230, "uuid": "fb1a34aa-089f-4cb4-b665-9385176e3450", "value": "1536:8AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrNS:vpoAnd9gucKCfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867230, "uuid": "07294192-7a15-4d33-b945-1f5be56ab566", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867230, "uuid": "28b03ec8-68ad-40f8-ab54-79575cf3e6cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867230, "uuid": "ec3fc18d-a15e-4b15-8207-4a66b97aeb80", "value": "catalog-1423620806.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11afeb49-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911635, "uuid": "9288dd58-554e-4044-a7ef-5910fc798d64", "comment": "Malware payload", "value": "0c93c4bb6680cd628c952d84a45defbe", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911635, "uuid": "d9f372ad-4648-4627-9537-9a05ba8e37a8", "comment": "Malware payload", "value": "10252437b99cf09099b9dcf122260aff8c61a54f28fa4f11d6181f1678b41ef1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911635, "uuid": "66b86be0-983d-41f9-9f4e-b9f240838bbf", "comment": "Malware payload", "value": "ebc7740156ee71e2f275bae30564186e1dcd467c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911635, "uuid": "af92d66d-dab0-4bb0-9647-db03cda0c26e", "comment": "Malware payload", "value": "8f36ea5c0b44683fea6920a9f7a7995fa5206e32efbfe843d446ac926e897a343b08435f43027a8e81211a227c52b91f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911635, "uuid": "1d27d4c1-c71d-438d-b4c2-951829cb0398", "value": "AD3302DFD014A9A7C39B53021FA5A6A606FD760CE23092A49358C2F5DA836D3C53DCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911635, "uuid": "8e8de26e-0cf6-438c-8cd3-54b6b42e66fc", "value": "1536:xxTuDqsF1Cnc3P57oj2+nC6uxkL4yx2v5e:xxTqqsF41j2Pxm45vA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911635, "uuid": "4ecba410-ab99-4f6d-bb02-cfc3dd9cad47", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911635, "uuid": "108f21b9-eb00-4331-ab9f-f8a4d2301c71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911635, "uuid": "8c2a06c7-907c-4f36-9fe5-5f026497a6f8", "value": "catalog-962966519.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a3920e-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896777, "uuid": "4e9fa047-8c86-41c1-afa0-0aea03ae43e8", "comment": "Malware payload (Dridex)", "value": "12aab4771ea41480fe998ced778db144", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896777, "uuid": "57f7eddc-a7d4-42e7-a89d-0013ba0226fc", "comment": "Malware payload (Dridex)", "value": "1028dd24dc5ec1136b8d552aa394940f9398f053290c2f273d6a7cc5089da551", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896777, "uuid": "5e2cad3b-607f-4427-8b15-774a1c696af8", "comment": "Malware payload (Dridex)", "value": "d84f5930ea627c136e670e309392cca67f2dbe9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896777, "uuid": "d1e876f6-5378-4781-9cf8-f9b76959a08b", "comment": "Malware payload (Dridex)", "value": "e168e299314a8f47f1ce7394c910e3c3f2a88e4ca167f37dd02cf3ecc626a12e9eecde3abb45c13575b941000615ec7c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896777, "uuid": "03f95ac0-1066-46d3-8d8d-d047db5611e2", "value": "B8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896777, "uuid": "471e2d5f-d3c2-4466-ac4a-0b9399ad8d0d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896777, "uuid": "a82b4ee9-3937-4d64-bdde-a6a9a72b3a09", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896777, "uuid": "1926ab73-5331-406e-9664-e9a4b88cb8b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896777, "uuid": "17f8c5c7-1fc4-4a22-afb4-3b456f88fbcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896777, "uuid": "43552cd0-c064-40d5-b0f9-20b50d30101d", "value": "12aab477_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ece35b-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914536, "uuid": "f3641b40-5fe5-4f4b-9d7d-6fba921b26db", "comment": "Malware payload", "value": "8316adf340c6a2c1e72a0b20089bc310", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914536, "uuid": "bf600cbe-50f1-4d8a-ab3a-0a39a67a7e1c", "comment": "Malware payload", "value": "102b7564d3949ffad4e826706b7279ba2bbf34f25bf3c3dce7c7548eda002843", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914536, "uuid": "ccc0b5e7-b98c-4808-ad58-0e05ca8bc421", "comment": "Malware payload", "value": "b1edf5beb46ed7263c33357e060ba042d0486ae1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914536, "uuid": "d200ff80-c371-42a8-bf57-df9c48c89c15", "comment": "Malware payload", "value": "73e0babbff220c026d9f175e8eae33b921b7c10bd77a2f2caf814a1a05c6f9943745c3e7528bdfc3c6104972afdcbb72", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914536, "uuid": "6f52ea18-28a6-467f-a228-9f365a121a13", "value": "E03302D5AA13F8D38AFDFEA308992394635ED49D35143C995C3B298144BB1A580D37C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914536, "uuid": "3d553080-7338-438c-b46e-cfd9b319911e", "value": "768:xo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SXAjMxyB:LeKCVQbp4LTaI7ZaiNQMIXAo8wCTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914536, "uuid": "22077f73-44a2-442b-a4e8-ca201baf730c", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914536, "uuid": "9e328c2a-339a-4dd2-8a92-41b84507ea61", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914536, "uuid": "dbad0fb3-9fc0-46cb-898a-5be3f2fdad1f", "value": "statistic-1113569881.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63ea6b8-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911454, "uuid": "a2c39002-621d-4a3f-9c17-2e2bbc33160c", "comment": "Malware payload", "value": "4e44f9c3822cdab3af463fe34295fd2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911454, "uuid": "1e253503-32c9-42d5-8148-3f0f353d6cb2", "comment": "Malware payload", "value": "103db0cd2a844410d81e2cd191fc27e7c9cc4f1e5a5fc5ff75576d2974622932", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911454, "uuid": "4cebf1cf-ae89-4e75-9070-3e0ca0da8431", "comment": "Malware payload", "value": "b0e244225dbab218fc1240b48009f12d851939f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911454, "uuid": "40f91cbf-b77b-4adc-9641-45349325edc7", "comment": "Malware payload", "value": "e858086830f2afa0bc889543baec393ef8c0d22051cc0913f9270c472641971a0e33500f7f23812d0f6949f1989d7ac1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911454, "uuid": "c510ec0d-16cb-48a6-b4d8-095eee9c4a43", "value": "883301DFE415BAB7C5AB66014FA59AA306FDB54CE0308628C754C3F8EA835C2853A5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911454, "uuid": "8cf5a8fe-13ba-4219-827f-7eab754f530a", "value": "1536:5xTuDqsF1Cnc3P57oj2+nC6uxkLiO9ZrC:5xTqqsF41j2PxmiQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911454, "uuid": "77032e81-3c76-4f2f-9160-7aaaf8c0f948", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911454, "uuid": "099e0780-5b5e-4bb4-b521-1c0cec0a4a6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911454, "uuid": "eddc23ed-330a-49f8-bba4-7d5a7f899d96", "value": "catalog-847829003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13787f11-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915073, "uuid": "8674f878-d98c-488f-8030-fa360520220b", "comment": "Malware payload", "value": "d0fbc8d95511de40d6fd4be25faaafaa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915073, "uuid": "6740440d-1210-4f9f-91e2-0ad093f5fd7a", "comment": "Malware payload", "value": "105a942542d9cbeeb2e8391b87fb50c98ed230f5860c2749050953c62f39f558", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915073, "uuid": "7da4ecab-28de-40c4-9fec-abeb06b68599", "comment": "Malware payload", "value": "04c8590817cb98f4c0266c30e0b9b35a1a14ba9c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915073, "uuid": "9fc7a1a1-b5a7-4b82-82c7-765c9a867284", "comment": "Malware payload", "value": "a9261bdaa0d9696c27382cbe37c050f99e45ae4cc4c120f8298622ee677f77437197e534c362a4586b0b26db4cab5ef2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915073, "uuid": "0f22233c-4037-4ff9-aae3-a25296e96e18", "value": "9B3302D6AF23E9C28AFADB670C5512E4936FD89C31143C59192A299380FF158D0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915073, "uuid": "8fcb1145-09f8-460a-9797-cfebd08142b3", "value": "768:no4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6F01:deKCVQbp4LTaI7ZaiNQMIXwFhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915073, "uuid": "f6728802-d9e6-4336-a5e4-a846e8ae23d0", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915073, "uuid": "48258c4b-e8b9-4660-acb6-d6d2f662851d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915073, "uuid": "76bfa0de-09b5-4342-8a7e-04e72deafcc9", "value": "statistic-1514180608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2add0466-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910388, "uuid": "389538c1-1b4c-4299-a563-623c2c42782a", "comment": "Malware payload", "value": "83cb1e0139cf6e9e909a0430c05abb76", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910388, "uuid": "28335631-64b4-49ee-866c-0598da427c44", "comment": "Malware payload", "value": "10646863f976849aba749fef298a3cfa7f33c54d71773a323dd36ed0ed4db4df", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910388, "uuid": "5fe3ed84-2f07-49c3-aae5-a409c61612e6", "comment": "Malware payload", "value": "b42cc09d8d053e2736d96a2a26348e8322a9393b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910388, "uuid": "ed2b68ef-39c8-4ca1-9188-378a973575ab", "comment": "Malware payload", "value": "4e983c4ec1b7090cbc6bd7a7e0508ceabf5ed6b824b3717767694bfbe5b9dff5c68119452e8d678783b8ea8d8aee5500", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910388, "uuid": "0072fc40-8279-4922-ab50-02abbc3a1628", "value": "4433029F6054B9B3C29F87016FB59B6306FCBA0DD230D158C35AC6F5EA836C1806E8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910388, "uuid": "54f35c98-1e09-49ef-85d9-30421c3d4e47", "value": "768:Tqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNqy:GxTuDqsF1Cnc3P57oj2+nC6uxkLTNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910388, "uuid": "812960bb-7716-4252-b97a-8424ed336c50", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910388, "uuid": "5a01e723-51ac-449e-b425-629097bb3815", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910388, "uuid": "9f8a61ac-ae80-4c98-ba0d-fd15a66d9d17", "value": "catalog-1971540817.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf32453-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867201, "uuid": "61bb4054-3227-4584-bbc0-039c23e693cd", "comment": "Malware payload", "value": "f504afa10d0b99d876097b33883e9879", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867201, "uuid": "644a5e54-5d97-4e11-8b3d-a27fbd3e51a7", "comment": "Malware payload", "value": "106a7706126eac79c025186cd7d533d98d87b704b2fe9afeac87022f4d13ad0d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867201, "uuid": "199fa894-77b1-443c-8415-4e066e17d1b3", "comment": "Malware payload", "value": "99113f5a84b6e31603910ed566fc43deec5e839a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867201, "uuid": "2e9a2c4e-53bd-46f6-8074-56b26d233096", "comment": "Malware payload", "value": "44ee52ac284f1e54419986ec496f4516ce632bc6b9b875f68ae7e3b2522c7a104e56ebf2ffafc92f577e657eeac41940", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867201, "uuid": "6c8f691d-5c51-4bc3-997f-498e527dd8ba", "value": "AD33E188EF57A81CC79273BBBC842F976BB7026454DED59967C2308D4287E3356102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867201, "uuid": "5d22c01e-8396-4dfd-bd5f-6096587a10ae", "value": "1536:pAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqk:epoAnd9gucKCIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867201, "uuid": "5500203c-0f7d-4bbf-bd52-34d9c7275106", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867201, "uuid": "0379b986-aa02-4a61-8aa4-b52614ea681e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867201, "uuid": "960960d9-6870-4df8-bbb7-ecd818683dc8", "value": "catalog-1407050581.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6199d362-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870537, "uuid": "301a3ec6-11b3-459f-b136-bffc0cfcaa53", "comment": "Malware payload", "value": "8e15ba9448915678d2601dc6438b4400", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870537, "uuid": "27267e31-76a6-4bec-a126-c995d87597e9", "comment": "Malware payload", "value": "106cb32f7736c08f1f7ba7530d2bf88fc1892f491818e02123ffe5f79eecfe06", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870537, "uuid": "1e25318e-15d6-4348-913b-ee34c6f24849", "comment": "Malware payload", "value": "ee2c573dff69521e42b91a1beeca7f7fb81f32ed", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870537, "uuid": "ced71f89-dd4e-4c2a-a145-4eec302efe7c", "comment": "Malware payload", "value": "4aca6b57e5585df37a4c2fc155734a756ebb7b0eb3329b7515412dff82c8891d0b162b620e177d374c44c17e60fc6e91", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870537, "uuid": "331c901b-bf5a-4ffa-9b6a-2fe3741042de", "value": "9D33029673FAA900C5F1C2B0A4E27188374F3D928E7D5EDE4D8890793B920A5CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870537, "uuid": "6d9fe0c7-22a9-4dd9-ac4f-222da676e7ae", "value": "768:V5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwI:V/czJJSI7r3Pwh8TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870537, "uuid": "96da714f-c895-4775-9cf5-87ea70c152b6", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870537, "uuid": "02ab0b94-97af-4870-9a78-7da82dc715ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870537, "uuid": "0e34ce09-cf1f-48e1-a98e-fbcdf12eb5b3", "value": "diagram-1983436685.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d87815b-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909104, "uuid": "20d4f3b4-b532-4ed3-8775-7b47ea5de51f", "comment": "Malware payload", "value": "1f33a2b6f57118743af2764ebf96c74d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909104, "uuid": "235d5d4b-f589-447d-ad53-f8dc27abe439", "comment": "Malware payload", "value": "107ebe13cd832cf9baae2577bfde2abd78f86ef99acf0fe71bb8de8faa769dd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909104, "uuid": "6398d52b-3ae3-4f98-9a6f-65d11385bbf1", "comment": "Malware payload", "value": "6f1d67696b076502bab3bcba1af24c72d3319301", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909104, "uuid": "62ba3a52-af81-4529-bb6e-0c9dd13e6222", "comment": "Malware payload", "value": "1f85e3e416f8b03cfd9e7866916e2f0ba7ca48f7eae857353228751803fe3bf334f8e48a6a8a777eae2ea3e9f8368e0e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909104, "uuid": "dfa606ad-ca3e-403e-bb07-a4e86aea2097", "value": "9C3302DFE014A9A7C39B53020FA5A6A206FD760CE23092649359C2F5EA836D3853DCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909104, "uuid": "248ee748-1a6b-487b-a1de-9952f3ddc5ff", "value": "1536:mxTuDqsF1Cnc3P57oj2+nC6uxkL4yx2W5A:mxTqqsF41j2Pxm45WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909104, "uuid": "3e3f0c1f-75dc-4655-a101-660305969828", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909104, "uuid": "d84f08af-bf54-40e2-b6b2-9330c230317d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909104, "uuid": "0f8a0f71-c7c4-49b8-ba7a-9c7faf07600c", "value": "catalog-1130931223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb97fd13-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867279, "uuid": "361c3480-3b56-430c-999d-0724611322a1", "comment": "Malware payload", "value": "dc79e054592ecc32a09739f8ddc855c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867279, "uuid": "924229c4-0696-4c96-bb9b-a9f01e1b9aab", "comment": "Malware payload", "value": "10899ced57e9043b1757ccf75e7d88fea9c0fb9579682d9855adc668752ca238", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867279, "uuid": "390db19d-a7c5-467e-ad19-d4eaf9b1eff8", "comment": "Malware payload", "value": "dbefa9247870ccf60534bd9006efca1c0c2e3edd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867279, "uuid": "db76d7e0-b3f8-456d-ac7d-64741eb58cfc", "comment": "Malware payload", "value": "63d4c00230819d0532c0e2ffdaa8fecce3b67c61eb4d1280d32aec2124a82c7c8d2f9210024e5b80d417d1dd7ae1b239", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867279, "uuid": "b52b5ff0-a279-453b-ab69-fbc7d920f278", "value": "B733E1C4EF1BB858CA8373B7BC482FD66EAB026464CED49597C6309D0296E32621427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867279, "uuid": "334edc29-c004-4f45-a3e8-946136086995", "value": "1536:mAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3AV:dpoAnd9gucKCQaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867279, "uuid": "33f6f6b1-af4c-48ab-b249-b53fa1d1364b", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867279, "uuid": "98bd3f2b-128a-4ab0-a22e-23756663ff2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867279, "uuid": "4d69b8ee-424d-45f1-970a-2a301bb8511f", "value": "catalog-147049071.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c643f434-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868988, "uuid": "32b98373-5a58-42b3-bbb6-9cedd852f041", "comment": "Malware payload", "value": "2502b6d1957cd9989b7f758cd45f4075", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868988, "uuid": "d6df84bc-d36f-41ee-82e9-33a3c4cb8ec3", "comment": "Malware payload", "value": "108a150804d377bccc8dfee75603e7e6defa73b9a214b3a4be2c92bccd0ef7d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868988, "uuid": "0e328899-4fb0-4d63-b27b-2d535780434d", "comment": "Malware payload", "value": "2976bde46705d30b23d8de3d7086a38731454287", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868988, "uuid": "794a3dcf-21c7-4b30-ba18-345c1b60efd8", "comment": "Malware payload", "value": "12902e13580bdb0e3abca9333df919c6c4c73dc6daf37eba0c199feb3c75dfbf64f0c8f4fb8e7262c6c03310917cf228", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868988, "uuid": "e76ba9d7-1f0d-4c6f-8a2e-cc1d49a69a34", "value": "FC33F1C5DF57F858CA8273BBBC882FD76EB7026465C9E19457C3319C0292E3356242AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868988, "uuid": "7ab08efd-85fc-4383-9a0d-4d72b204ac98", "value": "1536:6AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHisk:ppoAnd9gucKCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868988, "uuid": "c1a6f173-57e4-4249-aa33-ff94f80a788e", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868988, "uuid": "f0c986d5-bc5c-412f-800a-8eaf8a155d19", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868988, "uuid": "7bec2b88-0469-4cbe-b6b7-4c0db40bb452", "value": "catalog-864195163.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bcfa03-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909568, "uuid": "30a51ba2-6092-4fca-9907-b006ce4f0e7e", "comment": "Malware payload", "value": "d272f9c8512062cbe43f543ec9db31e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909568, "uuid": "0b80eaf5-a89c-47f3-83f4-372da0b0c375", "comment": "Malware payload", "value": "1091a310985902ef0baf07f27465219ba749fe2019f6fc9d9d98c75efe125a35", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909568, "uuid": "388e05f9-37db-42b0-8dc3-4e5a2cb55c6f", "comment": "Malware payload", "value": "71ca83bbfc5951ad6218a474b30209a4df878f4c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909568, "uuid": "0e0daceb-4922-4efa-a4bc-c95250e6b270", "comment": "Malware payload", "value": "c6ab0427d05aa29f75ef6a2500a3c786d811df254974d5afe5c22844fc763d23bbeec034291286124ddc926beaf9e484", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909568, "uuid": "d1abaf57-e688-4752-949d-dd54e9d6a946", "value": "5D3302DFA014FAA3C19B67015FA997A206FC761DE270D058C35AC6F5E5C36C2C12A9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909568, "uuid": "b89ca780-55d3-467f-a3e1-e83ca29814e6", "value": "768:sqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7cLa6:lxTuDqsF1Cnc3P57oj2+nC6uxkL7cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909568, "uuid": "39885081-2d83-45cf-8df4-7b1171f46866", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909568, "uuid": "082bf05d-2ec3-48f9-8453-082c7e90d177", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909568, "uuid": "e5e3d6ba-af26-42a3-925f-4d3f41d0ef78", "value": "catalog-1327573817.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75815f6-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912315, "uuid": "ae917d7b-62c6-4523-9298-59a9d146185e", "comment": "Malware payload", "value": "cb5cc944c507602d9f7398cf5fcf36ec", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912315, "uuid": "d1ffc832-4ba2-4cb6-8234-9671ecdb7cfa", "comment": "Malware payload", "value": "109452cf536f5993843e887b4bc45491015d06d7ae70053a68aa964246488abb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912315, "uuid": "59c8d335-e67f-4290-ab6a-cbdf93d8970b", "comment": "Malware payload", "value": "f59eba5b0f04ab4d6646ac784c7e309ad727f3f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912315, "uuid": "2bdcc97a-d1cf-4466-9cfc-96d34de7d27c", "comment": "Malware payload", "value": "c259002cb621a3cb0c3670eb72c1dc39efb58bdf36f75ff95aa982a481448f1d1de5be4128a6abe931e68c54412bb41c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912315, "uuid": "1b68a743-9db0-4476-986c-ee265c907388", "value": "7E33F2A232D7C23BC0C506F5F42B5ADA66B78EC9E920E0D11D4FDE1113D3165ADB264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912315, "uuid": "1677f4f0-85e5-4b5c-988b-f4d3ba2bc109", "value": "1536:XEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwe23Hd:UnBrX5Eg5Enjq3axWIfkNwe23Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912315, "uuid": "4aa37677-7e14-491f-be4b-a7d89a572eb5", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912315, "uuid": "9ce0ef81-6ffd-4408-9f0d-e2f8c23de3f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912315, "uuid": "ad0f9a87-efa5-4f74-9d79-83cda277a981", "value": "diagram-1533477898.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337fa68b-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910832, "uuid": "6ae513ce-caf3-44ce-bac2-662e1ceaffde", "comment": "Malware payload", "value": "427b6e4014d9e4ce5626b97dd9fd9cd9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910832, "uuid": "1f36c91f-7941-4bd2-9022-bbbb5d17c73b", "comment": "Malware payload", "value": "10967257bbe5fce55a3218227fd7c70d216167887769151db8311dcf22e020e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910832, "uuid": "cbd737b9-ed10-4899-a99f-e54f14a0754c", "comment": "Malware payload", "value": "39983b871c65b3940b740a9645bb492a1d5cb8a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910832, "uuid": "67ec482e-8905-47ae-aacf-cbd8abd80cbb", "comment": "Malware payload", "value": "41de3cafc63374019a98de5072faa1220eb730e9ec931edd314a1b29046281b43340500a8c67fc854d651768705022a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910832, "uuid": "a012765d-355d-4db9-889f-1b8d084aeda0", "value": "463302DFE415EAB7C1EB92014FA59BA302FDB54CE0308628C754C3F8EA835C2853A5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910832, "uuid": "8454493e-a591-4ee1-b9f8-f76e154d42ef", "value": "1536:sxTuDqsF1Cnc3P57oj2+nC6uxkLiO9Hr4:sxTqqsF41j2Pxmiu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910832, "uuid": "aec3ebae-6620-4af6-82bb-74750cbc38b4", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910832, "uuid": "60fa6811-a289-4c76-964d-240f7e25a1dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910832, "uuid": "ed362f4d-838f-477a-aa59-1fdf7b50aef3", "value": "catalog-368610430.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9a9305-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870800, "uuid": "8543b2cc-3f58-4731-b270-28313bca347a", "comment": "Malware payload", "value": "91fc8274f352589d163ac41b6b7bac1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870800, "uuid": "995aabb5-5689-4237-9bd2-9512c9eb360d", "comment": "Malware payload", "value": "109693590292d340715077c77240811a46c752626736f725c9f0249b23ec4bc4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870800, "uuid": "adc72e7f-452c-440f-9ef8-72a716826cbe", "comment": "Malware payload", "value": "7ea7de4e1733a249c871efd4181998d1854b9639", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870800, "uuid": "f14323aa-10d0-4a0b-8fbb-f571f69b19b1", "comment": "Malware payload", "value": "80ab81d0bcbe21612457040367b2060c10e15c05b85b7432ebebc4df1e19026987018bb7b9491558574087721716e34c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870800, "uuid": "66f5b980-6732-4542-b13e-1bdbaae68155", "value": "6B33F2D573FED9108AB1C1B060D3B659274F3D914D699AEA0DC864B93B93160CFE16C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870800, "uuid": "a78e7629-2c43-4708-b5a3-977e455c4c8e", "value": "768:75G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJixsCpMYz:7/czJJSI7r3Pwh8hxsWpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870800, "uuid": "56c99728-0843-4f17-81d7-474a27c4d55b", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870800, "uuid": "f0825475-1952-44ab-bde8-b914fe080425", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870800, "uuid": "28e3e1c3-eedd-4856-968f-3de83db6ab70", "value": "diagram-2135310049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830f9608-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914831, "uuid": "e517c78b-f932-4666-a4f6-0565b5b2c551", "comment": "Malware payload", "value": "85a9886bdde27ce1d37d5c5c8330f3b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914831, "uuid": "6930ae93-bcb3-4d5b-9239-65d055562a65", "comment": "Malware payload", "value": "1096ce716056a555211f95d020ef7944afc8b6471396c0ae501b69a7ca6475f0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914831, "uuid": "d06b80e8-ccc8-46c8-9aa6-5a2e01488cf3", "comment": "Malware payload", "value": "b1390b65d6eece62e0e7ef4b194ee709c5b4b2f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914831, "uuid": "4839f5d8-71cf-4f37-8469-d4f9bf3c8620", "comment": "Malware payload", "value": "cecd50305d35a5cea452875f1a2c8a59866d87f002987e0c82e90ed6f250d5935b8fc63d6a5a734cf7cdc292125bb652", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914831, "uuid": "6d1d80f4-4c21-4e69-8fef-d59161a3b928", "value": "FB3301C55B23FAC6CAF9DEA7045623A5936BD88D31283C5C193E298381FB158C4D7BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914831, "uuid": "95078fda-cd05-48c9-be0b-bb69bb8e3fc0", "value": "768:yo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SVFKmC:qeKCVQbp4LTaI7ZaiNQMIXFUmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914831, "uuid": "9c8ea5b5-327d-4f28-b591-112564b713f2", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914831, "uuid": "eb855afc-c430-4c48-8520-67a68113efc8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914831, "uuid": "606b1ec4-59bf-4182-a15e-4793e21cad14", "value": "statistic-1336763645.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5920b33-b3e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620907588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907588, "uuid": "c836ef95-ef6f-44c1-adac-42c03559105d", "comment": "Malware payload (RemcosRAT)", "value": "f84117fca79609ea125b4bb794208325", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907588, "uuid": "fa961a2d-027c-4456-a1ab-b23bb5c8110d", "comment": "Malware payload (RemcosRAT)", "value": "109a40435ad446c7b03af30bb049f55275a659c0271fa7a8a1a59d5871d18c10", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907588, "uuid": "0297be10-c942-4d60-8ece-c6f71caef8ed", "comment": "Malware payload (RemcosRAT)", "value": "d55fbf7a33cec471dd6270908cfb752d67861081", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620907588, "uuid": "033f5d32-f681-45bb-baf8-a7be0622fe0f", "comment": "Malware payload (RemcosRAT)", "value": "0be59b67e9fcf2789dd388d6e8c217934d494c8503ce263aafda10c225c41b2156fe6e32340fc4a6d8a2866ca3591bde", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907588, "uuid": "0951b1bf-632c-4ac8-b2b9-df349dea5848", "value": "F711ED11770A8B6B312F96664680BC6891106A10A49C7345883241D22ABC6BBDF66CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907588, "uuid": "a49866a1-ea46-469a-a08b-b96fd02188b8", "value": "12:75ghYN3v/2B7Ue3R5FJQDFz1lcM8F+XUfEoPBq77wHx7WFqMDgeJre6ZN3ZCBbpf:7iBNyd8F+IVBEux7WFtvxe6dCBo53yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620907588, "uuid": "d34053fe-95b8-4e7c-9f5f-3d0f48fab802", "value": 934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620907588, "uuid": "c981abed-f7b5-45c0-b0dd-8fb28305e8c0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620907588, "uuid": "906df2e3-4b57-4165-b8b3-3ceacf5e0f7d", "value": "Appraisal.report.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f68453c-b415-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620928891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620928891, "uuid": "64e21ef0-5066-44fa-8efc-b85e17fc2f19", "comment": "Malware payload (Dridex)", "value": "2ea13d7f1d9b0bfb295d863948f85b85", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620928891, "uuid": "2db840eb-0023-4856-b107-116ea1ba3155", "comment": "Malware payload (Dridex)", "value": "109e696dbb46f96524c03bf89518ae40f6f744a6f97265e50218e36fd10c7eea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620928891, "uuid": "b0b17ab7-d6d1-4bf7-96e4-ddbc77c901da", "comment": "Malware payload (Dridex)", "value": "c6073f5a1eb11529579e6e1d2f57a44e243b69bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620928891, "uuid": "2a7d8ee8-4787-4893-85f3-0979aab385b5", "comment": "Malware payload (Dridex)", "value": "cbc921a63c825edb0037aed96f1eccaf9eb958f0c3580380d86c4091176ddacaddced1a0b36629fdbca50e6b40c094db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620928891, "uuid": "4927dac9-a7ba-4cf2-a9f7-776c51e5296c", "value": "CFF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620928891, "uuid": "889b1291-a2e0-441d-9139-f0f3b71e60f9", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620928891, "uuid": "e38f2803-d788-4cf7-a6ff-58b37cac0571", "value": "3072:vWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:v42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620928891, "uuid": "a8a1c06a-f68a-47df-8ecd-4ca3f9cf1466", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620928891, "uuid": "5f2c154c-164d-4b43-88ef-84f3c6ac62cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620928891, "uuid": "38e50e37-159f-480a-ae01-bfc36ad1dd42", "value": "2ea13d7f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af690dcd-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872815, "uuid": "b509f914-ca74-48df-866c-387b1b698488", "comment": "Malware payload", "value": "05a7182cf67140a26c756c6fd82ea297", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872815, "uuid": "67081fe9-f46c-48bd-8af3-f730756d4755", "comment": "Malware payload", "value": "10b70c376f972d9871418b78e2b2c4aae205e8b4bf46d853bd3b313f33e6f09a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872815, "uuid": "8cbf078f-47b3-425c-87e0-89b933f6fb5b", "comment": "Malware payload", "value": "b48b06804b4a2f1c7a286fd0de5b36b87cd21373", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872815, "uuid": "85b146d6-477b-446d-9923-fb8f0b20846f", "comment": "Malware payload", "value": "b3e774d139580a1944b16d8a8c9e71b1639bcfb2057746977463e79deea14ac88ec93958dc9dd4556fab65ec1ce1849b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872815, "uuid": "f9ef06c4-d2cc-4f35-b55d-e086313192f8", "value": "8E3312F3D602B2ACB64381494E8C5A47923B827066595EF1C21DEFA1D33D7170B52E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872815, "uuid": "703a4225-9cac-4b60-99d5-6973d745080e", "value": "1536:r/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeegR:7XKAXh3TCdOi+KSZ4W7gR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872815, "uuid": "9176ab55-7a02-434e-bdfa-4e441c3ad014", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872815, "uuid": "4ef72e24-87c7-4fc3-b7ff-7d3983d15601", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872815, "uuid": "ef959f96-e32a-448f-833e-c0ac238be2d2", "value": "statistic-172220859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c8717c-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872698, "uuid": "bcbd1918-b47b-4083-aba2-130992c8321f", "comment": "Malware payload", "value": "4a6dfaf76590e3e2027d8580256a9901", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872698, "uuid": "688872ee-54df-49af-9aad-692772bff4f0", "comment": "Malware payload", "value": "10c9fecd205046537ce3f4a7cd890494c5032e333c4fcf56836635019ddeb877", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872698, "uuid": "61304bb2-0534-49db-a34d-a5e57327410f", "comment": "Malware payload", "value": "5ee3b0aaced9361e43f7cd1657f4f00e3cad9b52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872698, "uuid": "b3994ee3-3b56-4d9d-88ad-6eb02af38aa9", "comment": "Malware payload", "value": "c9680a940620f2b08fb731adefa79e89b48106ef0cae3cffacf553dc20de69eed4c151cf0f9685954ba435b595890071", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872698, "uuid": "e6b6f34a-98d1-4da5-8cf3-84c2d28342ec", "value": "2C3302F1D603B5ACBA03418D4EDC5E2B523743709A598DB1C59DEEC2D33971A0F90AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872698, "uuid": "d96018d3-9f73-4820-8ccd-7bf71b28e525", "value": "1536:1h/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMn:/XKAXh3TCdOi+KSZ4W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872698, "uuid": "77aecc6a-1627-4bdc-9c0a-4bf11cb55fb9", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872698, "uuid": "aa3d5c76-9f4b-49a8-86b1-e592b07b2c81", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872698, "uuid": "a4caee3a-7b37-4f8a-ba61-f4b98d24a3e5", "value": "statistic-1639866880.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a238f06a-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913595, "uuid": "89ff25bc-cd0a-4ba6-9757-75930bab969e", "comment": "Malware payload", "value": "ef23273a40780c658ff3aaa40acb525f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913595, "uuid": "e7c6346e-1bad-4c14-9967-a7362ef9773d", "comment": "Malware payload", "value": "10d7ea5627ed3bd5ad1965271cd7455c1192975ec21ef3fbdbf96c5c4cc1a2c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913595, "uuid": "02cf4e77-7403-43ba-8831-e91c5806c79e", "comment": "Malware payload", "value": "0d28214da5f030d5bd0311ebd9a76061ecd04e8f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913595, "uuid": "af01e16b-e02a-469d-8d38-33e727efeb7e", "comment": "Malware payload", "value": "e76f03e606511849850a3d99c698200ea29360d22d18ccf3e00d7d747240634747f66a49cdcf646c04254be6ea6f2e14", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913595, "uuid": "d1acc014-d6fc-4b66-be46-1c47b97eb19b", "value": "D033F2D233E3D139C0C115F2F5275DD96A978E88F530D4D06D9EDA4023D31AAADA174E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913595, "uuid": "3ef8742c-c84a-4fd9-a369-8891ba10776b", "value": "1536:IEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMq:9nBrX5Eg5Enjq3axWIfkNwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913595, "uuid": "d76fd315-e99e-4ac7-9e6a-f9781e973656", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913595, "uuid": "afa9d6d2-978d-4593-856d-cf6a097e2473", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913595, "uuid": "830c3ca7-93e2-47f3-9157-92a8fb311b64", "value": "diagram-430042445.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5916bf-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874154, "uuid": "feaed95e-7bf0-4a59-83f6-f4952070288f", "comment": "Malware payload", "value": "89662c398ef9a268928f8840f1142b1d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874154, "uuid": "c2da8a07-de1b-4d8e-b5a1-00cf9142e8e4", "comment": "Malware payload", "value": "10d9fd0ca1e20bddc1a246dd8a8641b42b8d4165cbc3138d7120772df9921724", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874154, "uuid": "ba47c22a-080e-4eea-a94d-34518c4726a1", "comment": "Malware payload", "value": "33e58223682e3d2ecd719b6e4c944dd9385ab801", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874154, "uuid": "12fd2930-0bf0-4385-bdf2-c8d925e7d121", "comment": "Malware payload", "value": "e5738b7f08cdc6e5ac669725e3b036693fb3c826312fa8543243f96fdb7c096432a8c8f25749964bc1e0476a188a76e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874154, "uuid": "babdace2-087d-4c53-af74-cdb0d924c5b8", "value": "233312F3D602B1ACB64381494D8C5F479237817067585EF18219EFA1D33D7170752EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874154, "uuid": "05bb2ad0-8511-4d57-b3d1-33702329a56d", "value": "1536:e/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Weesy:WXKAXh3TCdOi+KSZ4W7sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874154, "uuid": "25c88b26-f660-42c6-bc88-55eeba1123c1", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874154, "uuid": "ecbc1066-5245-45d4-80c6-adc39fc843e3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874154, "uuid": "3e6ac770-d7f7-4dd4-abe9-7e1a59c1a078", "value": "statistic-646623095.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0462778-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871501, "uuid": "78254c75-e877-4898-b21a-5e1c2c4dd656", "comment": "Malware payload", "value": "b5906a941eb40bae58d31715b9dc91e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871501, "uuid": "669875ae-5f01-4f6d-aade-cff96a891304", "comment": "Malware payload", "value": "10e300d90679b0ad82e614247dcc29d37e6294154b180edeb92820631b54c3c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871501, "uuid": "2d5bedd4-553f-4761-98a3-b61a8ee17f4d", "comment": "Malware payload", "value": "648c7e50689630690e1814d04dd9586eb68812f1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871501, "uuid": "b09a32df-9a85-44eb-a1ee-2b78ebb95a85", "comment": "Malware payload", "value": "6c48997b05df728f2e1e0b16950ac1164fd67a83401a56b2821aaf1b4dc2d47c2d4029d13cb73ffbb806024ba2bde0ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871501, "uuid": "4a1bad01-f196-4a81-89e0-a5b3db7d6f2f", "value": "E233F19473FDD510DAB1C2B0A492B6893A4B3CD28D3D59EA0DD964B93F920A5CFD22C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871501, "uuid": "ab2e8e2d-fc29-4aae-8966-da05cd49030c", "value": "768:Y5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8q/mGI:Y/czJJSI7r3Pwh8tv8x8JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871501, "uuid": "4cb6265e-4868-4848-b570-7f3e78bdf09a", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871501, "uuid": "11fbe65d-66a6-472d-8f9d-f738acb6f448", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871501, "uuid": "05ff4fb0-3855-47b3-bdb9-d74facbd962a", "value": "diagram-710294015.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77e9f68-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873661, "uuid": "05c4df81-ed9f-4103-ab91-cbbff5bb5e3d", "comment": "Malware payload", "value": "f2ff3761cc7e846fa36f084e49a3f69f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873661, "uuid": "6ea1b20f-88ed-428f-a937-08c4a35d00d7", "comment": "Malware payload", "value": "10e3685f5e7f234c6a741ff7d05d6b7db6e2939995c3abd9b00a7b1b04d0aea9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873661, "uuid": "3f8463c7-c57d-4a8a-921e-96edd2de7a33", "comment": "Malware payload", "value": "6f04b9c314dfe375b283c58a39958a36b6e9180a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873661, "uuid": "2bede2e4-2a50-451a-9df4-488229ec7ee5", "comment": "Malware payload", "value": "637976c3be44cb5ec521a2d731b26d9dcf28c8b9e416a7c5a8e24597d26fd1f8952d691a15a969d4fe4602f012b26be6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873661, "uuid": "58324b49-cdd6-4b4a-bc0f-c073219b26a4", "value": "DD3302F2E743F6BC754381894BDC1E6B423B4220125D8CA1C55EEED2923D72A0F51BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873661, "uuid": "d788869e-a3ce-4dc0-8849-2bea8f2bba08", "value": "1536:B/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMO:BXKAXh3TCdOi+KSZ4WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873661, "uuid": "d869fbbb-bc7a-4247-85fe-e01a88ffeb09", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873661, "uuid": "eb8edd61-473d-4bfe-9feb-70605eec1db1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873661, "uuid": "ff1ee342-3d70-4eda-92ed-ec334aff14cf", "value": "statistic-276352257.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff61188-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913081, "uuid": "66fabd34-1d0f-4326-a29f-2f316f808236", "comment": "Malware payload", "value": "93f1dd7c00a3cf81bc976ad3dd745e85", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913081, "uuid": "af9c84f3-0e0b-4561-8a09-810fb9378c1b", "comment": "Malware payload", "value": "10e4dc254c110a7dd3460371f857a234703037f10c9490ef3596432db8963195", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913081, "uuid": "e50ea74f-51e7-4b80-a913-0cf3f10bfcb4", "comment": "Malware payload", "value": "6c7638b89b477a31edf3e7b639b3d50a7879a361", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913081, "uuid": "259de9f3-d955-4847-be23-71968e007504", "comment": "Malware payload", "value": "ca233d85938f0d4db951972c7207f97a2927c1431256f24c958f0c2e989bd1e3accd5d66e678bd7c7e1b13bebe51639f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913081, "uuid": "88b2d16a-bd57-4292-a879-541c9be1c423", "value": "9633F1E232D7D13A84C544F5F82769DAA6678ECCE530E0D02D9FDE0122E3165AE9160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913081, "uuid": "9b4bdd8d-7708-4bf2-bdd3-b13ca62ca8b5", "value": "1536:FEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwsnpO:anBrX5Eg5Enjq3axWIfkNwspO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913081, "uuid": "67ac5a6d-03d1-40ed-a4bd-bcc585258de5", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913081, "uuid": "59502134-78ed-4790-a279-9077c6afb6f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913081, "uuid": "7036c813-a066-4596-9c28-581674fb77df", "value": "diagram-2002640709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e13a1e-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874014, "uuid": "c5deb6ca-5dc5-4d13-a07f-215c8bd23354", "comment": "Malware payload", "value": "fc8bc5c51220ed9b618085ada8f47f50", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874014, "uuid": "73a601a0-c48b-43cf-8161-97c42d648fc4", "comment": "Malware payload", "value": "10e500e7b3bb990e842cb6f23d842dc191695276c7ebf3cc31495835ce072674", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874014, "uuid": "b39327f0-b362-41dc-b988-0127cda3a245", "comment": "Malware payload", "value": "4b85315172d7689500e088791d237201345c52e5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874014, "uuid": "df35989e-c88a-4833-bf38-e2f5731ebd45", "comment": "Malware payload", "value": "960695972e596ed7600a96710c96192d52a5ac1c652ecde7bc63000775150eb24f4a913fab5169ff9bb4ca1e46490c81", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874014, "uuid": "7124990e-d710-4f52-b66e-e3fe1cc25995", "value": "313312B3D602B2ACB64381494E8C5F47923B817066595EF1C219EFA1D33D7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874014, "uuid": "0ffee1b0-7b7a-4608-82b4-dd31701db1cc", "value": "1536:Z/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeB3y:pXKAXh3TCdOi+KSZ4Wc3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874014, "uuid": "f0115852-de4d-428b-a36f-86b06210b32e", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874014, "uuid": "c748a260-b18a-4ee4-9616-5acbc006ae29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874014, "uuid": "c71de7c1-d160-49f2-abe0-3c80683f5eef", "value": "statistic-509684092.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059d59f0-b3e1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620906460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906460, "uuid": "efc85f74-cecf-437f-860a-477f4f120e70", "comment": "Malware payload", "value": "eb94143ced217b07d1e8edf939eba4ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906460, "uuid": "1824de13-5e69-402c-ba80-d0069ab8f235", "comment": "Malware payload", "value": "10f9937ef84f621801754122000968d454f68999c2899e9d763104f3204d6d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906460, "uuid": "c1013dff-d7bd-48f6-ad77-6f99123537d6", "comment": "Malware payload", "value": "bd05478fa232e98c66919ec131dbee416f8e5b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906460, "uuid": "f7785a93-4374-49ae-877d-c037d9fe38a2", "comment": "Malware payload", "value": "e4b43e2957819c25729cdfaae80d0201ac88edc351dd70ed8cd4d043b112cb94425a98142be8d64643017d0f63cebfef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906460, "uuid": "bc6f60e5-b241-41bc-ab6e-302abb8aad40", "value": "35747D839C7C22C5C8D264736E17C3722B132E7E458A56A921DFF623347352CF6A295B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906460, "uuid": "5643d955-9ad4-4a88-97d4-a6633a3651bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906460, "uuid": "a8e96e08-7c1a-4a2f-9090-1db3bd6311c9", "value": "6144:E1BzRQJH57ukTKD6HtHxuGKATcdKPXbDtttdttttAhArKZWeSFynwSPFWAB8uxMk:EVQf7TTKGNHF5cdKPXbchArKZWeSFywn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620906460, "uuid": "9e5ca747-b0dc-4931-998c-920936eced06", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620906460, "uuid": "bbe919c2-1785-4feb-b462-c7cadd2e7bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906460, "uuid": "1ccaebad-effb-4de4-abfc-f7212dd10694", "value": "ORDER0304994304PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c293522-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868327, "uuid": "23079a4e-d8ee-4cca-a7e3-246581ac6ed2", "comment": "Malware payload", "value": "82cf2a9cbcd04b5ec8f92c358f931983", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868327, "uuid": "f771d36a-3d26-4483-9742-a4b22bb57c14", "comment": "Malware payload", "value": "10fb075c92f646b82b95ba37ca54b1e21e6ac10f052460018892c4c5cc522f2c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868327, "uuid": "9cd57aba-75a3-4b65-891d-1f6ea3e0ab21", "comment": "Malware payload", "value": "26cc2055253c3cde0d2e4db61cd1236e466ce81b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868327, "uuid": "e4fe5255-779e-4a33-9334-02ebc24f54df", "comment": "Malware payload", "value": "6b6bca0c8585c557c1aa4d72b8649e80a7640b8b2ad172551f806d62a269d44745b076ac72c67e2eb793dd1b8b824005", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868327, "uuid": "24e6c4f0-0202-410a-9656-715e809eb478", "value": "9633E188EF57E81CC79273BBBC842F976B77126454DED59967C2308D4287E3326102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868327, "uuid": "447ecf10-b66c-484a-b2ca-4e8cf37225e2", "value": "1536:AAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNq6:bpoAnd9gucKCI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868327, "uuid": "16688d69-6f2e-4bc7-aa5f-0f281e9cb7ad", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868327, "uuid": "c9a7740d-f207-4aee-85a6-3aec038f1005", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868327, "uuid": "0e28cd94-8ebe-477d-88f9-22d684733dcd", "value": "catalog-321822201.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ae764d-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874085, "uuid": "ca6315c1-c3ea-4e7f-bb5f-e0b67efea4c6", "comment": "Malware payload", "value": "181a96d734868a8adc179741ad5ccc71", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874085, "uuid": "9c22a7b6-9d56-44ee-93d1-969ed7454537", "comment": "Malware payload", "value": "110faf57e4056768cf4886761534a4f8bb1d1bb4ede6f01e54e3df3b16e2a07b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874085, "uuid": "14c40794-41e6-4c16-a3ed-872b6c3f4a8a", "comment": "Malware payload", "value": "6eb1ef2c43b6bfcdc6a45199451f88b4ce81e969", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874085, "uuid": "afe2249e-6112-4a7f-b5e1-4907724ff379", "comment": "Malware payload", "value": "7f47445db17cdfb2ff7d77b80dee73e4e9f05135d66dd29eee8b0df8a697e790382c1ba4ad4b9885b1a5d74617dfecd9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874085, "uuid": "a80fd761-3798-4774-a08c-922bc51bf5d5", "value": "A83312F3D602B6ACB64381494E8C5A47923B817067685EF18219EFA1D33D7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874085, "uuid": "f98e4995-aef2-4b4d-a842-31d7f4600681", "value": "1536:+/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeB8h:2XKAXh3TCdOi+KSZ4Wc8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874085, "uuid": "0194e5a3-aea2-47f1-a283-9561441fcc66", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874085, "uuid": "9ea5c01f-2ecd-4347-a25a-f8517f10c1a5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874085, "uuid": "fdbcfe48-6dd1-4375-bb76-c06657076807", "value": "statistic-583912521.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488b10eb-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872642, "uuid": "d397d331-0db9-4552-bc25-dc5b72920330", "comment": "Malware payload", "value": "3743cabbf96f901fc3a8de93af250de8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872642, "uuid": "e42e5a6f-aee0-41fe-829f-566f5df4b204", "comment": "Malware payload", "value": "1110bee82c74c71a7147cb57aa757659d076635066cc43c863a1f265d35a5b7b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872642, "uuid": "744e52e4-9cb6-411c-87f8-9edf987e3b9c", "comment": "Malware payload", "value": "7b9d567c97dcc6a8b4bb9438804b5ba36f897f48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872642, "uuid": "352b78b3-9992-4121-9916-7eabf941db8f", "comment": "Malware payload", "value": "4e9368ced0587765499a0b4af15928d8314be983f2bcc577b418571f07eba821e9dcec7edc631a4589a7b7a7487412ef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872642, "uuid": "e7848e3c-2e7f-422c-9d84-e30233c26dd4", "value": "FF3302E3E653B2BCB203D4C985CC4A5B123F4220556D8DB1C51DEEE6A23D31E1B91AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872642, "uuid": "147b284d-6ad9-4231-b7a4-3d8856b92952", "value": "1536:Q/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WetG:gXKAXh3TCdOi+KSZ4WoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872642, "uuid": "326f99c5-c122-4752-8365-c479e7066228", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872642, "uuid": "90bdcd27-14a4-41ee-bd3e-c87d33b87af1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872642, "uuid": "d2bb03b2-0820-470d-96f6-a45374a185b8", "value": "statistic-160195359.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba2bb46-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871842, "uuid": "8a73a723-652a-4e06-83e8-bc2c72af42ea", "comment": "Malware payload", "value": "1444457637ee066820460c16afc2c7c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871842, "uuid": "3ad31d78-56bf-4759-bc03-6d800b493c8c", "comment": "Malware payload", "value": "111131e23d505770ec0dea238327e83ccb5a485e91e1387761484b83ed917a20", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871842, "uuid": "1838d7a6-bc35-4e08-8afa-5a2e6f493fcf", "comment": "Malware payload", "value": "66d8c7c3b5da618e81b26f5694e5e4bdf0249198", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871842, "uuid": "d90ee2cf-7330-41fc-8242-afd43e3985b9", "comment": "Malware payload", "value": "02046a9f5a3d6a719a64021d8b248aa137ca970ef2b7eaa59349fba7981f36e7956f5ca9996ca432cff4dbbcdc2edad3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871842, "uuid": "20d0caf9-7a19-4130-96ba-afb7e0ea0350", "value": "2F33F19537FAE610C6F182B0A0D17689274B3D518A695DFA08C4B6793F931B0CFE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871842, "uuid": "9041e3cd-f7f9-484e-88da-7ee4c5675c84", "value": "768:G5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJp26:G/czJJSI7r3Pwh8Rj26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871842, "uuid": "034b861f-39bc-48dc-9e4a-0fca044f8961", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871842, "uuid": "179530ce-c452-430a-a1b6-bb0b80afab99", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871842, "uuid": "237f6a29-e48f-4304-ad64-3ccb35ec9aca", "value": "diagram-989125655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ccfdad-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916656, "uuid": "b750df88-864c-4fe6-a0de-72122752d3de", "comment": "Malware payload", "value": "f91b82d9593ce4ce68f0eb1e2f8964fb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916656, "uuid": "7c4f27ee-49f7-414f-88af-da4c5942a42f", "comment": "Malware payload", "value": "1112323678f7d8eb8497e082ed2c0931e999c21a283a5654b1c85837f6a22898", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916656, "uuid": "263e03bb-ad36-4c63-ad64-b1efdeaca1cf", "comment": "Malware payload", "value": "9cb50a3b5e0f8cc2009a9e022f05e9bab8cb18fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916656, "uuid": "22c137b6-7624-4a44-a956-3a80b85b7d00", "comment": "Malware payload", "value": "00cfa45d915d7a9fc5243de84feffb271b7ebc09e313ab22baee3ff68840d2cb41643a558e04f11a7472e17b8b2623a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916656, "uuid": "65bb9278-5dbb-4294-9340-c8c5c58f776e", "value": "513301866917F5C6CAFAEE57004663D493AFD99C31243CA8593E288240FB65CD4E3BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916656, "uuid": "ed5fc2e0-b67f-4adb-82d1-e88ce915ac16", "value": "768:fo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Sd4a898T:leKCVQbp4LTaI7ZaiNQMIXl9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916656, "uuid": "a548f269-8817-4109-bbdd-a8f3c6f9cf07", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916656, "uuid": "1a0f9366-53f5-4e73-bb61-5ee4bf7c2e29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916656, "uuid": "699aa63c-030a-4421-a9ed-00239c84d86e", "value": "statistic-686897513.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b40afc4-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868808, "uuid": "2a35e09e-79f1-482d-a017-8784cefddaab", "comment": "Malware payload", "value": "fdf0cfd66c4e1d30131b5279273ae79c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868808, "uuid": "c52d9d90-ead3-4cd7-8b03-c257328667ad", "comment": "Malware payload", "value": "111b4d1979b3a5b26ceae404c30697894337fdbe89c62e16e608c33eef60ca8d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868808, "uuid": "53bd2fbb-3c74-4379-bd7b-fc8c48288e7e", "comment": "Malware payload", "value": "a51f2d45b9a26579fb9f12d63a84bdb223927c6c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868808, "uuid": "ff675176-8be3-47f5-86a5-9fee59678604", "comment": "Malware payload", "value": "9da67276e538ce7e155a69fe0b9b5ff09a1e0437a1d717111998463e42bdaa133e548064aac22b91c41ccfa633f98c4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868808, "uuid": "e3768f86-2646-496e-b458-33b1f82c90c7", "value": "2033E1C4EF5BB858CB8373B7BC482FD66EAB126464CED09597C6309D0296E33621427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868808, "uuid": "0e8ccece-9441-4b29-abdc-cb09b6c4ec17", "value": "1536:FAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3F1:ipoAnd9gucKCQaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868808, "uuid": "0ab72c6d-9aae-4fd1-9f8d-cad4e8bd89cc", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868808, "uuid": "73f52df8-bf84-4b75-9131-7f4f5a24c95c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868808, "uuid": "1ace7e35-8530-4076-945c-66a63beb463f", "value": "catalog-700013800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bfa85a-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866942, "uuid": "588ae8d0-a253-463a-b0f7-c54c1d7026fc", "comment": "Malware payload", "value": "fd9501ba35ad9e874f2873caae5785ea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866942, "uuid": "a352aa4f-c71c-4aa1-8c5c-edea0a3ff2c1", "comment": "Malware payload", "value": "111e174cbbd9a21c8148c8fd2563eb667ad0bfef9fd21bdcd10d20857296a339", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866942, "uuid": "5f1e5cca-35a7-4c77-9a45-c9cc94ff31a3", "comment": "Malware payload", "value": "4728f18870980cded7692926e010107bb7df98b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866942, "uuid": "06ed7b77-e613-4276-9aaf-e7dd902d1a3f", "comment": "Malware payload", "value": "024c70d16574758239b601c0f246a7de5b1c0cc46ecda22d16e7639cbca768fce0e0a171921bd605c8b488c1a01d98dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866942, "uuid": "0ddbbe71-887c-489c-9de7-2e00ac14d5fa", "value": "2333F185AF5BF458CB8373BBAC442F97AFB7026459DDE19867C3309D01C2E2716142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866942, "uuid": "82845c9f-f4f3-48ca-95fe-8ff4fc40c03b", "value": "1536:pAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSB:epoAnd9gucKCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866942, "uuid": "f27b7ba0-83fc-44c7-8270-f51103a59443", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866942, "uuid": "e00d2abd-88bd-4d07-8b81-37838f2f260f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866942, "uuid": "fb713ed1-6f14-4ca7-b939-cafe4601d998", "value": "catalog-1205743281.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34d5d45-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872070, "uuid": "e4524d50-5d21-4da2-99b5-320895f14673", "comment": "Malware payload", "value": "f4b52e9f16e919ec396e10a478520945", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872070, "uuid": "9b025bdf-14fd-41b6-948d-0bab7388c0cf", "comment": "Malware payload", "value": "112842a7c2a932757e909de8c351e92a3f4ed16fd0df0ca19f4018f731aa2e6c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872070, "uuid": "cfb53427-dc76-4fdb-8cd3-95c51c3d399a", "comment": "Malware payload", "value": "e833ac3f69a7accdee01c595910ce16a38f9f12f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872070, "uuid": "2664132a-84b0-4ae8-ab74-8ae910726308", "comment": "Malware payload", "value": "17657351233411d15f009e40ecf9c06197243797339b0d6a92f25f2202f158f3a3ac8aebc29e5dae479792594e244b84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872070, "uuid": "caa9fcfb-b96a-4a18-8e6d-1cbe43306f85", "value": "693312F3D602B2ACB64381495E8C5F47923B817066585EF1C219EFA1D33E7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872070, "uuid": "3e1391d4-e5fa-4c5e-af89-18b7b3558930", "value": "1536:JG/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Weetqccu:4XKAXh3TCdOi+KSZ4W7t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872070, "uuid": "89febbbd-6bd6-4006-9e0a-c03c6c4bcca2", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872070, "uuid": "2a843034-6f7d-4d08-a339-7d0ae4d51259", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872070, "uuid": "bb1c0f1b-b21d-406c-822a-4dec358ace77", "value": "statistic-1185276615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fca8ce2-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874024, "uuid": "50d032c3-70e5-40af-be26-90501ce50dea", "comment": "Malware payload", "value": "cf796418c2dcdaff305334b3e445009d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874024, "uuid": "5d3d6d59-b42f-4b87-b6ec-31022299afbe", "comment": "Malware payload", "value": "113080c90e7842d9eecfe73db7287d7646df3d3623524da512c5077b4fc9759f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874024, "uuid": "0dbcc8fa-9476-4920-b5d8-1c47c11e3e1b", "comment": "Malware payload", "value": "c602dab4e78e65eb70360c50896cc4b24f0b69cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874024, "uuid": "15c54b76-2fcc-4498-8d83-ae603e7fffcf", "comment": "Malware payload", "value": "3c054a9b7d7ab730308dae2d029b8ddb4c1d6a5e6792f85cf559b9e4f4e6a3b7a13b615d57757a492fc5e69574cbf0be", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874024, "uuid": "fccf3eb7-4274-46c9-a0b1-b1d3276e455b", "value": "BE3312F3E643F6BC754381894BDC1E6B423B4220525D4CA1C55EEEC5823972A0F51BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874024, "uuid": "6d67ee40-e9d3-45a2-8c06-cc5f1069dcb2", "value": "1536:Y/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMY:YXKAXh3TCdOi+KSZ4Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874024, "uuid": "b42799be-4609-4f44-885c-85abab2b81a6", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874024, "uuid": "99b54aaf-4092-4b6f-b416-12e13c7fc0fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874024, "uuid": "4c889886-a0fd-4c5c-b62e-624bf36de425", "value": "statistic-520219118.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5decc7ed-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909615, "uuid": "a8c3e1b4-1ac4-4181-86fa-f985d68c3254", "comment": "Malware payload", "value": "7c24aee9b5ac452bab313991ffe8eea2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909615, "uuid": "64d83131-ba82-43b1-9ff6-12c6203517b4", "comment": "Malware payload", "value": "113b1b12e1c3f214e6afac65d625c69bd5536a6d975e2fa783d07acb94ddfedb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909615, "uuid": "763c1ece-f391-4cd4-a2ea-2245b2fb75ec", "comment": "Malware payload", "value": "bb08068b633a25f5eb34da316d59cd8729a951f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909615, "uuid": "115accfa-4495-4e4b-a9e5-b658621ab418", "comment": "Malware payload", "value": "bbd8c8130b297d991bf82c1492a3a2ebedde685ff8464c3ca1c63dbfa90b80eaab7d21bf13d54a4fea5bdbb3e0167243", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909615, "uuid": "c5394b2c-e725-413d-a2fc-aabc79a53c5e", "value": "A03302CFE045AA63C29F93015FA59AA306FC792CE170C14C8369C6F9E9836C1C43A8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909615, "uuid": "1f3d4fcd-fa8e-4bbb-9337-0571038680b2", "value": "768:iqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0CxfM:zxTuDqsF1Cnc3P57oj2+nC6uxkLlfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909615, "uuid": "3ea67666-74dd-4bb0-a3cc-0cf89b752828", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909615, "uuid": "db3530aa-571e-4bd0-a5d7-e2d39073dcf1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909615, "uuid": "deb7f051-fb73-44aa-9e79-61e033c5c9f2", "value": "catalog-1366759567.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9614292a-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868907, "uuid": "14977311-4489-4134-81af-c69ea59dafdb", "comment": "Malware payload", "value": "45e137369eff3892ce71864654e5fed8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868907, "uuid": "f7bff73c-9642-4c95-ac46-ed3a88210091", "comment": "Malware payload", "value": "113d265896981601a5a18100fcaeac93411ed122f25385b9f2acc2ea98ba96c1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868907, "uuid": "6b9a9119-3d19-4f3c-b086-9b0a2524c2bd", "comment": "Malware payload", "value": "b0323895b56bd45d4eb0392a766fc64baf736fb8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868907, "uuid": "43210196-4e42-47d8-8ef3-819e506daa2b", "comment": "Malware payload", "value": "e13e0f474621a1f2d96a4917e7bdb305a198f82be3ca2cee21644493168ead20f925079302f1174be56a35040a14d9e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868907, "uuid": "5bb74cca-22f3-4c97-90a3-c37341d9f3f6", "value": "6933F1C4EF1BB858CB8373B7BC482FD66EAB025064CEE09597C6309D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868907, "uuid": "f1f16aa4-6801-4c67-94a0-8c5178774b21", "value": "1536:dAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3EK:apoAnd9gucKCQaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868907, "uuid": "79bb1440-f897-41f0-a93a-2de64e0fcd5f", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868907, "uuid": "97329ac3-c280-4f80-93cf-a3202e93a817", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868907, "uuid": "6de5c33f-a31d-446d-b55d-3aa81be4fd28", "value": "catalog-794962528.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fdb441-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868388, "uuid": "45569c0e-ee39-45ca-a759-860bea452633", "comment": "Malware payload", "value": "345f99ad0fdcd6cdd94c7a635c309716", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868388, "uuid": "cdf39298-3434-4461-86ce-e1ebbd35d1f6", "comment": "Malware payload", "value": "11482c647490d688b97d082432bef6ea34ff71607fb5c6074b42d7202a12b101", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868388, "uuid": "1adfd0ae-3e7c-4464-9a15-a79d3f961700", "comment": "Malware payload", "value": "e6b581b62868c952ececac72eb51822683ece9c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868388, "uuid": "48c16f15-0317-49d7-87dd-a34d7c165f47", "comment": "Malware payload", "value": "96ec026fb1eb91aa6083a081eb3800903e4fa9440322364620948b857b49ef68c52c53143d7fba4925f3664a595dcf6d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868388, "uuid": "583688e0-b692-4f9e-ae5d-ef818aa40ddc", "value": "4333F184AF5BF458CBC373BBAC442F975FB7026459DED29867C3309D01C2E6617142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868388, "uuid": "24a837bb-9f2e-4145-83b5-311d75976d03", "value": "1536:eAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSY:VpoAnd9gucKCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868388, "uuid": "b0e1329b-a355-48ff-b732-14d80df7f315", "value": 51570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868388, "uuid": "7b9b6ff7-da65-4816-b9a7-7833cdf42f07", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868388, "uuid": "6ca3e109-f480-480a-9d53-4912cc71531b", "value": "catalog-37563346.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1531f3dd-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914647, "uuid": "47eeedf9-8517-4ee7-869a-65161fb2abc1", "comment": "Malware payload", "value": "8feff3455d6406bfb5370e07bfa9fad0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914647, "uuid": "123297fd-1bc4-4cf0-b598-9e1511e5d960", "comment": "Malware payload", "value": "114c0a362f5da30de4004edf24465542a58edb10364d41a0b6eb22fe2193674c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914647, "uuid": "17989e3b-a834-4286-b428-edbf9f2b7c2c", "comment": "Malware payload", "value": "3560a5bc3f7dfdf7316c972e58ae7bb44bdb2f11", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914647, "uuid": "285badfc-5482-4d1a-a326-4c526775600f", "comment": "Malware payload", "value": "c3b572d35dd2938f3cb89531205e1d7f0e47270f4ead9a68c5894654c30543d7838eb400228c95a1b0f5d68feb87b23e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914647, "uuid": "0c299aad-958c-49a6-afa3-ed3a7db5d5e2", "value": "DE3301C19A13E9D3C7F9DE13086923D4935F959D35203CA85C3E698280FB558D8E3BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914647, "uuid": "b44d2c89-2ce8-47e3-ab86-f46a900b404e", "value": "768:ko4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STpnu:oeKCVQbp4LTaI7ZaiNQMIXDpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914647, "uuid": "16e1c580-75aa-4863-ace6-ca483b52a878", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914647, "uuid": "68d123fb-4180-483c-ad03-064a5090ca6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914647, "uuid": "bd5edd6e-07e8-46a1-af50-43cc81b86362", "value": "statistic-1177847252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f18686-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915880, "uuid": "00d710e8-60a0-46ac-88bf-99b2d98f6373", "comment": "Malware payload", "value": "6e4b6df7a248dc1507277c121878fdad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915880, "uuid": "825f3aef-35d1-43df-b165-bba6f93dcb44", "comment": "Malware payload", "value": "115008a781f9a795639c658773b640ef634ca62258ba45259b827427395b215e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915880, "uuid": "a16ad6a7-52fb-49bc-9143-4e7f03443171", "comment": "Malware payload", "value": "4475337ee4f8e863933085c195f59a674d32103d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915880, "uuid": "4a600f40-cb8e-49ca-a27e-645a14cfdc43", "comment": "Malware payload", "value": "de75dc0ded7806832db05713fbe85d36701b760b5b74d8ea6f85fdc18cb713ec4a64ced4502ef6e0c1c3609f07284fc3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915880, "uuid": "a93f9c0b-7d7f-4c7c-a086-912a973dbe93", "value": "C233F1D56A23F5C6CBA9DF9704A623A8535FD89C31643C68093E298341FB164C4EABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915880, "uuid": "6cdea3a1-976d-41f3-95df-9f4251d83caa", "value": "768:Wo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SSRovylD:ueKCVQbp4LTaI7ZaiNQMIXCRgylD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915880, "uuid": "65d04d5f-4fea-49cb-a08e-45fede6a9ca8", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915880, "uuid": "c0d898d6-36f4-4091-8a10-2b7255e9e890", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915880, "uuid": "f9e38d14-d939-42d4-8150-41881df91db3", "value": "statistic-2123290446.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ad6862-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867588, "uuid": "00e9faa7-65f7-4e07-ba71-e57ca6e8faf4", "comment": "Malware payload", "value": "902a980ca1d5e8fc190d29439d4e58d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867588, "uuid": "6dfdcda5-2125-4672-ad5c-41dae3c475cb", "comment": "Malware payload", "value": "11532b64d9d0059dcf70f89799e149fe1a1c9b7cae9188a66b824d60552fc4b7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867588, "uuid": "25d04ab5-89b1-4c83-8bbb-3fb485391364", "comment": "Malware payload", "value": "df5ce6545e3e3491c02ba5418f6066288ed11381", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867588, "uuid": "96125671-fa98-4a6f-81a4-cd9357ced54a", "comment": "Malware payload", "value": "d7a593fd75a8635b46edafe06a16b8023b2d269d04993f5c0bddc66e56aadd4b94c3784fef2603270926b5ed58c9992c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867588, "uuid": "933ca917-7ff4-4634-8a42-f4bba584d390", "value": "3733F1C9AF57F818CB83737BBC482F977EBB0254649DE1A55AC6309C4292D33661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867588, "uuid": "5c401591-aab7-4bd6-8cdb-27f40b348086", "value": "1536:tAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQ2N:KpoAnd9gucKCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867588, "uuid": "118794d9-6042-46d4-b5e5-9b0347ca11bb", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867588, "uuid": "2edfbdfa-b1af-437d-a92f-d8622ee9f7d6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867588, "uuid": "05fccc4b-820f-4c2d-8120-27ba360dbbe7", "value": "catalog-1719534820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4f0647-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873883, "uuid": "c8b0db1b-ede8-4849-8f73-dc8d353a30e0", "comment": "Malware payload", "value": "355b69741363884967c40a55a3d8e13f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873883, "uuid": "bb27cbe0-1064-4461-a093-e2b6bd680b6a", "comment": "Malware payload", "value": "1153c106ee5052c6aed054defabfaa383ea9a522c1ff3bdd5250a77228e2d540", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873883, "uuid": "db1b9644-2132-4591-98cb-d0aa4a15a9ac", "comment": "Malware payload", "value": "e273caca31e86b9f5ef6f2398619583e450bec43", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873883, "uuid": "8a8b743f-9df9-44c6-9f97-6325cdf0644a", "comment": "Malware payload", "value": "fcee14d1338c010f4e6eb1b8974ad7c8ba1112e84728e7a792af3787f2ddee12f722dfdf2dbac96034566517696dc1d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873883, "uuid": "35b46632-d4ab-440c-9bbb-10641e3119cf", "value": "6A3302E3C352B2BCB643C049C9CC1E979377427026658EA2C56DFED1A63D7120B61BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873883, "uuid": "5b9a7e86-ac28-4f62-bf44-29f258074e62", "value": "1536:K/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8Lemu:6XKAXh3TCdOi+KSZ4WpRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873883, "uuid": "5d03c219-912c-4ac1-bbc1-b33f46d385ff", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873883, "uuid": "93e4f8b1-1c0b-40c1-bc38-5b102283b9a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873883, "uuid": "1149e8fd-a8d3-4c14-be8d-e718b18445a9", "value": "statistic-435414195.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de50876f-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909401, "uuid": "b6f81cb8-93f2-4a69-be4d-2b7a82e1aa15", "comment": "Malware payload", "value": "a543b173af9beb30e0c7d67e97080e8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909401, "uuid": "cdc176c1-fff7-439c-ad1f-de4a9b140de9", "comment": "Malware payload", "value": "115f4d409754df79c3a03f5c48609c638cad0211254f905c41e15244fc69039a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909401, "uuid": "febd3f4e-b0b3-44c4-91ed-10b849adfad2", "comment": "Malware payload", "value": "bee3fc3bfd99772fdfdfbe08462e9041fd210f2b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909401, "uuid": "cb700eb1-924c-429d-9ab5-c1c193066a64", "comment": "Malware payload", "value": "1d4c1262e06fb7be994342761a6f87ac5639571bcb9fc0a7500f8ede5cd30bacb05a44d2a7307b31414634dedaf7b35e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909401, "uuid": "049c7ea1-b3ca-49ac-a026-5d8fd203c9c6", "value": "763301DFD009AAB7C39B53024FA5AB6202FD754CF13096689355C2FAD6832C285799E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909401, "uuid": "094e3ab2-18cb-45f6-ae3f-a5c03a65d1d3", "value": "1536:0xTuDqsF1Cnc3P57oj2+nC6uxkLlyx2i7:0xTqqsF41j2Pxml5i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909401, "uuid": "89af027a-335f-4d20-b46f-3eafdbd09090", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909401, "uuid": "4fc491e6-883e-466a-bccc-bd9963ae4998", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909401, "uuid": "2b803d40-9d5a-4a2a-928b-0dc8588c47ac", "value": "catalog-1220667023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c870fa-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620867905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867905, "uuid": "56f1fdae-7635-41d6-b01e-3a54bbb4f0b9", "comment": "Malware payload (Dridex)", "value": "f3f12cfd451f75f3e4d8c2332212c9ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867905, "uuid": "604a0de6-7238-4ad7-a755-a45ceafa5c19", "comment": "Malware payload (Dridex)", "value": "11681529dc7116f350847af31ed0957e05c76516d5791ea15750e98844eacec1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867905, "uuid": "b8a9ece7-d92d-4a3e-b209-c9cce4d907db", "comment": "Malware payload (Dridex)", "value": "8b35af27d71e513ffd37472d2ebbdf94fcc99923", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867905, "uuid": "b0fa4d31-68f5-4b2c-a0aa-5a47c3494e10", "comment": "Malware payload (Dridex)", "value": "ed087b97b8d00057ad1ac4291961073fdc0c42424c8aa1bc6563529967803c561181259c653023797a72b15dab555487", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867905, "uuid": "94ddfd60-f164-4ff0-9064-cf96c4a85718", "value": "96F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867905, "uuid": "313b862f-7c3c-4572-bbcf-8738b03474d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867905, "uuid": "cf5f15b5-f7ea-4666-9c41-9f90bada3759", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867905, "uuid": "77b25e97-7810-4431-ab65-935eb442a76e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867905, "uuid": "a17918f1-259c-4e7a-bfc9-5bba74bee6c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867905, "uuid": "3321c193-7b5b-4653-af76-b349fb9aa320", "value": "f3f12cfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3ab84a-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868538, "uuid": "7555ff90-e4ff-49f6-872a-414ccb642d14", "comment": "Malware payload", "value": "c4c3a67842d2cd7d3911dab85e614a44", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868538, "uuid": "0bce7dd7-1439-4ae4-863f-78c36e4dfce4", "comment": "Malware payload", "value": "116fd0efdc26a0979b646175b11130ef9127e1cddc226a9dca4b23de968702f9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868538, "uuid": "c805f841-ae9b-477c-b7ad-ced4ad861951", "comment": "Malware payload", "value": "f737d7e1e0b0684615da12c9374a7f07e46d6b07", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868538, "uuid": "a565df37-5ab8-409a-ba0a-1f7bf61ee162", "comment": "Malware payload", "value": "30e60f186ce8cacc48e6f32b8e8891f7428b95f2b26e068a4874c1def9520a3dde589582cf07fe756967b41f47b84682", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868538, "uuid": "14dffc06-2e86-403a-8b56-e0680ad60565", "value": "9D33F1C9EF5BF418D79373BB7C892F976EAB0224558ED19857C3309C0292E62661027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868538, "uuid": "4e0faec8-aa4f-4eaf-b1ad-27b10428a27c", "value": "1536:pAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrgPh:epoAnd9gucKCf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868538, "uuid": "1d416fde-57ad-44e9-9f26-7484ea51ebbb", "value": 51569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868538, "uuid": "1afb8ee3-e324-488e-aac7-c23122ed717e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868538, "uuid": "a59abcdb-bfa0-433f-93f6-4bf622af96fa", "value": "catalog-49603494.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a494ea79-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874515, "uuid": "97a1fe66-a13e-4fcc-b572-f083cd0bc8cd", "comment": "Malware payload", "value": "fe0a15eb74200364bc03a6875e2c09d7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874515, "uuid": "5af0db13-3773-44b7-a7be-8f0a8a719c44", "comment": "Malware payload", "value": "118249886d62ba805b19fa4db227bd77bf9d17bb5fa5def26b5c1cdef46a57db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874515, "uuid": "a7f04b95-65bd-4376-a593-7d21f2b84dd8", "comment": "Malware payload", "value": "fc254e7f6a8bca51f569d5e66ff8247a42fbfd38", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874515, "uuid": "9f238a9a-7db0-442d-bd1f-67e7f3280748", "comment": "Malware payload", "value": "e3b297fe2d598e761911d99be4342a4e1772bbebc5943954c6b5bc42385b9fd79593a6a194072b715aab31b5db16e810", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874515, "uuid": "0d195f16-e51e-4f4e-9f2e-00e14d533145", "value": "423312F2E643F6BC754351894BDC1E6B523B4220525D4CA1C55EEEC1823D72A0F61AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874515, "uuid": "d2bcf310-5db5-474b-8fa4-43660e920639", "value": "1536:2/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMa:+XKAXh3TCdOi+KSZ4WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874515, "uuid": "9e7aef4a-8bc9-4a55-a373-0bc1ec9254ad", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874515, "uuid": "f6dbe487-73d6-4716-80da-0fdfeb611260", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874515, "uuid": "1517e443-999a-492a-9a2b-6b6dc7971506", "value": "statistic-929009667.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e73b51-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866650, "uuid": "2306aa52-ce9c-4939-bce7-a31a528f5dca", "comment": "Malware payload", "value": "fadd6dd11b41e4365de867f1465962d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866650, "uuid": "9500eeed-1342-44a2-9c1a-e3945bf9f0ae", "comment": "Malware payload", "value": "118a33328fdc06e2ff3f0606fbacf2a2dd38ab2bd09ded4df4da99c199b84d0b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866650, "uuid": "f99de29f-47c1-45f8-a450-393c76379da5", "comment": "Malware payload", "value": "90fa378e99f8763b0a44f8be56622481a5c86aef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866650, "uuid": "b6315244-4fe9-4c9c-91d8-59510624af19", "comment": "Malware payload", "value": "73b50d7bb4fc6a79a6bb8bfbd28f47325bf3485527ccc9d4389c61c4065d66c75160181bc0003838bc294207cf710cf3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866650, "uuid": "f9cfbd22-c6ea-430a-beca-9f7b4aabcd22", "value": "9C33E1C9AF57F858CB83737BBC582F977EBB0254649DE1A55AC2309C0292D33661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866650, "uuid": "0fa4f83f-b037-4f99-9f5b-4c19a350df58", "value": "1536:nAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQ6i:ApoAnd9gucKCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866650, "uuid": "dfd1259e-91b2-41d4-b4ef-9890926dc375", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866650, "uuid": "792f0260-e1a4-480a-805f-c44fdbc89c63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866650, "uuid": "055fa30e-77b8-4913-bcc7-aeeac09ad48c", "value": "catalog-1013138604.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a09c9c2-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872645, "uuid": "7d68c83a-8f4b-4874-a6d7-b45d71963802", "comment": "Malware payload", "value": "3f5d60fc62da15fbff7b119654311f6a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872645, "uuid": "7e4f463c-c675-4b6f-82cd-35e9ebf9d02b", "comment": "Malware payload", "value": "118b6650e09170eaba22207675e99bfdd1ac21a4fefa03927294255ac77c459a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872645, "uuid": "d73a7bdc-f28e-42dd-af33-59f83663a6bc", "comment": "Malware payload", "value": "4e2ee29b7968320500b08e4cd191e19f6c97148c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872645, "uuid": "fb41e1d5-939d-436d-91c1-d434e5ddb65e", "comment": "Malware payload", "value": "22bef7f5dda3698099e8acc52c71577786add09fba19b9886143b25759154cec00befdc9dd56249b85a819ffa524d1bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872645, "uuid": "c2024fe7-9d4c-49c2-9694-931c4978b689", "value": "6B3312B3D702B2ACB643C1494E8C5B579237817066585EF18219EFA2D33D7170751EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872645, "uuid": "0f03ab98-3ab3-471d-95cf-666017f3fc9f", "value": "1536:2V/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBAe:qXKAXh3TCdOi+KSZ4WcAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872645, "uuid": "a662849a-2ba1-4bdf-b2e2-98f7f8d840eb", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872645, "uuid": "b99a64cc-37ee-43d9-9019-6576972a4aff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872645, "uuid": "741d74d8-b2a7-4bae-9294-e3cc93a80644", "value": "statistic-1606003494.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a622295-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910522, "uuid": "dde6dc6f-6ef0-4069-aa7c-08e2e1a72509", "comment": "Malware payload", "value": "6292d8285cc0839783a92b1896668bb7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910522, "uuid": "4fa97e16-e4f6-415a-8941-564948c2a03e", "comment": "Malware payload", "value": "11a82d99ae5fdb5cc4438188e30ebe799356cbf1671c1c893f1e797ea1b516ec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910522, "uuid": "8162b531-b2f3-4c9e-8785-269f94e703d6", "comment": "Malware payload", "value": "9942a353a1ae6fac1c538ca82dec2a222c31d885", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910522, "uuid": "01971a07-1900-4287-880a-321460d14f97", "comment": "Malware payload", "value": "dc3a640dc4ce0a68e281b40746dec4887532b3b79ee26ce6cce58268c9d38272c593dfe67840c589ec068717fcbedcf6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910522, "uuid": "441c354d-274f-4ff8-b265-26b77f507048", "value": "7D3301DFE415AAB7C1EB66014FA59BA302FDB54CE0308628C754C3F8EA835C2853E5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910522, "uuid": "9dfbd6da-e434-4b67-ba6f-bc6847609372", "value": "1536:dxTuDqsF1Cnc3P57oj2+nC6uxkLiO9Kr6:dxTqqsF41j2Pxmip6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910522, "uuid": "00ed1681-1d08-4f27-a753-45cf702e7e1b", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910522, "uuid": "bab52ffe-a811-424d-8256-6871d9d06154", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910522, "uuid": "ca7a42f6-f156-4171-935d-a3e43ddec825", "value": "catalog-2077572488.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001f00cc-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910317, "uuid": "41626934-e56f-401a-abd3-0e1e41a213ee", "comment": "Malware payload", "value": "06ac491c33768e0fc4a205e5d9e137ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910317, "uuid": "72fb1339-d3e5-4fbf-81de-5353b89feccf", "comment": "Malware payload", "value": "11a9dda5ef6f101924c49ecde5c9a00c5c776fb71701eda53dbc83499920eb8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910317, "uuid": "26c1be41-cd64-4ff2-ab05-de1053b693cb", "comment": "Malware payload", "value": "ea5e23b66e89996fd0865bcb433a7cb90870ec5c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910317, "uuid": "1f9e37e2-e892-4428-a70c-0359ba64aa2c", "comment": "Malware payload", "value": "0edef5c31b37a030960e32101dd8a029c4acfb9997099921b9ded0a2fd2390ff437cf8cb9c0fa6de18a0ddda976f9239", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910317, "uuid": "55f9c984-4a96-49c3-8a1e-110581beb287", "value": "BA33019FA048EAA3C19B93015FF2DA9303FD795DD1709658C369C6FAE5836C1C03A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910317, "uuid": "9a434670-95e3-42fd-b7b8-ee6fceea1a7b", "value": "768:Mqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0BCu/EM:FxTuDqsF1Cnc3P57oj2+nC6uxkL0BCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910317, "uuid": "1ca54284-4290-4c30-ad0a-3981a4b3b46f", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910317, "uuid": "6be5fc25-d206-464c-9d28-c8259b7c4e57", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910317, "uuid": "09e82b65-9b99-45ff-918b-e4abf8940aba", "value": "catalog-1911367047.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184fb173-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871702, "uuid": "0aa229c1-b21e-4fa4-a4a1-c39897fedce2", "comment": "Malware payload", "value": "67a78b2292aa5d0120dcc07467c8715a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871702, "uuid": "f0f781c5-52f0-495d-8f66-042cbafcd5d5", "comment": "Malware payload", "value": "11b432f862af5f9e511dc78a35cc24a39429289f90b18fe366947c190ae25606", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871702, "uuid": "799b233b-3b7a-47b5-b778-916d8077e8f9", "comment": "Malware payload", "value": "d269b3eac95727f619f7f4a38273fb48b03df052", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871702, "uuid": "19260a41-3374-4a4f-9ee3-d682b4856b2a", "comment": "Malware payload", "value": "0cb1143f05477236eebfef2d2c1a7947e81d3d6bd110c23cff22640501cdf94daf2948829b92dbeb6469a8c3b0c0511a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871702, "uuid": "8fc97fa4-e5c9-4853-a950-3a27ec2f57e2", "value": "4133F19133F9E900C6F2C1F094E17589374B3D918DB95DEA0C94A5B93F931A0CBE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871702, "uuid": "75890047-dbc0-456c-8941-677484ad888c", "value": "768:K5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJbD:K/czJJSI7r3Pwh8RZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871702, "uuid": "1c23c37d-6f3f-4d1d-af9a-f7013c95b6ea", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871702, "uuid": "32a906fa-4278-4158-a0df-36fd36ad660d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871702, "uuid": "993a5504-0395-4764-bcae-9c99de8cbaac", "value": "diagram-899225035.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4822fce-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913706, "uuid": "e0e0c419-c45d-456e-9a8f-fe9505ed1423", "comment": "Malware payload", "value": "94b658c172a0780fa7b8a914e244be8f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913706, "uuid": "b53ad69c-2cd3-4fff-9148-ada6c3e06cd4", "comment": "Malware payload", "value": "11bcc971e672a74d602a37e852c263c41c30c57835c780e4aa632def9fc1122c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913706, "uuid": "7a0258f8-bcdb-4d18-8637-5c6bd72c957d", "comment": "Malware payload", "value": "2d45e78dee41f7e236064eb440b5788dbb163f9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913706, "uuid": "cc831315-711c-403f-8281-d7135a0bbadf", "comment": "Malware payload", "value": "08b51015f8072dc2f17b33132e7e28e14b9a667c0ecfac34eea1dc196378c9b9c581574011f4ed424802d14dd160e8a9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913706, "uuid": "998cc457-cf7b-4825-abda-f23600e2a968", "value": "3133F1D132DBC53AC0C245F6F82B6DDA66978BCDE930D4D02E9FDE4112D2165AE9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913706, "uuid": "c67a2c59-b971-4f13-a88a-76be0251d6a0", "value": "1536:HEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYn2:knBrX5Eg5Enjq3axWIfkNwY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913706, "uuid": "e345c13f-787f-4dfc-915e-e0c1011a78c9", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913706, "uuid": "5653d245-a585-4c70-8322-1811be9ab29e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913706, "uuid": "56ed8a6b-4713-45db-a091-c178258f1c52", "value": "diagram-501333474.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bed3017-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912618, "uuid": "58a2900c-9f37-4db0-86bf-8dbe10cd6362", "comment": "Malware payload", "value": "e5dd35fd9ba7e6e4522b171ac40b688f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912618, "uuid": "3f9cca1e-cfeb-4b19-a3bf-68bf5c0ac9ac", "comment": "Malware payload", "value": "11bf7288ef49e63227479a4b7efbcefeef16270bd9d0f7c7189a5e24000012c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912618, "uuid": "691c473c-a3c7-4b44-a0b4-6c7149f12fef", "comment": "Malware payload", "value": "87314aee523ce9c3abc689aeedf45249c5803d0b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912618, "uuid": "94ef7422-97bd-45c5-8e77-b57fbfaf1d18", "comment": "Malware payload", "value": "0d2db10e39207401c5e4f996d922800212aef03eb4afb051fcfb4eb1409ee018fbeafbd130dd9e0ed4fe5b472fe59423", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912618, "uuid": "527086ca-0c0e-4b6b-86f9-b09208817e86", "value": "9033F2D232D7E23E80C605F7F91F5ADA57B78A99E83090C12E9ECD4212E31656DA134E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912618, "uuid": "782178fe-641c-46c8-ac44-d7e08a680219", "value": "1536:xEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwnqj:+nBrX5Eg5Enjq3axWIfkNwnqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912618, "uuid": "bfb2d694-82d3-45c0-b1c8-c8518547051c", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912618, "uuid": "11eaf870-3800-4d07-8e21-8ceba69a4dfb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912618, "uuid": "5db25016-72d8-4d76-9b77-69df13f273ec", "value": "diagram-1781033964.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be48ad4e-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914501, "uuid": "11279b46-2f69-40a9-a2b6-a55de672fff7", "comment": "Malware payload", "value": "921f5aa191243542d7259b9ebf655995", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914501, "uuid": "bc7aa9b2-8db1-4d05-8b8a-82f555987537", "comment": "Malware payload", "value": "11dbd14278781227ab7f1dafa57e678354ce34d59d10a6e8f16db328a48d8b19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914501, "uuid": "b7b059e3-dbe4-420c-833b-132f893dae74", "comment": "Malware payload", "value": "0788b516884f545a52b2f0e743113352e9efaf67", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914501, "uuid": "e66742ef-eeba-4f29-893e-62f7aa922b04", "comment": "Malware payload", "value": "8b2f1f7350f74b8c6bb7ce1e42c94ca60565e2a2ce07127e844b08bb3e8eafdb9bf2483105d1963d3655bd1c1c8769b6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914501, "uuid": "922e8815-055e-4c0c-afba-56441886ecd4", "value": "F43301C56A23F6D286FEDFA304561395939FC89D31243C98182B658281FB158D4E7FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914501, "uuid": "c41c88b5-d8a4-40f5-910e-e9b42d62d88e", "value": "768:6o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkfDUIt:ieKCVQbp4LTaI7ZaiNQMIX0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914501, "uuid": "7ddf87bb-f548-4471-bf6f-2e79192a511f", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914501, "uuid": "b53edc80-5dc6-4db6-946d-e70625c3a6e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914501, "uuid": "851778b5-4ba8-4c7b-9b64-75be4d4f40ec", "value": "statistic-1087536603.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ef9adb-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910081, "uuid": "baf4f177-673d-4728-a03b-12edcdb06dca", "comment": "Malware payload", "value": "a901c65f6465fb4161851d875257007d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910081, "uuid": "a54a97d4-c52b-4b53-8c0b-ce30f3490e60", "comment": "Malware payload", "value": "1205f36a1c29f92542bcb2d8aafac9791570ea5e355fca3d3d87f529623dd268", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910081, "uuid": "c666007e-6bc1-493f-b336-9f4ef87dc1d4", "comment": "Malware payload", "value": "1ec8ae28b47b6419b3051998b090bf196a4c1b16", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910081, "uuid": "2af6b427-2c5e-4307-89af-7cd5f3af1321", "comment": "Malware payload", "value": "05976c52f884b8b04ca02332ab4de226ac178cd27abcb9d9131955068741c100b8c31cb7d5be2d1b8f232a423c4906a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910081, "uuid": "e2a52435-d470-40b5-a0fd-3f4bdbd2d659", "value": "AF3302DFD009EAB7C3DB53024FA5AB6202FD754CF130A6689355C2F5DA832C285799D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910081, "uuid": "1a6b7a4d-b516-4e93-86b5-4a4f5e7fd479", "value": "1536:HxTuDqsF1Cnc3P57oj2+nC6uxkLlyx2i0:HxTqqsF41j2Pxml5i0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910081, "uuid": "b68cda2e-49fa-4147-958a-e8150ea1d2ac", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910081, "uuid": "c4d9df37-7386-49f0-9e96-acf7aa7b78d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910081, "uuid": "99358d69-f8f6-4911-a116-15958f414788", "value": "catalog-1732157890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56414175-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910032, "uuid": "679d20e6-fdfd-4d6f-b54b-a77132ddefa0", "comment": "Malware payload", "value": "4fff13f33bb571910408f96181e8a8ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910032, "uuid": "9a3421c1-2347-4b46-95ef-59df64e64776", "comment": "Malware payload", "value": "120f00054253f28e9567042f78075e8497d09bc1177102f3af92c6b3a3b86091", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910032, "uuid": "6d20d520-50d8-4e82-ac74-d0a5c980a5f5", "comment": "Malware payload", "value": "c132c0a33b02451d91c98db73e066414475b6a19", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910032, "uuid": "fb6254a6-4524-4257-887e-22196ebe4359", "comment": "Malware payload", "value": "250c155df36bcef041c6a02b14f2218b333b9ac719bb536a5cfc216f35bdb3b4395c1e6522a01adcd14f303940367dfa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910032, "uuid": "61f7f104-7bde-42ec-855f-14662fa1a9ef", "value": "233302DFA014FAA3C1AB67015FB9D7A206FC791DE270D058C35AC6F5E5C35C2852A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910032, "uuid": "f828c68d-e5a5-4755-8d7d-9c04044dee9a", "value": "768:vqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7sLq:ixTuDqsF1Cnc3P57oj2+nC6uxkL7su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910032, "uuid": "51fd0733-0e1a-4ee3-ab83-604ad785cbce", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910032, "uuid": "5b1ca2b1-3c46-47be-82ba-48506a4b9743", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910032, "uuid": "ef434893-7856-4eac-8988-0bdb0c334047", "value": "catalog-1689296893.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1864b5d-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913191, "uuid": "cab5a0a2-146b-4776-976d-be71e39cb6d2", "comment": "Malware payload", "value": "294f944368d993e2b9c5dc0107032660", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913191, "uuid": "c35dbf19-13d1-493f-b35b-252c49283e06", "comment": "Malware payload", "value": "12144a4896b739e39183ef829918040f799746b710874e736842260ba292145d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913191, "uuid": "0d93a1cd-c1db-473f-843b-176b2e850969", "comment": "Malware payload", "value": "e8d4d1821bec43c640a9e23fdd4fc6f0a047a2dd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913191, "uuid": "d957559d-d1e3-4849-8b8c-a6eda64daf48", "comment": "Malware payload", "value": "0f22a4f1095aa17d71ef08313ab28210baffcc32b91ab42aab8cc6ba6d8a3141cfa35a15e98c8cae278315e66d0a42c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913191, "uuid": "889cef42-192a-430c-a24a-87965c7bcec5", "value": "D033F1D232E7C23AC4D504F1F52B6AD952B79EC8F43090D01E9FDA4126E31B5ADA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913191, "uuid": "0b488cd6-4c5a-4ed8-b63c-dad02d65b37a", "value": "1536:yEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRlY:XnBrX5Eg5Enjq3axWIfkNwRlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913191, "uuid": "9c7b07ee-04c2-4e82-8ac9-a47e6d720054", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913191, "uuid": "83262988-3ffa-43a7-a4a4-3284ba394414", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913191, "uuid": "acfbb31b-f82b-49e2-91b0-283797ff8d16", "value": "diagram-2068429401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888f14dc-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867166, "uuid": "12b2a11a-a618-4fc2-8def-5931c8ca1c5c", "comment": "Malware payload", "value": "d4495dd27d9ff94776d9326ee0e11fa3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867166, "uuid": "1056fe59-31ff-427b-b60f-b70cb17f6a9d", "comment": "Malware payload", "value": "1222f223abe87d692135151cd6a341569e4cfade08ddccef0b08f43e6f7326fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867166, "uuid": "fcc54afe-6281-4c67-87c6-01505a516e3e", "comment": "Malware payload", "value": "5d2485e1f29367ff72a6e9a727f727a749984262", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867166, "uuid": "af0b5744-2644-4281-a639-6972c15acc67", "comment": "Malware payload", "value": "1bed4155ca5605ea3eeefb60272973cb089f797138ec56cd9032973e8ed7f5e138c8154d054ed89d37fc04f90b8d2144", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867166, "uuid": "8bba1124-f37e-4e25-889a-1884b5ecf355", "value": "7233F1C4EF1BF858CA837377BC882FD66EAB025464CEE09597C6319D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867166, "uuid": "49dd0329-1a9f-44df-97c2-4aea34fbc7c7", "value": "1536:PAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3y8:IpoAnd9gucKCQat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867166, "uuid": "fb16eca4-7c0a-40a0-a01f-6e89d914f7f1", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867166, "uuid": "dda7d03a-a28f-4b0f-a8d1-a2c1fdba3853", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867166, "uuid": "ec79d45f-96d5-47da-9ea0-b0ac0995e2d0", "value": "catalog-1377062062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feed37ed-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916757, "uuid": "6eff5a71-d748-485d-bd52-c6fdb6c3f7f6", "comment": "Malware payload", "value": "f821cf3a7bfbdcb2d3af6ee119ec92e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916757, "uuid": "48df8f8d-8bee-44a9-ba0c-413bf5173f3c", "comment": "Malware payload", "value": "1225f520aab4f846a8d282eb9bc1f9b32a2720c3e9688de3bda0f8db82c06ac5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916757, "uuid": "0bfab1eb-d26c-40c7-9fe9-4ecb81751f4a", "comment": "Malware payload", "value": "fbe0023679a89c247d2f149342a3111986d8e1f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916757, "uuid": "869c23d2-b8c2-46a9-bcfc-159b45f18faa", "comment": "Malware payload", "value": "3173c93666e16346d1a12647d202381c65435c55b0f29088ce413555d082a187860cc9dfec4e3f31ecc6b30d1d850b9a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916757, "uuid": "92ff5a3c-91e7-4b0a-b080-2d89ee989b8a", "value": "9433F1D65A13F6C6C6A9DE67045633E4639FC8CC30643C68683B658381BB198D4E7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916757, "uuid": "af318cda-e65a-47c4-a9b9-33d9b4347f7a", "value": "768:Zo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK86yT:DeKCVQbp4LTaI7ZaiNQMIXd17T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916757, "uuid": "0df01775-9d09-481b-870b-cdf69824f85d", "value": 51769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916757, "uuid": "22feb6f0-5da9-4114-baff-1c44c4169694", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916757, "uuid": "86a443a0-5be9-4c02-b267-f5bcb9a4daea", "value": "statistic-769796884.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d120cfee-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872013, "uuid": "7dcb2b8d-ca38-4571-9188-6ecfb7b8f901", "comment": "Malware payload", "value": "c354bdfb39aff65e664b4c7db0fa7327", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872013, "uuid": "f15fb8a6-9fae-40ab-a28b-e82891d6a30e", "comment": "Malware payload", "value": "123897447ecba120d507d7de54956450458b2e207c7cf745226ee8ebd2a3d820", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872013, "uuid": "de258fa1-6a5c-4743-9feb-1e037e1e4124", "comment": "Malware payload", "value": "2a104042f3e09e18e57f7d0247d228e0589014ac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872013, "uuid": "a294b44e-1614-4f65-9307-2facdb66017a", "comment": "Malware payload", "value": "648f2e0b096fd34008fe050176b03737ac052f27db5f544b4f526b45cd3534bc59fb578a6ff59f7c931f6efae4dcda32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872013, "uuid": "cc33eca1-0843-4bcc-bca6-81d3b7e04c74", "value": "D03312E2D34276ACB74280864ECC5F37427781715A588E70860DEF92D33D71B0752E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872013, "uuid": "26970296-5044-4bd0-b01b-bf4866428d2c", "value": "1536:dG/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4We+UF1Ad:4XKAXh3TCdOi+KSZ4WvqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872013, "uuid": "b0b5ddea-a79d-46f7-a0b3-2f3615e24644", "value": 51606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872013, "uuid": "3b0757b6-6189-40d4-b87c-146d15be1583", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872013, "uuid": "c8071950-15b8-4fab-90b3-851c0ae5fe9d", "value": "statistic-1144677998.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a873ff4a-b38b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869797, "uuid": "6f02c929-152a-41a1-87d3-e3ccef85c6f3", "comment": "Malware payload", "value": "5644582f2d7304a8c4cc1f8b9ec5b99d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869797, "uuid": "8b185d16-7ab0-47d1-8027-65130c153d44", "comment": "Malware payload", "value": "12428785fcbf91119ea1d23b4bfa8dbf77da005e4a285fb6b885645efbea3307", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869797, "uuid": "a7587060-843e-493c-b4ad-557a69076bb4", "comment": "Malware payload", "value": "e7fea551c0bb88e9347357650582838f05917281", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869797, "uuid": "26f3f2bc-4ddb-4c0b-82cb-444de0f5a41a", "comment": "Malware payload", "value": "b3c70ac7bbd0e20343aac40a17ae698cf5c7aa8b2d9515011fd9dda2277bf1b1cf3ad5d4c23aaf2dc70eac033da444c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869797, "uuid": "fab25773-38fa-4bdb-842e-6632f70a02b0", "value": "9433F2D473FEE510C6B1C2F0A492A689364B3D91897D69EA0CD464693F831A5CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869797, "uuid": "288edb7f-d1b4-4d48-a754-bd26a220905c", "value": "768:55G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8rRVIWgN:5/czJJSI7r3Pwh8tv8x8N2nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869797, "uuid": "1e4b4d98-396c-4f34-a307-66bf21de2e4f", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869797, "uuid": "bdf1b573-e138-4d8d-afa5-2306cadc2ec8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869797, "uuid": "f1fe011f-543d-4629-81a3-b0b400e7fd58", "value": "diagram-1445549021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381c5362-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909981, "uuid": "3b72c907-0331-4472-b62a-676a9b52e468", "comment": "Malware payload", "value": "7e64fdafaf7f754fb4ea37a99b3d94c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909981, "uuid": "ba6575ca-6757-4f32-b46d-57bac67cf225", "comment": "Malware payload", "value": "124c53ef0b12f7be2c2e57ad7ea0a5d9ec405f25c5073a44d173d760334d1e97", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909981, "uuid": "38b7e3ff-12e9-497b-b9e0-67fb01792212", "comment": "Malware payload", "value": "8a02d4bbf201d037bed5ccde6ed39101eae27086", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909981, "uuid": "75b3a3f1-8ddc-4636-a1aa-743aec3115ec", "comment": "Malware payload", "value": "118f19307978082a5f13f23774190bc4677f5dbd844a5e5843b00bcbaa8f6aca570d4d58dc2d9ccb869c2df19edbef54", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909981, "uuid": "9b155c01-4032-4b1c-8992-208dc262067c", "value": "7B3302DFA008AAB7C29B57026FA6DE620AFD765CE03091548369C6F6EEC35C280795D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909981, "uuid": "ce31be1e-f511-4c09-a79e-2c28e3da20c7", "value": "768:Jqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOXv5:UxTuDqsF1Cnc3P57oj2+nC6uxkLOXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909981, "uuid": "4f9db27b-9ad8-4a8a-a281-bf20942a99dc", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909981, "uuid": "e1df8fc5-f2f6-4343-8f09-f857a7b2e490", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909981, "uuid": "5582a8bf-d6db-40a6-aa7f-85a20da1b403", "value": "catalog-1655995250.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80672517-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910532, "uuid": "e0b4fc3f-9d07-454b-826d-ebc110e09aec", "comment": "Malware payload", "value": "4b3f840443f10b316797390ac7fb6dd4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910532, "uuid": "1ad8d60f-017e-4457-a853-6d4efd318a8a", "comment": "Malware payload", "value": "1250c05520d45f775c7ca6301db3181c40db77a800ba82c6bac659740ee6122b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910532, "uuid": "1917ffe7-2444-4cec-aca2-6d4354417f53", "comment": "Malware payload", "value": "fbf765cf5476f45ae55e532dbb4d33b5008c51ea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910532, "uuid": "43fabc00-0527-4a64-8a18-fb9eec9b1708", "comment": "Malware payload", "value": "dcfa8d562851a292e3572377df7a6a4af56943546c1d629fc1cd137c38e398e5095b336c4f7d253f5027033d08f7d821", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910532, "uuid": "8848ffcc-f8bc-4473-a723-760c1d17e3e4", "value": "0133029FA014EAB3C29B57005FF897A205FC7918E170D16C935AC2F9EAC35C2857E9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910532, "uuid": "5204034e-3f83-48d3-8f28-ffe76a3c1486", "value": "768:cqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7OKa:VxTuDqsF1Cnc3P57oj2+nC6uxkL75a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910532, "uuid": "00b82512-c881-4b6c-889f-e2b3e4f47752", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910532, "uuid": "9793b674-f309-4459-8919-cc5c0fe583b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910532, "uuid": "bda66a8d-3781-498f-9d61-ca27c47216f5", "value": "catalog-2080064519.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25145e2b-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911667, "uuid": "56b64acf-5b33-46ef-af96-d37827c8435a", "comment": "Malware payload", "value": "85cae98329ac8a3b3d5b74b34813b555", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911667, "uuid": "a85b424a-cbbb-4b97-9d3e-205101b2f901", "comment": "Malware payload", "value": "125748994b7bc30f15a61c003f070f7c89ec60320df57c0da8120296ef89e24d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911667, "uuid": "b29db4d3-b744-4b78-9b12-e3e0fcf2eada", "comment": "Malware payload", "value": "6fc343622befc37ebba41a89c90b76d5f5dd98b3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911667, "uuid": "763fb62b-fd02-4417-b879-08f1e14601bf", "comment": "Malware payload", "value": "2f301cfa3e4d192a29b382b7238f662a0e97ca227cc11d8690e0abefd205c49fc66f1c5670da87d8a969fa90d621ccc9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911667, "uuid": "879ec7f0-fe1a-4db9-8b57-3f8571ab36e5", "value": "4E33029FA008BAB7C19F53016FB6DEA206FD761CE03091648369C6F6DEC35C280795D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911667, "uuid": "56a89cec-e80a-4775-8e66-99c4c5876799", "value": "768:vqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOwve:ixTuDqsF1Cnc3P57oj2+nC6uxkLOwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911667, "uuid": "80b0c4cc-9ac3-46c6-aacf-75739c294f8d", "value": 51711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911667, "uuid": "0292f7a9-fe17-40be-97e2-00b89a704cff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911667, "uuid": "671dc7f4-c590-4316-970f-cffcb15e7847", "value": "catalog-997611610.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4991c4-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869322, "uuid": "01cd0549-9f59-4229-a0fa-6813329a4d0c", "comment": "Malware payload", "value": "8214bb62e06ac65a57b18917a3712487", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869322, "uuid": "36671927-dade-4cbb-8f7d-edf972d419fe", "comment": "Malware payload", "value": "1265b1e4a1cd4a23f87306c76910e44c2472b99499ce457307ba2da0a7e8d121", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869322, "uuid": "a0db8492-d6f3-4d9b-beff-1d60853d0a33", "comment": "Malware payload", "value": "f7a42c7c3455f6a99c2369fa5cf59a7a656b72b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869322, "uuid": "a802bcc8-2793-476f-ad45-44577bddda94", "comment": "Malware payload", "value": "a2a5549b69e1583dbc890e46c30e1e0d22e487b7274b24776019d2477ba92008d73bbc45d3a3611b53d821596c961416", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869322, "uuid": "1fedc19a-2d8d-4b40-a40b-f09966f24dbf", "value": "1E33029673FAA900C9F1C2B0A4E27588374F3D914E7D5DEE4D8894793B920A1CFE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869322, "uuid": "f9486d59-e5ef-43e9-bc89-ebc049a85057", "value": "768:+5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcs:+/czJJSI7r3Pwh8fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869322, "uuid": "c9285951-fa06-42f9-857d-dc459cdbf83e", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869322, "uuid": "db1df2a6-3147-44e5-8994-f9ed87f0619c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869322, "uuid": "6c3a9dd4-28d0-40a6-8f45-31e2e440875d", "value": "diagram-114794418.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23d183e-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873786, "uuid": "32d602a0-3eb0-4baf-b06c-b5dfd1ce9429", "comment": "Malware payload", "value": "628f7fbfe5927c6764a8eef57a798146", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873786, "uuid": "50d8f60f-ca92-4160-b6ba-bf0033dc9cc7", "comment": "Malware payload", "value": "12719e5ba3a69e9a862caa282f38831baa8e011ed630f4645932ca49da561204", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873786, "uuid": "44f0cbda-8489-45e8-a85f-b6df516e11da", "comment": "Malware payload", "value": "bffc7d4fc925916d91f905aff4d80b7acdf541a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873786, "uuid": "867c806c-d86b-4b04-bcb8-e516964b730a", "comment": "Malware payload", "value": "32eb30b26f187deafa7af385ac676031dbe4e8d88347c5d588fb6edb06ca04c5dc930171b003b7ecc512dba06333dfcc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873786, "uuid": "52b0d192-3505-4968-b0d1-90bd665781fd", "value": "983312F3D602B1ACB64381494D8C5F479237817066585EF18259EFA2D33D7170B52E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873786, "uuid": "f7469a7f-fa7a-4def-a8f1-ff32f4c3e892", "value": "1536://2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBO9:3XKAXh3TCdOi+KSZ4WcO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873786, "uuid": "5472ab78-84d6-4027-8dab-3539518e26df", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873786, "uuid": "4d83b893-2f54-4876-a3f1-0b471d537a2c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873786, "uuid": "dcf36021-cfdb-4427-83e4-3731915b4bf6", "value": "statistic-352923628.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcefb73-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896864, "uuid": "9284028a-665a-46d3-a478-18656572d5f8", "comment": "Malware payload (Dridex)", "value": "0110c1a84d61a768ffc81894dc258ce9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896864, "uuid": "a8208fa2-7e4f-4df3-bee8-eec86bf0ef51", "comment": "Malware payload (Dridex)", "value": "128f88a227a96cebde355f7b66eb8506e7e8bdc26110eaa9e7418cbdaa8224b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896864, "uuid": "f8711ea1-c43f-4769-8269-0630339affbf", "comment": "Malware payload (Dridex)", "value": "d934cfe58c889e65299389a0fdf08d4e095612c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896864, "uuid": "5ebc840e-964f-484b-8415-53230798cf3c", "comment": "Malware payload (Dridex)", "value": "ca2adba015366606ee0261c425522879080a308a83b4033a9a8c632c862c7816e53ff7f78fe8b49e83328fe391e34fed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896864, "uuid": "bc9d70e2-10d1-43b4-86f3-bd4286978357", "value": "EBF3AE93E16FD1E4F6234A3040F5F47B7A7C248B86389D28C7408E7E95EBE29C06E615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896864, "uuid": "61f46071-805c-4796-8175-0a3a918c877e", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896864, "uuid": "4925c9ae-2123-42e8-a749-29cd9dca529a", "value": "3072:P3b4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:P3XvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896864, "uuid": "95d21538-8ee9-405e-8b8b-f95469ba3715", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896864, "uuid": "4d7c58ed-5169-43f5-86f2-f209c71d429c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896864, "uuid": "5c02f411-37fd-41b1-99dc-6d12674b978c", "value": "0110c1a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5d0ad5-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911409, "uuid": "2b5a6eec-45c2-4376-adc8-f91eb58292b5", "comment": "Malware payload", "value": "3c4cbc1c0855104b9d7f5755c4b9ce18", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911409, "uuid": "bb02971e-3cd0-4705-a849-8c8372979bcd", "comment": "Malware payload", "value": "1296e36b9d809b52d9495e407d4fdaf3273ec2962845d32b9b22db14c467c981", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911409, "uuid": "03b1c7d3-4a29-43f5-b75a-40413e84f5d8", "comment": "Malware payload", "value": "08e939aca5c853b086e0405a91e4cbaa7f5266ce", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911409, "uuid": "62a878c8-ee92-4b42-a0c1-ec936f9e9b7a", "comment": "Malware payload", "value": "f6c11fd3fd787e5d67da7c5184f4878015709e0f548a0fccc24f0230ee1988cf9641aadc97b1668a35c736356c97e27e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911409, "uuid": "075c1d3f-c716-49b9-8db1-4fc6d85cb130", "value": "A23301DFE415EAB7C1EB56014FA59AA306FDB64CE0308628C754C3F8EA835C2853A5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911409, "uuid": "240cc34d-0155-4582-8fb3-02721c2cfec7", "value": "1536:yxTuDqsF1Cnc3P57oj2+nC6uxkLiO91rK:yxTqqsF41j2PxmigK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911409, "uuid": "798ce07f-bba5-4644-aaa6-c1ae47100ed0", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911409, "uuid": "e93350e0-3f63-4b71-b7f1-361510e9eefd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911409, "uuid": "d2941a3a-3f22-475e-8cda-851ccca16cac", "value": "catalog-806432366.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6abd3e-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870746, "uuid": "861ed2ac-b771-42d2-b7aa-c3d204606536", "comment": "Malware payload", "value": "9a88fee2b0170807d4eb456f196c38de", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870746, "uuid": "2983e1dc-3baa-4056-b212-5c5f285db810", "comment": "Malware payload", "value": "129b8801727cae29e56d6f61d5b9d74c92f98ebd296b107a80bc6b39263d20ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870746, "uuid": "e665aaca-5dbf-4466-939c-6ca52aefd4f0", "comment": "Malware payload", "value": "c1e3ee164d512b919a7eb45051664c9bb0cd9bd1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870746, "uuid": "426fb1f3-efea-4b78-ba8b-4c523f66bbdd", "comment": "Malware payload", "value": "e97ee7c89727c758c5f3318fb6dd841e17ad8eca2c0bebd8f0ae44725964804e0a46c77516c5a72b0f9796eaacfc8722", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870746, "uuid": "faafcdf0-a9b2-4c52-9c11-9daf016aff02", "value": "3133F19433FEE510E5B2C2A090D275893B4A3D91497D9DEA0DD875B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870746, "uuid": "f9b1809d-b017-4676-9323-b6fc86add139", "value": "768:95G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccO5n:9/czJJSI7r3Pwh8Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870746, "uuid": "4ad5341f-9111-4f4b-9fa2-351dd85b238b", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870746, "uuid": "9b78e697-ba79-432a-a196-9f86be78558e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870746, "uuid": "37e428a7-856e-441f-b18c-93b20dbf5c47", "value": "diagram-2107236919.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f858d86-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910557, "uuid": "d07e5de8-6147-4251-9ebc-f1a541166933", "comment": "Malware payload", "value": "b7d1e77895c90abe3b2ce5a04fdb35de", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910557, "uuid": "f60b414e-b333-4637-87db-3e43460f094c", "comment": "Malware payload", "value": "12a3bd739b931614da626b320973016a0b532439059071736df7e258b33e98ba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910557, "uuid": "5e3794d1-3f63-45a8-a61f-69d21ab8859b", "comment": "Malware payload", "value": "3d5b020510b8b3c3c6cf99e0c8ac78cfe2c78826", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910557, "uuid": "48a5c02a-325a-47c2-af60-e4963089241c", "comment": "Malware payload", "value": "6e88dae937ef5da3fb62b708bc459ec39ba767df3bde5090a21f2e6615747adc037ca76e3f1843c8ba37394196da2a4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910557, "uuid": "f330f3fa-0632-40c1-a147-45aac0d0340b", "value": "C53302DFA014FE67C29F53015FA58BA20AFD7909D070D258C32AC1F5F9835C280399EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910557, "uuid": "ee1d66f7-8525-4cd5-b593-ffc9eaf62e83", "value": "768:7qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LpDvNPn:+xTuDqsF1Cnc3P57oj2+nC6uxkLTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910557, "uuid": "91415097-2b95-4b97-a18a-2ce2123544a8", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910557, "uuid": "93c6ee11-5d64-4be0-ab22-711fa69e279e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910557, "uuid": "3121c186-9cfa-47d5-913a-c860a15f6efb", "value": "catalog-2097704966.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107f892a-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868253, "uuid": "a6bdb468-b4d9-4f06-881a-dcf35fb83e40", "comment": "Malware payload", "value": "caf1b4e49dbfeacec9e08a80e68b0c0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868253, "uuid": "2d8c75a0-a3f7-49af-9ba8-c7c05846eb23", "comment": "Malware payload", "value": "12a45b46fff58506d0ee3b076698b2e920ecc5f15eddbbee44282020f79693e6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868253, "uuid": "8e971b4e-75e1-4b02-908b-49b6136ee8c7", "comment": "Malware payload", "value": "d3a8dbf4cf9f9b65b18e060ba0d99020f38ba891", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868253, "uuid": "e7025077-a6a7-47a5-b92b-05ebc1b65496", "comment": "Malware payload", "value": "d1541e0b8144e63c2183ef20492195175014e0c4672bcb7ec2310ed155e26aafa4a2e38f8aa5991ecb5c1ccad46a1e46", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868253, "uuid": "0b493876-2c94-4a69-bfa6-a375f191c746", "value": "A933F1849F5BF458CB8373BBAC442F979FB7026459DDD19867C3309D01C2E6216142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868253, "uuid": "7067e3c1-5dbb-4b83-bcf0-870cfbe42508", "value": "1536:DAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSr:kpoAnd9gucKCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868253, "uuid": "f413b57f-1bc3-4b0a-89b9-033d7b707ec5", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868253, "uuid": "208d18c9-d973-439d-a040-8f3f0abb35e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868253, "uuid": "ee3719f8-03b7-4a4b-9578-c9e3e32b9c9b", "value": "catalog-258799188.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d9a398-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915740, "uuid": "e00ea8f5-7860-4009-af1d-f4f31f58c757", "comment": "Malware payload", "value": "d36595a455757577e09aa3a4edb2979d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915740, "uuid": "3afaf57b-1b2b-43a9-b604-04a8374e0529", "comment": "Malware payload", "value": "12adba9dc9ff03cbab8dfd3ea0dcbf38b7bb5d7aa2cc1590da4da0656068f164", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915740, "uuid": "45d6f7fc-a9bb-4f24-9c1f-07e5e6f45efd", "comment": "Malware payload", "value": "84ab54fe73c15e1ad7ed5fd26a50d4f087ae1037", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915740, "uuid": "6882534e-49eb-4556-9901-5f01ce9a7f12", "comment": "Malware payload", "value": "2ca5ddb195b4ca38a88f70634fc21af0c7d6660670822fdc2bdfcd26cdd1972eb3008178dd1e53b5bf958eb5e0a05cf5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915740, "uuid": "8d2dc2c0-5730-4215-aab1-b208c9ae340f", "value": "933301866917F4D2CAFAEE57004623D493AFD99C31247CA8593F288240FB658D4E3BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915740, "uuid": "b8fa930f-8c07-4df2-9636-7b87c3c3b1e2", "value": "768:No4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Sd4a89aF:XeKCVQbp4LTaI7ZaiNQMIX79z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915740, "uuid": "16c8d1e4-74a0-4a68-bafa-d877eaa67be0", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915740, "uuid": "98ca7b01-4aae-4e67-94f4-57c9a2f6e834", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915740, "uuid": "9349269a-8d9a-488e-9b11-d6fcb44c6347", "value": "statistic-2037523237.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce355c05-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872008, "uuid": "916b362c-122e-41e7-961a-76176f47e9d0", "comment": "Malware payload", "value": "2634d0b10cdfacb6e89720b8107a4b85", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872008, "uuid": "9d512790-5dc7-41ee-9b23-e06f1ab2da49", "comment": "Malware payload", "value": "12b18e2d0529231205e92b9a77fdbc439fef280fd3711ca3a7f57e8948ccc3cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872008, "uuid": "a85aeef1-0e35-4c31-aeff-781efe6c1062", "comment": "Malware payload", "value": "9e05ff8d4c67a8bd6aa5ab22d25796b5b3cd8684", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872008, "uuid": "38508250-2e88-4faa-835b-9eca79885642", "comment": "Malware payload", "value": "113be98aed55950757e3776939fa242eebc1eb8415b00339ba962b6edd84c8f998b8c9a453a7f8422941fee34ad0a4e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872008, "uuid": "6b3100ca-29d2-41d1-8113-08eb30cd920f", "value": "0F3312F3D602B2ACB64381494E8C6F47923B817066695EF18219EFA1D33D7170B51EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872008, "uuid": "c15036be-a269-4e2e-8aa4-220b24196efd", "value": "1536:GU/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wee/6:bXKAXh3TCdOi+KSZ4W7/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872008, "uuid": "ffc8798c-e753-42a8-bf26-e38fb913bdc4", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872008, "uuid": "87adb409-0212-4dd7-b66a-88d292bdf6b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872008, "uuid": "839ed53c-e74c-44e7-8e61-5f554901b054", "value": "statistic-1142962939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67b7e78-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871163, "uuid": "d5fb9b33-c73a-4a61-b73c-54a5ce289915", "comment": "Malware payload", "value": "91dffb3219c6cc624cf26241f6b723e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871163, "uuid": "4741f8e8-9145-4d7c-a236-847dd359d721", "comment": "Malware payload", "value": "12bc1e686dc89a91cce783c11a634302d3fe565ccdcee4ab10c55b8f01760a7c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871163, "uuid": "4b232e5b-d002-44fb-92cc-3c5ce5676116", "comment": "Malware payload", "value": "4b48c53d577f3150a59332cdef933e792715db03", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871163, "uuid": "96188794-f3f6-4a58-983f-90ad88b6f26f", "comment": "Malware payload", "value": "96bd4230975f8d9ae7e90a5e8d32ecb887f13db769278ae2b1c81ad55d68f08c5c61789b8cf09b9e7dac5437672d9c2f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871163, "uuid": "7af06d15-5386-440e-9bd2-279ad29460c6", "value": "9633F19133F9E900C6F2C1F060E27699274B3D918D794DEE4C94A5B93F932A4CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871163, "uuid": "74c2e002-3da0-4fc9-a7c0-959bcd30ad97", "value": "768:T5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJSr:T/czJJSI7r3Pwh8Rcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871163, "uuid": "3ae1bc52-8124-4b70-ac69-8d0eb122045a", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871163, "uuid": "5bd0ced9-1713-46a1-8f20-55bb4cf6f8dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871163, "uuid": "d4442a5a-895b-4bba-9d68-9e2fd7a647ff", "value": "diagram-469880687.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ad9d95-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871326, "uuid": "b6ef6724-1ddc-4a64-8b6f-94357bffb6cc", "comment": "Malware payload", "value": "eabc48c89d8e32f0c9a458bf60ae095b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871326, "uuid": "cd62e99e-f7c2-40f9-9607-b93170891f0a", "comment": "Malware payload", "value": "12c0eb1299190aedd724473354f91947896ee6cc0df78c7f9eece776b22d5ed9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871326, "uuid": "df111b72-241b-4af3-9c10-584ab6906544", "comment": "Malware payload", "value": "93598c4bb3b5f3d555cd5aa38c9828237fe75501", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871326, "uuid": "6c293064-e5d8-4bb4-aa23-bb195a5f5639", "comment": "Malware payload", "value": "5867bfe1441d02f88c19231c294f74f83fd55f8e94445f2ae79e104d4c2961750f2b6ad0da553c4755ef17d6735ce664", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871326, "uuid": "985014ca-3fd6-47c1-a5ed-c733cfdd13e8", "value": "2F33F19537F9A900C6F2C1F060E27689274B3D918D795DEA4C94A5B93F931A0CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871326, "uuid": "5cf3a6dd-f7f1-453a-b00c-85bb8fc986d1", "value": "768:K5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJ9g:K/czJJSI7r3Pwh8RPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871326, "uuid": "23df00df-b724-42cd-8029-1279441b348a", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871326, "uuid": "ee1016bc-7606-4c78-b1b0-1143d110cd2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871326, "uuid": "29cc0a00-15bf-4c76-b12f-86df36c88abd", "value": "diagram-594867095.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad5f176-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911838, "uuid": "93123112-aeda-4ade-a91b-5e7c981de3c0", "comment": "Malware payload", "value": "7c059f4f7894d2c03b4e22588553a0e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911838, "uuid": "9254425b-4ee6-48da-be99-63a72106ad2e", "comment": "Malware payload", "value": "12c451540331c1b3f76117cd253cbd8cd00719714af64254d5f743e8da216ab0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911838, "uuid": "c3be03e5-6a44-40dd-804f-ab8e9b2be48d", "comment": "Malware payload", "value": "785ac64001136074bfb61cfd7e2f07844de089c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911838, "uuid": "29f6ea32-7653-4ac0-af86-e3e3673ba5d4", "comment": "Malware payload", "value": "44855fd2d76e6bdca78a611df80b8dd558e26599e715e32ba9fa0d125535e8ed0512b85c65f57e3924b8f4f2ed6d613c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911838, "uuid": "b04ee6e9-7e43-4ae8-a6b8-f2aa71506911", "value": "603302C133E79239C4C105F6F42B6DEA26A78D8DE520A0D05E5FDA0113E357AADA134F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911838, "uuid": "02fe5f46-676f-404c-9612-198f9d624dc5", "value": "1536:DEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwHY:InBrX5Eg5Enjq3axWIfkNw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911838, "uuid": "5acc40be-8e63-4c61-9193-3b676086c342", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911838, "uuid": "b759d095-bf6e-4896-8643-4f390d2179b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911838, "uuid": "99370b01-c4fc-48eb-a494-b5adaa7a1a04", "value": "diagram-110800948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89abae8-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868509, "uuid": "561cae0b-93ea-4fd6-a3c8-144f00c642b0", "comment": "Malware payload", "value": "64efce33d157a9dcbd4e50390a5fe245", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868509, "uuid": "a0215e02-bd43-4a4d-be64-6d5072437cef", "comment": "Malware payload", "value": "12c7b1f6aed0252c8f617f45f592b5df59f1d1c301c7a986ea030bf614d6b4e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868509, "uuid": "a61787bb-af66-4bd1-9ca6-c9e4a551978f", "comment": "Malware payload", "value": "d48c28e755a22bee2b16c5295e756adc04e1c677", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868509, "uuid": "d6dc3288-e216-4ae1-8e4f-a0005d7cada9", "comment": "Malware payload", "value": "222a56368790775e3779183e1994141752e0275afd9077c85cee33075d82050ca70d20feab3fb89e0ce9a475c28fc784", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868509, "uuid": "4ea1fa21-6c0f-42db-914c-aa67af55c126", "value": "A033E1C4EF5BF858CA837377BC482F966EAB025464DEE09597C6309D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868509, "uuid": "8d74318d-7ee0-496b-b02e-fbb73a7ec671", "value": "1536:CAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3ND:xpoAnd9gucKCQap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868509, "uuid": "421dc009-ad09-4f86-937c-a07ab3bb086d", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868509, "uuid": "19ac0032-abfb-4ec9-a79b-386f7c91bf3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868509, "uuid": "30df914b-bd60-4572-9858-a8bc0578e68b", "value": "catalog-468734437.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e315e1ec-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910697, "uuid": "e05be2b7-b557-48a3-899c-2e4a4deee67e", "comment": "Malware payload", "value": "c3bee211876e2dabf069a377f1918612", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910697, "uuid": "094fed0e-7970-4dd8-bf4a-83e03b126953", "comment": "Malware payload", "value": "12d3e0fcfc1a918e3dfecc00f306387735af877396974359e36236c78fea6137", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910697, "uuid": "6ec331d0-4abd-4857-bc88-da460e33f5cd", "comment": "Malware payload", "value": "3502f69bf0aa6d666b80dcfde623fb401cea9696", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910697, "uuid": "47aa57fd-fd76-4e35-84a7-0418f2668a4f", "comment": "Malware payload", "value": "d0b2b17a17015b6fb58468f632ae96094250aa9cbed0c8c5c94bf1990ed469947803aee3f346dec0a7a9ea9b153c6e99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910697, "uuid": "50b89f35-6f4f-44b0-8807-4700bea606e1", "value": "E33302DFE415EAB7C1EB96015FA59BA306FDB54CE0308628C754C3F8EA835C2853A5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910697, "uuid": "9026fb28-c6de-459d-9efc-99e38a2b3578", "value": "1536:KxTuDqsF1Cnc3P57oj2+nC6uxkLiO97r1:KxTqqsF41j2Pxmi61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910697, "uuid": "666082b9-5503-4fcf-9177-39051a0278ba", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910697, "uuid": "a8684a10-bf3c-481b-a62b-a5f60e74d892", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910697, "uuid": "9ca59180-25e0-4fbd-9954-010e9f3ca32b", "value": "catalog-278882111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb27e96-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916945, "uuid": "8fec4f36-ff93-4e46-8bca-cad484ff2670", "comment": "Malware payload", "value": "1d9b1d25168fa8829a3ac75b8064af25", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916945, "uuid": "8dd54d12-5a5a-41f8-8063-ef93eb34dcff", "comment": "Malware payload", "value": "12ee748f8c371b446e49ed702fef2905f4c88db4cf92f37201e1919f06e9d212", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916945, "uuid": "e3a9e00c-5a55-4874-b25f-03ddc9dc0fa2", "comment": "Malware payload", "value": "4e43554e121b09803211aa2c18cff929dcbdd285", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916945, "uuid": "82f4035f-dfd2-4718-90bf-1bdf823a612a", "comment": "Malware payload", "value": "1e6c34377ea35843e472641c6c465946dec277d9e77e2bddd0861ccf9f7fa5d82eb1713f3804c148ed2a7b4367173a16", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916945, "uuid": "929700f6-a5f6-47c2-9043-d96f5807324a", "value": "8B3302D5AA13F4D7CAF9FF93049923A4A35ED49D35143C999C3B258144B71A8C0D37C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916945, "uuid": "916ff094-d0aa-4432-bce8-a161fd93426b", "value": "768:Fo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SXAjMxyD:feKCVQbp4LTaI7ZaiNQMIXAo8ZCT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916945, "uuid": "4d7c1396-8b62-426d-afc3-f77269ba8797", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916945, "uuid": "0e611842-da89-445e-bebd-1b158e5b6bfd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916945, "uuid": "5d6a87c8-8265-4956-a164-953fafab5f88", "value": "statistic-892018584.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562d312b-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910461, "uuid": "0955790d-c3fe-451e-bfe4-d345983f1287", "comment": "Malware payload", "value": "efc3c4bcc6ef9329e6295d02ba5ccd4a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910461, "uuid": "59cc4b8c-bbc4-4f7f-8e9d-a871c63079e9", "comment": "Malware payload", "value": "12eefb2e9db0aaebe97ded97ffb7fc192e548f206f857d99e808cdc525d3b7e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910461, "uuid": "3b10bea1-c2f2-4904-826a-dbe4adfe2cbf", "comment": "Malware payload", "value": "029ccd07d8a1778d7e3dfac7d44639ca8a365f20", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910461, "uuid": "19d9a359-79b1-4488-acad-058252b251f2", "comment": "Malware payload", "value": "ed6cc70ab344fadb84d8c87630077162d952766681b572c291c65a0ab76fb29b0bf86f1b9b7ef5803c0fdc342972a470", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910461, "uuid": "33caf86b-ca7e-4670-b9e7-a1638e688c32", "value": "E93302DFE004EBA3C25B93005FF98BA215FD7918E1708168979A85F9EA833C2C53D5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910461, "uuid": "602e721f-e3ce-4e56-8077-9e3feac0360a", "value": "768:7qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3gkhfvh:+xTuDqsF1Cnc3P57oj2+nC6uxkLYaXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910461, "uuid": "0ae0dcfa-7684-4799-bfc0-99d0a1af9680", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910461, "uuid": "09569a8d-4f64-480e-8f77-3bbb9a95f4e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910461, "uuid": "bdb0e9ce-c1a7-4f7f-b9a4-430f9007b54a", "value": "catalog-2012680994.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12469b1a-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "f7638c30-7ceb-4610-9bdf-cce20c8e8b95", "comment": "Malware payload (Dridex)", "value": "c9e96acd1be61dffd5b01f82b1b3973f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "5c6cc599-8ff3-4b98-a179-cd25a1f83d30", "comment": "Malware payload (Dridex)", "value": "1304c0a3a1b0ea48aada49a3503c66bc432fa6d4b2b4438d2bcb1ac7e42ed48b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "c2229c49-acc9-4ef4-a93b-bda1ed90ab2b", "comment": "Malware payload (Dridex)", "value": "5b1288d8d7df0dc26e2bc5ba2310589355adb00d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871692, "uuid": "37b57fe7-dfa2-4188-ba09-2f101f6e9b50", "comment": "Malware payload (Dridex)", "value": "f7565d0239b33ebb8b3cc146316f56d7554f26e4faf0451581d4d4a8d6be2158e8f6f0cd698ac881d3c5564e0d02784f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871692, "uuid": "2e13bd6d-cc02-460e-b0f7-75769b7b1a8f", "value": "31F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871692, "uuid": "32f9ae8f-d673-4f17-8cc5-271959536772", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871692, "uuid": "2ee40d3c-73ac-43a0-b38d-69abde7f357f", "value": "3072:19F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:19F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871692, "uuid": "b2f249da-b903-4b11-ac71-e40897b8f0f9", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871692, "uuid": "abd02c10-9fc2-4e73-b2ed-043deed253f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871692, "uuid": "fee3596d-584f-4a6d-85ee-b8ce75336078", "value": "c9e96acd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b15406-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871487, "uuid": "ecde9290-b044-46a3-9d28-93be65e3f32c", "comment": "Malware payload", "value": "34817e6f335aa213ce27b840c623ffc2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871487, "uuid": "8e7e62f0-5249-477c-997e-172d42dc2cbf", "comment": "Malware payload", "value": "130aa825eb3de4cb5fd141a6bb37cb1f298199bf6612e9cf70b03af9582a3393", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871487, "uuid": "db490a8c-23b6-4d11-8191-c8b980276d41", "comment": "Malware payload", "value": "edf65e2c33c7efbe44d0dd88eff6aea6fba1031b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871487, "uuid": "206a12ca-0b6e-467b-bc25-000629b97394", "comment": "Malware payload", "value": "59ae8510274d73ce5bb1c8d3a45c8086520d405a279c049d29aa83ef68e66f798767270751391f2dc0eef1062a342595", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871487, "uuid": "058e2c74-4b03-4469-8a7d-6cd208e8d6cf", "value": "6333029673F9A900C5F1C2B0A4E271C8374F3D924D7D6EDE4C88A0793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871487, "uuid": "59d2219e-9407-4d45-a4c3-e6db75c02e33", "value": "768:e5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoo:e/czJJSI7r3Pwh8ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871487, "uuid": "24eca766-6fe9-46ba-b767-7980c7f873c5", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871487, "uuid": "fef57d4d-9702-46ef-a45b-63653c702799", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871487, "uuid": "2f9cb22d-0c20-4fce-a3bf-c71accaacf3b", "value": "diagram-702112085.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbd2008-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915034, "uuid": "a1156d75-d469-40ed-8d45-04dc3d4d65c0", "comment": "Malware payload", "value": "bf92b05b66cb831879075d20f1415583", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915034, "uuid": "876e09f6-07c5-4ecd-903e-c79307c58c2a", "comment": "Malware payload", "value": "1312d5b77bfae6d3733a0d8a332e7454eeb146f79c101a63541bca37cfab7c81", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915034, "uuid": "d69a552d-ec53-4992-a6d0-9605e22b6596", "comment": "Malware payload", "value": "49f78988d196935c1b06d9a70be65ae4c551401a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915034, "uuid": "2117a0b7-b525-4ed9-8652-8da95a002fd5", "comment": "Malware payload", "value": "0d79900700f5a803183f13510f183fb556f91cecc9b6d815083cfe8ba7ac6157e76fce4124b3e709888f33ac98eee4a7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915034, "uuid": "5f1e0523-7491-4194-ade0-c47894e907e6", "value": "B13302D69B23E9C28AFADB670C5652E4936FD89C31143C59192A299380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915034, "uuid": "0f55e0be-8282-425a-b79b-e0b4cfcad4fb", "value": "768:Oo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6FFr:WeKCVQbp4LTaI7ZaiNQMIXwFGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915034, "uuid": "4e5c895d-740d-4fc1-987f-c5146536817e", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915034, "uuid": "bc91a71b-4849-45df-b129-b234b915cd01", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915034, "uuid": "dccf3cf9-7746-4824-b0fb-52b3bd2c2fbf", "value": "statistic-1492808959.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f6216d-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911779, "uuid": "f5960162-7715-4b3a-b4c0-ee80f71fb796", "comment": "Malware payload", "value": "7baf478dcd312649ef72dbb8652aa3d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911779, "uuid": "85a8c0e9-011d-489b-aea4-c69ddce3307a", "comment": "Malware payload", "value": "132e0b3d18d94b15c3258f773d43447b4eae1aca6ddd5d453b0f231797996990", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911779, "uuid": "6759ddf6-68e5-4fb1-9505-7275228169e8", "comment": "Malware payload", "value": "bcb601c0fb50ee8688907baa9777b6c150d6cc39", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911779, "uuid": "16ba06de-9eb5-46dc-ba6f-f3475e1944fb", "comment": "Malware payload", "value": "1fc92e4b2507a39d5471a162467dc7accc51b9aed327a410f79243e832b81eabb873255d901ddeca2ba43b0d10a436a2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911779, "uuid": "f685186f-d01b-4d8b-80f0-2ffa6cc21c41", "value": "8C33F1A232D7C13BC0C546F5F42B5ADA66B78EC9E920E0D01D8FDE1113D3165ADA2B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911779, "uuid": "700d229d-ddaf-401b-b3c0-ae99ec0d61b6", "value": "1536:fEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwu2CHV:snBrX5Eg5Enjq3axWIfkNwu2CHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911779, "uuid": "98ea6b5a-9d0f-4c91-b908-06af52c36b78", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911779, "uuid": "8e84a111-3219-4da7-ace3-af5c39888c56", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911779, "uuid": "5de623a9-c18a-4056-9fe3-63ae5127c902", "value": "diagram-1063581805.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eafd194-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871740, "uuid": "d2b7df68-54f5-4724-a5ed-2e009b13ab2e", "comment": "Malware payload", "value": "bd03996ea4380875ff1d705baed02e24", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871740, "uuid": "6a0b5f79-b245-48e2-9151-01766a958876", "comment": "Malware payload", "value": "133241c37f11cc3cb6169f6b1a339a0f8adf4f5851eec63939582604039c2fbf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871740, "uuid": "ac826d07-90cc-45e3-84ec-ba3017f57bcd", "comment": "Malware payload", "value": "231a9bff0fa5996b0c5f7934cbb693f9e1dd6251", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871740, "uuid": "fa142a4d-98d5-4268-a46d-77677b5bacca", "comment": "Malware payload", "value": "9daedbc57f66b4f032503d21edcd6e44afe64cf151048fc397e67565d6e039666739269544f66efdc4d39d864350adf9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871740, "uuid": "a29ce6e1-211b-49a8-8902-05ef1bba1785", "value": "A533F19537FAE50086F182B064D27689274F3D618A695DEA0CC476793F931A0CFE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871740, "uuid": "e52b35e7-b4fe-4486-9975-7de1ddfd96ac", "value": "768:B5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJq2f:B/czJJSI7r3Pwh8Rk2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871740, "uuid": "7cf0349c-93a7-4fde-966a-0cb146f80ea7", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871740, "uuid": "22f4379b-f96f-467d-acd6-f0c73a535224", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871740, "uuid": "5bbdddbe-9287-4ffd-bce5-a5285d27f438", "value": "diagram-935523495.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1022ef85-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913350, "uuid": "ce9c0788-ad0f-4096-9c8a-0b38924ad8c4", "comment": "Malware payload", "value": "4e86d605b62cfca4e67cc72949719451", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913350, "uuid": "7a39640a-0a1a-4ac2-8d1d-86b7d394e6f7", "comment": "Malware payload", "value": "13433d4d130e81843a43e160a3541b07418740fa9d646555a4e7426c80df5ce4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913350, "uuid": "6a2eb690-4d4c-4580-bf7b-54a799690085", "comment": "Malware payload", "value": "5c9081bb525731c28919b0a3437a03deb03d1ace", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913350, "uuid": "c8950940-724e-4839-b2f3-f1b29b4d4b01", "comment": "Malware payload", "value": "5b33b95ebb668ad20e971e89a2c5b93b43938addcf009bdc49dc2bf970377cf5cb99a07f45492a3ffea834b020034274", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913350, "uuid": "d8e756a2-ab33-4530-a2aa-96f73ca0a082", "value": "593302D232D7D27AC4C105F4F42B59EA5A778EC9F83094E02E8FDD0112D31AA5DA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913350, "uuid": "f5ad2f4c-9a60-4209-b1c6-235201b703d5", "value": "1536:fEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnOW:snBrX5Eg5Enjq3axWIfkNwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913350, "uuid": "5a594f4f-13a7-4bea-80bd-6e46461fd7c8", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913350, "uuid": "a0d61e3e-9876-4953-bf6c-613bb1366a63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913350, "uuid": "6c4da8fc-5045-44fc-9b32-9c7d8d44371d", "value": "diagram-262025577.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8515f078-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872744, "uuid": "771766c5-c86e-4f58-ae0a-00f37a8e1368", "comment": "Malware payload", "value": "0833268fecf9c0d13a65a9d26d81b963", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872744, "uuid": "9189c8c9-53f6-4f41-8e77-7f9bfae6a949", "comment": "Malware payload", "value": "134e5e7d70ef1776104182bf2a64569d88ea6dbb55f76eecf22219d6f3bf256a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872744, "uuid": "b4876e32-67d7-4828-b77d-1c4c703c9c5a", "comment": "Malware payload", "value": "e090a9a5d85b20e4da2c5a7daae8d62eb6b96c47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872744, "uuid": "44731522-d038-4dd2-aec6-ac07e559fac2", "comment": "Malware payload", "value": "3e24a32dfb31280a607f2bbe23c012d4914077b3141511af68a4be1bba7c0a8bdad34bc8ab0df3f08c6eb9160367660e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872744, "uuid": "e421320e-a31c-4385-94ba-f827a45ad224", "value": "033302A3D312A2BCB643C04989CC1E979377427026658EA2C56DFED1A33D7160B61B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872744, "uuid": "1c30c50d-422e-40bf-9ba3-38ec8213abb5", "value": "1536:Vi/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8LCBK:0XKAXh3TCdOi+KSZ4WBR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872744, "uuid": "82dc6b1a-bac0-49a9-b51c-a591c52677a5", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872744, "uuid": "cddd1c8b-638f-42cd-8a43-7219e853b6eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872744, "uuid": "39e8276c-022d-4716-8002-96671ad784fe", "value": "statistic-1678065940.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d64822d-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912621, "uuid": "1311e4cd-926d-4307-8793-83bb3f086845", "comment": "Malware payload", "value": "52179d7e6ee8663c308dbe2e5808c6bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912621, "uuid": "3ed187c0-f4c6-42aa-aa6d-689df565a346", "comment": "Malware payload", "value": "1367840c5f0ca2ed3fbf0f3a93d1cbd0401b69c71bca7107712357f99da2bcf4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912621, "uuid": "da9f7278-7663-4152-b1d6-fc32d908786c", "comment": "Malware payload", "value": "2391c9c68fae42fcfed6afe36e04055f984db103", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912621, "uuid": "bedab84a-9f7b-47ea-81e2-2c68c4562b80", "comment": "Malware payload", "value": "6c30b5c354bc593511f34cacfb032d25bad91a9dc87381da3667428072f237b46d1503bc3d7bb8ca9c2e2ca4e17418a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912621, "uuid": "52bf73e1-c46e-4e5d-8cbd-937aa437a0bf", "value": "1033F1D222E7C23AC0C105F1F61B5ADA56AB8A9CF434A0D11E5FDE4122D3175ADE174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912621, "uuid": "4a468a07-d71f-44e8-981e-3702cdd0bafe", "value": "1536:FEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRk:anBrX5Eg5Enjq3axWIfkNwRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912621, "uuid": "e59130ee-55bd-474c-ac13-cf64370ce4f6", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912621, "uuid": "82a7d363-23ef-4f4d-8d2c-55854c74eca5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912621, "uuid": "df8d484f-89bb-4d76-82b7-412f35ef0496", "value": "diagram-1781706135.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746bd4d3-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871427, "uuid": "1a691d98-1a3b-4850-931f-72c16efb344a", "comment": "Malware payload", "value": "e151628cd3676e14f15deaf508d05b1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871427, "uuid": "10d517be-dc2f-4ad1-9e65-3f6f44fb5480", "comment": "Malware payload", "value": "136b09e58040971e0fdfd3056edf9d4eeb5728213b20da3b7f6914c7f3d15678", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871427, "uuid": "a45ec645-f058-4e55-870b-99881239e841", "comment": "Malware payload", "value": "618fcd176711969135a9c8d31812f57f76813285", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871427, "uuid": "a96f2085-f5c4-4225-8003-5b97183d112a", "comment": "Malware payload", "value": "b25fe72cca2d4b5f252d9610eaf95be43a97d70d1d89d2f9ef4c1c03c9a68a33b5e22fa91de7e0a4a87ff3fda6cdda67", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871427, "uuid": "cc872ea1-10f2-47f8-9546-ae3c42df4e27", "value": "1933029673FAA910C9F1C2F0A4E27588374F3D928D7D5DDE4D88A4793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871427, "uuid": "818235a3-ced2-47c8-8b0d-50371ee73f7f", "value": "768:c5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJwT:c/czJJSI7r3Pwh8TT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871427, "uuid": "2b3d4205-4ea6-4a5b-b9be-820ab967b769", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871427, "uuid": "31c447a7-c25b-4d5a-86e8-d162b3798861", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871427, "uuid": "e3de5771-1ee8-4363-88a7-6fe5bf03dac0", "value": "diagram-673574602.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5968c26-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872879, "uuid": "369c4b98-f35d-4f1a-b7ae-9fc4d56cf47e", "comment": "Malware payload", "value": "2bdab74d5ca7af63b0452be29ae85ba5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872879, "uuid": "208a42be-a53d-4ed3-8e03-58f77e10917f", "comment": "Malware payload", "value": "1372b0fa92c4e2c56ca2e1b16ffc17503a432f827ec209be6efc286ccc373a26", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872879, "uuid": "db683d97-b588-4272-89f9-24010c0d4fdd", "comment": "Malware payload", "value": "c4c9b75c28f2c8abf54f89c31d007b954b9a99f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872879, "uuid": "b36319b9-c7e7-4037-8686-4f4344559d77", "comment": "Malware payload", "value": "24c6f8fe7559be0a3ec963c7b0773914894846f8803e6eb5a548376f8884077eb629a0654fbba25a2094e33bf79f6f1f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872879, "uuid": "4c1e86a9-5702-424f-a9b9-adacf98f9379", "value": "EC3302F2E603F6FC754381894BDC1E6B523B8220525D4CA1C55EEEC5823972A0F61BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872879, "uuid": "9ff6d136-893e-4872-aa38-e67408d9eb3d", "value": "1536:Qu/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedMX:HXKAXh3TCdOi+KSZ4W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872879, "uuid": "5cff4a96-256e-4756-86bb-fbaec7d10880", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872879, "uuid": "8584bdfe-29f4-4e21-a143-dac1da0f9753", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872879, "uuid": "f9231a6b-c73b-4e79-badc-59eeb8ce2247", "value": "statistic-1767191109.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75c4b1e-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896853, "uuid": "36c641dc-cebd-4ef7-b767-eb7df5534fd4", "comment": "Malware payload (Dridex)", "value": "495de2dcae34804890583e956b27be75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896853, "uuid": "59d75cb6-d06b-42c0-8495-172653e77364", "comment": "Malware payload (Dridex)", "value": "1377aa5de6c544810c261a3697b267e8539712bb84cdb73f6b3eedf8dcdd5884", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896853, "uuid": "265acee3-d2cf-44a9-a32a-ef362dda3fcd", "comment": "Malware payload (Dridex)", "value": "a6bc4814622c5a45cb34a2de0887bcfb863a2d90", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896853, "uuid": "163b6975-716a-4a3e-900b-edc326e73e8d", "comment": "Malware payload (Dridex)", "value": "0133ba9b0308cc6e4dd7954018a45bad675ac8e13bdb46d7732398fa29964bb1ef7b6599d501cb87a708641a584770b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896853, "uuid": "d13b4945-f95f-4205-ac4a-0d7ef962db60", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896853, "uuid": "9adc8549-3b62-4790-b01b-3d5f5bfb556b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896853, "uuid": "01b52f71-23d0-4b28-94cc-3e12fceeb2f3", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896853, "uuid": "bbe5dd6e-2739-4187-a7ca-fce62cafc851", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896853, "uuid": "8095f90f-afa0-4a41-953a-243f43245227", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896853, "uuid": "11c492c9-58c3-4dab-b2bf-110d51c3556f", "value": "495de2dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d559538-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874073, "uuid": "dd66773a-1935-43c8-975c-e84ccd95da8a", "comment": "Malware payload", "value": "06728e6c1811dfa28b97d71f898c1077", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874073, "uuid": "2fb84c65-0f44-4381-8483-eb240493bac6", "comment": "Malware payload", "value": "1383a8bd3440e38c8da502b0c4451354d42b5622c136d28d73e266ccb5b93a16", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874073, "uuid": "448634d4-8ade-4c52-9b17-fd4f096baba6", "comment": "Malware payload", "value": "6ea76973ac9c12e68bf905946e64ae352c5c5843", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874073, "uuid": "2aadf71b-1bc9-449f-a89a-b4aa427f7d56", "comment": "Malware payload", "value": "ea6bdb298103d9dc178a978202024d073257dcaa6ab058524bf30445a22be522e89abb8c9a76ed24f45076a91dc9e7f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874073, "uuid": "b99cc8a5-d126-442e-b40b-8e6372f45551", "value": "6F3302A2C312A2BCB643C0458ACC1E979377427026658EB2C56DFED1A33D7120B61B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874073, "uuid": "f51c851c-4e6d-406b-bddb-9796fd69f4b1", "value": "1536:0/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8LGW2:sXKAXh3TCdOi+KSZ4WpR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874073, "uuid": "6ae68de8-a87f-460d-977c-3d105d34c601", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874073, "uuid": "a2685c87-8a32-4a99-832b-b879144df09a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874073, "uuid": "584f6ddf-9bce-4733-9d4f-a2a9a5076403", "value": "statistic-566247342.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d850d4-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914883, "uuid": "ae00216f-b407-4220-8417-8806c64b903e", "comment": "Malware payload", "value": "2478f5d8bd6040081d27a7fe56a01a51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914883, "uuid": "6d2e0d28-2bc8-4a86-8d4b-911b3cb83657", "comment": "Malware payload", "value": "13a89d58bcd7758b4f08bf9adc11acec41fc321931d5948c25536e65b80b4b9c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914883, "uuid": "40fb7462-3fb7-4700-a81b-8d057f80bb6f", "comment": "Malware payload", "value": "b98c992d9173515cfbb9168e8d691422b8422210", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914883, "uuid": "b9f58bbe-962c-4cf4-8668-d5b3c4ec1170", "comment": "Malware payload", "value": "c45e8a96b8158853c84ffe643d97818cee3b71b99072c0e4d056911db7b1be920da058ff801728f3d2080833b53913d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914883, "uuid": "20a1b912-d92d-4095-ad01-201529ab2f9b", "value": "253302D2AB13E8D38AFBDAA7085252D4936FDDDC31147C59192A298345FB164C0E37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914883, "uuid": "d09b2b60-aea1-41d4-b9c9-3b6dea3ec756", "value": "768:so4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ScjA6FMl:AeKCVQbp4LTaI7ZaiNQMIX4FBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914883, "uuid": "52e00b8b-c3f9-4194-86e1-a8782258ecd9", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914883, "uuid": "cc031e7e-02cb-4bcc-acdc-f5b05de1fdb9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914883, "uuid": "9ad15ad6-b818-4dff-8545-57b58380088d", "value": "statistic-1374033211.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5443b920-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915182, "uuid": "948f569b-ce97-4fde-8b05-e736fa8519de", "comment": "Malware payload", "value": "c7caa03fba086bf94016d2853e2bf107", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915182, "uuid": "7b5136c0-8f3e-4422-8c67-61f5e2588770", "comment": "Malware payload", "value": "13b939e19f9caaadc0c5bb01757ce21f7d358bb0d2e1c8c7046025194c97b1b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915182, "uuid": "f5f28893-a56e-48d8-a372-677080560ea6", "comment": "Malware payload", "value": "4acda21157317c3e047bc3aa1807f4d47cbfb091", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915182, "uuid": "608e4c12-8b67-4b70-9973-7c7d4b0d99ab", "comment": "Malware payload", "value": "26005766cba3bbfe70a9c3288b617fc58615bba48cc9dfdf137631fb5871c2454476112b775ed650092d0de09b1b1436", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915182, "uuid": "6345acbb-fdd2-4c51-b54d-694fb282c979", "value": "C93302D69B23E9C28AFADB670C5613E4936FD89C31147C59092A299380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915182, "uuid": "ef695f88-cb44-4ed1-b0aa-d637d34609c4", "value": "768:Lo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6F5K:BeKCVQbp4LTaI7ZaiNQMIXAFS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915182, "uuid": "bc4e6031-c9ef-42a1-9736-111f3539c534", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915182, "uuid": "87d8658f-d367-4e7b-b4ac-ac7cc892dce6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915182, "uuid": "be931288-b840-44d0-bbf3-ac93f3e6f351", "value": "statistic-1570961404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985de957-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913149, "uuid": "40ca4b78-83ed-4ab6-b996-c18938ba675d", "comment": "Malware payload", "value": "7917862419bfaad790753e3666a3a9b5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913149, "uuid": "ec9a2e31-6209-4af5-9e82-5e03d4758cc5", "comment": "Malware payload", "value": "13c79c9191fae2d53aeeec5ea38770c2d8f5c7c40adaa5fc9048af85c931b676", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913149, "uuid": "bfd81430-698f-4b05-9a2b-efbcccb940fb", "comment": "Malware payload", "value": "d96fbad914acbe593e242daef4d1def0c19bf19c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913149, "uuid": "6b521249-1378-4943-b278-1b13f423b045", "comment": "Malware payload", "value": "9d5ead8a765dc322ad9b479815d59ebacbce501f5104fa6f13ae60c63d9b179a6cb6bbaad67e8fc7ad547786427a4dd5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913149, "uuid": "cde1805f-1410-42da-9618-1362aa6e1457", "value": "D63301E232E3D17A84C509FAF43759DD65A78D98F93080C02E8EDA5122D31B9AD9274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913149, "uuid": "01645a3d-c254-4459-b741-8f41f30ab826", "value": "1536:nEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHrRY:EnBrX5Eg5Enjq3axWIfkNweLRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913149, "uuid": "dcb98bb2-0728-49c8-aef5-3ca2a788381d", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913149, "uuid": "31ab41ec-81a7-4e73-a7d7-c2e616a0a6c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913149, "uuid": "988d691a-ffd5-4df5-aba3-04a74b337e52", "value": "diagram-203823963.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bc9d3c-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916208, "uuid": "b6b7ad8d-5397-4df4-bc9b-ce2b93266bfe", "comment": "Malware payload", "value": "73d7e432cb7c9beb974bc7f2649c216f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916208, "uuid": "bef41bf2-47d2-4819-8d91-832a4be19064", "comment": "Malware payload", "value": "13cb1c31b89cb71e99650cacade4f9214160b7aabe50ff20fe3cafada9f65191", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916208, "uuid": "ac28b61a-27d9-4024-90cf-605d7bf0b05e", "comment": "Malware payload", "value": "bdfec285a7af6b8fe253e77267029b247d5c42b4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916208, "uuid": "a64d3178-c116-4dbe-921c-e211c8171bb3", "comment": "Malware payload", "value": "df3072e5bef4f403c7a70f09828b2a62394eb2f84453a4860800b1f34e848b6d5e9c1d510fd81d1be3a961e63fde2019", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916208, "uuid": "df35f9fc-e75f-4ccb-a28e-2f8eba948f76", "value": "0133F1E62B26F5C2CAFEDE53084563A4979F988D31283C59153F258241FB558C4F37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916208, "uuid": "44be716f-b745-428f-846a-6a667d630538", "value": "768:ho4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/sr:beKCVQbp4LTaI7ZaiNQMIXvsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916208, "uuid": "cf1f0682-ffdc-4809-82ee-de31b1188504", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916208, "uuid": "7a424dd7-1b09-4f62-961b-3daeb57224f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916208, "uuid": "702949ca-1539-4821-bae6-aa36d5c3ae10", "value": "statistic-458969151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1948b31-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916708, "uuid": "53783fdb-8172-4531-b9ab-9b3bd57ec52a", "comment": "Malware payload", "value": "0684ec17e3c812471f3fdb9431c75bcb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916708, "uuid": "479fd968-d4be-43ba-a9c3-c614e77f950d", "comment": "Malware payload", "value": "13d3274ccd7248a05080fb38c5c932dd64107945df9b3b1b3cf98931504148ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916708, "uuid": "c961d58e-41fa-468f-83c9-fcb156bae4a0", "comment": "Malware payload", "value": "22dcd674ad87f622a062acf3c92c28ff79d2bcbf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916708, "uuid": "e639e191-60ba-4430-956c-e7c135a3f354", "comment": "Malware payload", "value": "e676b6f04fa513a1ab693ce4f32dda97610e7c15803f0f53d311c414aa028b973966bffffdfb3282e248180c1a525dfa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916708, "uuid": "82722ced-c669-420f-ba08-99646b41cceb", "value": "C43302D62A13F9C6C6FADAA3045623E5639FD5EC31283C59183A648240FB164D4E6BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916708, "uuid": "8c45dbad-e845-4681-9574-66a99c76882c", "value": "768:uo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ST1mCnjU:2eKCVQbp4LTaI7ZaiNQMIXD1mCax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916708, "uuid": "890e64c0-9b66-4507-a08a-dc7420a5b960", "value": 51768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916708, "uuid": "33175229-ccec-4967-b65b-3a4fc6d5a1ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916708, "uuid": "edd2c9be-9df2-4469-a79a-1516de341364", "value": "statistic-736543053.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937b9493-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913570, "uuid": "4a5063c9-3b0a-48c1-8bd7-ed0ea141a489", "comment": "Malware payload", "value": "f0963565b45edd28da02d8cee49b0ac7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913570, "uuid": "c7cf7cdd-cae3-47bc-99f0-947c29921cc8", "comment": "Malware payload", "value": "13edc883f27edc683f8c76755eac8acc616b1a4ec32b62828ac9432056048c5e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913570, "uuid": "bb426fe4-3bbd-45a2-9bcd-deb91bfeab7f", "comment": "Malware payload", "value": "0f8921ed4984ac2e410ca6faefe831c80552def6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913570, "uuid": "8478e9bf-46e9-4559-80bf-75d6262c2329", "comment": "Malware payload", "value": "03af5962ca4bdd132198e2360218d3d8faabaf50910e9ce057ec6e65dc216a42521493c249535a90a823ab15ff5c1d94", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913570, "uuid": "ecc00768-caa6-4162-b361-33fafce1c265", "value": "7833F1D232E6D23EC4C505F1F5176ECA52BB8E9CE430A0D15E9FDA4022D31A5ADA178E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913570, "uuid": "16e4fc9f-25a0-49f8-a34f-5aac94fe5651", "value": "1536:uEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRe:LnBrX5Eg5Enjq3axWIfkNwRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913570, "uuid": "636b9172-80cb-48e7-be33-728a67be5606", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913570, "uuid": "89165c78-2672-4315-8d50-a781a76c66e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913570, "uuid": "260629a4-1d2e-47e8-bd58-5b7e4744c495", "value": "diagram-415116569.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61da95f-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914568, "uuid": "615bd417-7e88-4082-b585-a732649310cf", "comment": "Malware payload", "value": "750e675012e7f365946210b58f826071", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914568, "uuid": "e423276e-467e-4736-874e-c211f5956e04", "comment": "Malware payload", "value": "14219510fee82ea056c8fd4e7a9d9a3469bd8ba8711a4ac521a26b55d07274ce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914568, "uuid": "ac26b033-654f-4f8a-a1ac-d6e599739c7c", "comment": "Malware payload", "value": "8b81bf4363dc585fbc548f6469abda062a8d17d6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914568, "uuid": "df186bb3-d732-4b7d-ba51-41aba79a4f07", "comment": "Malware payload", "value": "29de1db37c99e0d26aa6240ba6a0c5a8547eb57ef28647106b0212d3a7631d8ee4e905686302143750cae9febde222b8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914568, "uuid": "c55f9d0a-e4bd-468c-b17c-aa4713b9c132", "value": "2B3302D5AA13F4D3CAF9EE9308996394635ED49D35143C995C3F298244B71A480D37C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914568, "uuid": "f5f9eb6b-97fe-4bb4-ad90-51a840b48e5d", "value": "768:lo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SXAjMxy6:/eKCVQbp4LTaI7ZaiNQMIXAo84PCTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914568, "uuid": "ba2fbb15-ccd4-4106-ab55-6c88b51187d0", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914568, "uuid": "8ec4a4cc-9b0a-4d3e-87e0-c12c4acf8d0d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914568, "uuid": "ffc2369e-b358-4874-8b0f-7c624179bbf2", "value": "statistic-1131096037.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a09d0e-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896771, "uuid": "812bdc35-597d-4f17-a5db-fb89aab065e1", "comment": "Malware payload (Dridex)", "value": "6c4a588308b1ea89f38a90dec7bb6265", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896771, "uuid": "5764a3fa-dd13-4c4c-b1b6-805b7bb9278f", "comment": "Malware payload (Dridex)", "value": "142e3f72191ff09b2944570548646fe6b03e474d0aad3396047e00925ae87368", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896771, "uuid": "f4cb764b-593d-4ded-932d-8326bf212671", "comment": "Malware payload (Dridex)", "value": "a93a10d9beb79148874e5915e6ecab4f49ca6911", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896771, "uuid": "fbb449e9-7ad9-44e6-9a73-1851dc4b7d83", "comment": "Malware payload (Dridex)", "value": "eb161f3259bcc2e38bd5aef3c51dd2d8c7aa4db2a92be49f631c53f7b6f6fdf2e02a6965b13762b63212db7db8f1447a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896771, "uuid": "ee0c0dc4-7e02-4e55-b0fc-9e8b65cc8682", "value": "57F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896771, "uuid": "05cf3a08-fd91-4fd8-8afb-586f25f660b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896771, "uuid": "8c6a1414-3366-4b7b-baef-32971f4f3fe4", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896771, "uuid": "93897345-1929-4099-b264-c036ea2b2783", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896771, "uuid": "070d2373-8a59-4754-aa43-de0929a91a6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896771, "uuid": "0163bf4d-840e-49d8-9cbc-4e562861371c", "value": "6c4a5883_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7821e0d-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911940, "uuid": "88072336-2d3e-45f2-97e4-a1091c6d00a8", "comment": "Malware payload", "value": "415274af57ce4eb38551f36c88e27ab2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911940, "uuid": "d6362018-03de-4aa4-a6c1-b10b7d4d24e8", "comment": "Malware payload", "value": "1441339e4d3158adcbd618d481f218f4b4468cfbe76abb3f1d73342ee120e02f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911940, "uuid": "353b7d65-8c13-4511-8987-b84082f63ffc", "comment": "Malware payload", "value": "e88e3a76e7e9356625ac60321c40b3f84b397139", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911940, "uuid": "f096fccb-a64c-413b-9e45-f33f3be89f01", "comment": "Malware payload", "value": "6fa2a98208299e70efd2f4f2aae865d9c1a5fe27c84dffabc108cec3a01b94d83ff946a4b50191cc1e057fba7c4608f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911940, "uuid": "a6fa03fa-d5cb-4302-8e58-0a748ddab528", "value": "C43301D132D7C53A80C245F6F82B6DDA66A78BCDF930D0D02D9FDE4112D2165AE9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911940, "uuid": "3f62880c-2798-4487-8a1e-97264e26eed7", "value": "1536:ZEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnd:WnBrX5Eg5Enjq3axWIfkNwYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911940, "uuid": "ba310a05-b0e6-402f-a599-97e462712583", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911940, "uuid": "11d9f49b-883b-41ab-857d-0f314a2fd6eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911940, "uuid": "c1697c80-1468-430a-9bc5-976d376238be", "value": "diagram-1191479242.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49520934-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874362, "uuid": "013687d5-a9f9-43e8-91d1-424df3415bbe", "comment": "Malware payload", "value": "c4d9c6d66ac751e2c0363aa8ee87c794", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874362, "uuid": "b59c0369-3052-4103-957f-a5f0f5fa5243", "comment": "Malware payload", "value": "1442116062687f2632620afcdb3035ef708cc3f332dd4e017b8e002ad386ecac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874362, "uuid": "60a01d27-75f8-46e8-8f73-ead4a57cead8", "comment": "Malware payload", "value": "4ec035e241dd3f9a5ea81f44c121d04c134a7ef5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874362, "uuid": "8abdc174-071c-4757-9d6d-f1cd29e3044b", "comment": "Malware payload", "value": "db0cf70a1d0ca8a6d22346588b6edc296ab7376d667e71f6c0df3bd778e05c9a9369a7216405daa6f1526db60f7088a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874362, "uuid": "c22e1ea0-4871-474b-b11f-56b8ad83c682", "value": "E13302F6D242B5BCB643844A4ECC5F2B523B807056284EB1811EEFD2923D71B1791B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874362, "uuid": "6320cd99-7a48-4f44-b6ed-b4bccc93d881", "value": "1536:l/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeVucv:NXKAXh3TCdOi+KSZ4Waucv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874362, "uuid": "81239ac8-cc8e-4e4b-a965-30355124a649", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874362, "uuid": "ef192861-8931-4a71-a84c-bbb81f15e335", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874362, "uuid": "ca197c29-af58-476e-8cdc-da477a8c0557", "value": "statistic-818641412.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b26f09-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913358, "uuid": "f75a9dd5-8348-4b7c-afca-24101abdd3c3", "comment": "Malware payload", "value": "f541c8e72482da900f218cf11740fb5f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913358, "uuid": "26e59fa8-d3f8-4630-8575-ce48ce63ee45", "comment": "Malware payload", "value": "1446007fcb21bfcf36e05bbef597eac064a022ac237c6c4bf96236717c6d1b89", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913358, "uuid": "ce53bd71-f108-443f-ad05-5d82fbba75f2", "comment": "Malware payload", "value": "ed0ce008a655340c36ebd7c688fc2fd243963aaa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913358, "uuid": "06312697-9620-4b05-bcac-c2c59b3ed3d6", "comment": "Malware payload", "value": "66a1e23d391c663e1f6abfea4a41501c978b8672a6f0491597b104ea747f11fae5ba75450bc0aa4d4a46e355ccc767fd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913358, "uuid": "960f83a4-fd35-4bcd-a037-4759f26908ce", "value": "4033F1D232E6C23AC4D504F1F9276AD952779E88F43090D01E9BDE4126E31B5ADA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913358, "uuid": "ca4b71fa-d39e-4411-932f-828dcfe14de9", "value": "1536:yEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwR4d:XnBrX5Eg5Enjq3axWIfkNwR4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913358, "uuid": "73c7ac90-2578-4bb9-b453-c68d33c3f0f7", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913358, "uuid": "f33b0fe2-4f32-4b03-a21b-b3e1c1a004e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913358, "uuid": "3643804b-3723-4f0f-ad3a-fac73767e5df", "value": "diagram-266469800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9356d7ae-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870620, "uuid": "2915b683-ddd9-484e-8246-eeff42189834", "comment": "Malware payload", "value": "d582d88b71664381c31d53c9af8a6214", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870620, "uuid": "63b8e0a5-444a-49da-949b-c1d458a71d42", "comment": "Malware payload", "value": "144ffe678763f139204bcd648a612641ec8cf49c843704f160c2d4c62db4beaf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870620, "uuid": "dc85b24d-dab2-4661-a5b4-026b2bf8a5a0", "comment": "Malware payload", "value": "2bc91417aa4ac2747093377b5b77f4c87fe0228d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870620, "uuid": "b597e8d4-ea41-459f-a473-821a207babd3", "comment": "Malware payload", "value": "cb268384c57a285bc266147e7833eba55d77fa4a76f52bfd5f43c1d873dd5cdc49efb802d74e3eb0be64594c415271f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870620, "uuid": "6acd3079-1634-401f-bea9-1ef8850b719c", "value": "7B33F2D573FED810DAB2C1F06093BA5A274F3D914D695AEA0DC864B93B93160CFE16C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870620, "uuid": "6d55ad7b-8ed6-48e8-a219-d844393e345d", "value": "768:y5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJixsCpMnS:y/czJJSI7r3Pwh8hxsWyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870620, "uuid": "e7639d00-bc7f-40e8-9df9-e5ccb9f90c7f", "value": 51589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870620, "uuid": "6e6720d2-c1cf-4efc-ac65-a7e09e19dc03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870620, "uuid": "f4db9111-b7e1-4b6b-bb4b-b5ecedd80364", "value": "diagram-2029738.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdff645e-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916245, "uuid": "423a58c7-7f69-44c4-8248-daf6e6bdef91", "comment": "Malware payload", "value": "bec73f9b6f35b8af80c8b14c78a02edd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916245, "uuid": "7be9bad3-1397-4beb-8a48-39fe0bd47df3", "comment": "Malware payload", "value": "1453032ff6b1918e5882c33851342f75194240b916b9e52ec4d4bcbed2d4eb02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916245, "uuid": "24f2aebd-d5c7-40c8-82ff-9119e2490275", "comment": "Malware payload", "value": "31b541861b3fc0d11f27a472aa836dcb6aed4976", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916245, "uuid": "8afc1dbc-6f73-4a6d-a6a5-28147b08641d", "comment": "Malware payload", "value": "b7d1ae7a9dac82bb186f9705b65fa61adc9a7cb75d6294d1d8b19eaeea3aea66fb9e949159c973b5f101e37d1df099f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916245, "uuid": "e842b0e6-7f01-4c1a-a97a-550ea9d319d5", "value": "863302D69B23E9C28AFADB670C5522E4536FD89C31143C59192A699380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916245, "uuid": "ab5cb287-af0b-459f-9dbf-0f05d8fe4434", "value": "768:To4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6F/2:ZeKCVQbp4LTaI7ZaiNQMIXAFIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916245, "uuid": "4507353c-bd9b-4656-89df-7b96cd13abe5", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916245, "uuid": "1a863693-b0e3-40fb-b0b0-a23ed8e4dce8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916245, "uuid": "245c7c13-b662-4982-b3d9-020ccdef2de5", "value": "statistic-48730237.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f60b082-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912248, "uuid": "275a5049-b824-4cdf-a9e6-d8f92589453c", "comment": "Malware payload", "value": "23a7f35c818b7417fa65dc8b4bb3374a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912248, "uuid": "8b974ade-d04f-4fa9-b10a-18f7e181d11d", "comment": "Malware payload", "value": "14589296833b988f1f8cdf956121e4df6daa843aa150b999b57463d614c0c6a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912248, "uuid": "7efe4aa2-3160-43f8-9208-f9623bd02e0c", "comment": "Malware payload", "value": "04850ed0acd7d193c4a7a2cab12b1a6c5eaaaf52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912248, "uuid": "fdb548e8-d3e8-4fd9-95c2-3bd0bee994b3", "comment": "Malware payload", "value": "4229056a55b86ca02f7b02dc5c58422c1f97a9977f2e0364deb926061ad1ed4ee3a95a8db1f9b750205e9b450151fc46", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912248, "uuid": "b46f946f-2d61-4f57-8812-02c7f0281caf", "value": "5B3302D232D7D27AC0C105F5F42B59EA5A778EC9E83094E02E8FDD4112D31AA9D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912248, "uuid": "2eb6fe82-403f-4232-a328-98989fb72312", "value": "1536:IEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwngq:9nBrX5Eg5Enjq3axWIfkNwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912248, "uuid": "0666f361-ab2b-4861-897a-99dd9d0fab70", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912248, "uuid": "2eb9f166-20b3-47ca-8326-c9eecf668c0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912248, "uuid": "ef54d68c-f7ac-4911-8eab-962b3e56fa75", "value": "diagram-1476519001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8902ce9-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914062, "uuid": "167e317e-905f-4475-9799-2286d8e2b3ca", "comment": "Malware payload", "value": "aeb884a5ec57e82205b1c6037a2e611d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914062, "uuid": "c7ed3041-3671-42a5-b8c9-b8db2ee02fd4", "comment": "Malware payload", "value": "1460b585f0f6471225a78b07c92628cdfda12781384b00955aa7e0dbaaf89247", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914062, "uuid": "04f2dec8-5ba6-414d-8e85-d2f0dc690258", "comment": "Malware payload", "value": "4b9f980ed8df0b3162f61203ca3d3efb632989c6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914062, "uuid": "5119ad87-f30a-45c7-8669-c772d00fe000", "comment": "Malware payload", "value": "e79e547ef75156566b01428e775a58d0dde1887d9d8c2454c0c6197cea350de699dc9e78b6e936453a51eac76a07a570", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914062, "uuid": "b679cc2c-7726-4ec4-bd49-d5796e1acc1d", "value": "3D33F1D222D7D23AC0C104F1F62B5ADA52AB8A9CE43490D05E5FDE4522D3175ADE174F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914062, "uuid": "817ef807-dd12-495d-a0c2-27a91bce3e73", "value": "1536:oEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRG:dnBrX5Eg5Enjq3axWIfkNwRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914062, "uuid": "22ed875d-8c56-47d7-b98c-c3245ecf23c2", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914062, "uuid": "56a25299-85f9-4ce2-bd35-c8fb286d6432", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914062, "uuid": "ae60dc4b-1b5c-4e17-82d2-1f16ab4eed17", "value": "diagram-758006939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ad46a8-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914321, "uuid": "869d4a3b-0dee-4b25-a1d0-c9a27396f764", "comment": "Malware payload", "value": "369f81b5055fcae2ca4b482d8d4c6ee2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914321, "uuid": "f2a842c6-e393-497f-9f15-ee13762b2d14", "comment": "Malware payload", "value": "1465fb84dd3959e59d7acdc41772fe532d6f1a3fc3cbfb339cddff5ad68912e4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914321, "uuid": "1ebea23a-2206-40fb-a3a0-b4af291eae29", "comment": "Malware payload", "value": "6335c527078d76787f802e8a8a84d0d6a4b49cd1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914321, "uuid": "56f83176-9cb0-4d87-b1d2-7424bded79c6", "comment": "Malware payload", "value": "da3e9129f0f1bae79256f446494734471709d2ab112e2cf21c2da5a39860225b0b546b4aca7b7e9a2dd07b44084db37e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914321, "uuid": "7cfe4332-71ae-4889-9f78-e7188977afd7", "value": "5233F1D332E6C23EC4C505F1F5176ADA52BB8EDCE430A0D15E9FDA4022D31A5ADA178E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914321, "uuid": "c5535b4e-123e-401e-a5f1-9afb97762260", "value": "1536:CEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRA:HnBrX5Eg5Enjq3axWIfkNwRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914321, "uuid": "bf6d75f0-d22a-426e-9b2e-32e43e7e3643", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914321, "uuid": "0a674835-55ca-4908-bcc1-aa84379b153a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914321, "uuid": "ba412c8b-8cec-45e1-a126-66917e5d8139", "value": "diagram-965352587.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb26d88-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915148, "uuid": "9828d137-2e2c-42fe-b9d8-000d40086ddc", "comment": "Malware payload", "value": "30445217530dc63102bdc8d796711586", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915148, "uuid": "1e70f5e5-33ec-4353-847b-272a8c1b2aaa", "comment": "Malware payload", "value": "1488eac6a727d45d152ae5d487c23ade6ea7b70640ad6b01aea81dfc5fd1d2d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915148, "uuid": "17c9c7f8-dae2-435a-abe4-a62683ef57d8", "comment": "Malware payload", "value": "c257d02213737a1923f483c4acf15332ae37e1aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915148, "uuid": "ddf0e3b0-b398-42b7-af3b-9d18bae86e1c", "comment": "Malware payload", "value": "7862a962c58abce75888efb0dc60040017cbc40f04ce95e73206d70a15790d66da61944cd57005247e453cb71ade937d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915148, "uuid": "fa8cc4a5-d568-4221-9a4c-c1a4256710cb", "value": "CB3302D69B23E9C28AFADB670C5512D4636FD89C31147C59092A699380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915148, "uuid": "b818e0d0-cbfc-4f10-8887-95a66a2ce8d0", "value": "768:Uo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6Fqo:4eKCVQbp4LTaI7ZaiNQMIXAFXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915148, "uuid": "1813da33-d58a-41f5-821b-2fe5c16ed5eb", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915148, "uuid": "2e1343e9-7b52-4fa5-a364-f61111936d2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915148, "uuid": "b648e180-f8ab-4347-95f0-be44cb789000", "value": "statistic-1557236857.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a907e187-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911888, "uuid": "b5c832da-ddd5-45f3-952f-a2257c3e63f9", "comment": "Malware payload", "value": "98c3b68fbfe148e6dedfa09a87041ca8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911888, "uuid": "247dfe08-7d83-4a83-a964-906e86480a88", "comment": "Malware payload", "value": "149350b6f708ebba2924f5a0f063edc8092a8194e29f415c78ede6decd765f1d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911888, "uuid": "14d932a0-4c83-4310-8ac4-e30af00db137", "comment": "Malware payload", "value": "5675b3af3c5d0c487fe1ac4b17733e84ce9ed87d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911888, "uuid": "224f92c2-cef6-48eb-905a-b6d5ef69bf09", "comment": "Malware payload", "value": "93eb7f24cdced8315e7c7014a923913f7d2f45386ace4ced4318366d55c7e10508b49efb6c722e643019db265e9b234f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911888, "uuid": "92100dfa-5cb5-4d45-834c-ae1fb735bb85", "value": "633302D232D7D27AC0C105F5F42B59EA5A778EC9F83094E02E9FDD0112D31AA5E9274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911888, "uuid": "30b18889-9059-42d8-9956-730631e0072d", "value": "1536:sEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwn2r:ZnBrX5Eg5Enjq3axWIfkNwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911888, "uuid": "22308bc9-911e-4185-9820-682923d005e6", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911888, "uuid": "77132d36-14c3-4772-a116-c787394451c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911888, "uuid": "ee6af359-3f8a-44b8-9896-47f32ae8beb2", "value": "diagram-1158779497.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac420fe9-b404-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620921772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921772, "uuid": "f5082b06-d5d6-4c37-85af-20301ac5430d", "comment": "Malware payload (Dridex)", "value": "f736b8e1aba8a21184f32fcbcb66f771", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921772, "uuid": "c69b167d-6728-4763-89b5-376e002c1255", "comment": "Malware payload (Dridex)", "value": "14a1b5b1655ac2451481df5eebf93ac74e9f41a764f1927bd9c21fd3b0435676", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921772, "uuid": "41baa0b1-6122-4a0b-82a4-72df2ce69130", "comment": "Malware payload (Dridex)", "value": "238b8763b5de385190806f68ab8239553c598a51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620921772, "uuid": "ad5283cc-810e-4d89-8c7c-c0e0d69e4b9a", "comment": "Malware payload (Dridex)", "value": "56ae12b7421d0ffaafb77b9382b587bc874ca0f532870ecf7ac6137a1a16d5ffaece6fde47abb96572de792c88dfed5b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921772, "uuid": "9584a05e-ec6d-417a-b5c9-a118fa9c1488", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921772, "uuid": "309c8558-bf55-429c-bb92-b136f7ebdf30", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921772, "uuid": "fc3d515c-14f7-4ca0-87ef-21ae38064252", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620921772, "uuid": "3511d922-18db-4f3c-9722-8ad4d00772f4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620921772, "uuid": "089de90d-94d3-4363-9e9d-f3f651b68279", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620921772, "uuid": "e8a3ff07-1dc7-4d88-acff-61f427235bdb", "value": "f736b8e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b535d65-b38a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869131, "uuid": "4ac08977-bd01-4b83-8b74-0515fb7b887b", "comment": "Malware payload", "value": "2e3fc317e72faf43fd7ed3fef69f1621", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869131, "uuid": "34f58960-7645-4020-aaf1-7e52c9e52fe3", "comment": "Malware payload", "value": "14a713cad396356fedc9523b73c9a53b391f5b0b7f34026ed64c5681800ea889", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869131, "uuid": "80e7450e-3665-46b5-a1b5-eae48436ab47", "comment": "Malware payload", "value": "aa484639cd93bff676fa6b3327ed52a51cb8a1db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869131, "uuid": "b7a55462-7a23-45b5-8a52-ddbc68aca498", "comment": "Malware payload", "value": "22c28a24ee4625125a95517eb045699301af331eacab2696ebafd25fb3a5b9ee09cdb88f41f742971a1495899bca5493", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869131, "uuid": "f60975af-e0c2-4dd3-8b5e-0852382cf642", "value": "F933E188EF5BE818C7D273BBBC852F976B77026454DED59967C2308D4287E33161026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869131, "uuid": "642f5496-6435-4eb6-a085-ebe88bed3489", "value": "1536:Z2AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNq5z:ZNpoAnd9gucKCI5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869131, "uuid": "2670deeb-6876-4223-9816-002b47e0258f", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869131, "uuid": "a6378f6a-69c9-4b3a-ac46-027a3e4cdb8e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869131, "uuid": "3535e717-5ac3-49a6-a7ef-cf21fd771552", "value": "catalog-976374250.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189eaf02-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872991, "uuid": "88b8574f-4899-46fe-bea6-1b0869a1fede", "comment": "Malware payload", "value": "401d057daa74f482a9feb1bd438f99b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872991, "uuid": "28288597-a0df-4697-b8d3-2d39bc7bf077", "comment": "Malware payload", "value": "14ae6137a9a50ab60e896242167f7c8224998e263e7cbe9cfa138908149f23fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872991, "uuid": "32d90630-2020-4297-ad0c-e55f49bd786f", "comment": "Malware payload", "value": "0ba5e1e9dc25232cae2e045a6407ebc35862151e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872991, "uuid": "088e8eb4-7137-44bd-8fba-27456945369d", "comment": "Malware payload", "value": "368ab38284e4065c8748ec0e052a1e282dc613f7a0367377bd693a1e6ae0a8347f9ae972425e745a72df3532693039ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872991, "uuid": "4874a19a-ffa4-4aa9-9556-2146c8e1c3cf", "value": "A83302F2E643F6FC754381894BDC1E6B523B4220125D8CA1C55EEED6923D32A0F51AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872991, "uuid": "94aba37a-0eb3-4349-83e6-a93ae400fb64", "value": "1536:tI/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedM+:2XKAXh3TCdOi+KSZ4WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872991, "uuid": "d94607e2-0b39-4f73-9a61-46a3cd7152c3", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872991, "uuid": "ab79c56e-6520-44f4-a6bc-022e7dfee8cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872991, "uuid": "ab0ac1b9-04e0-4eb6-9164-058e7dd0a8fe", "value": "statistic-1836078139.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858ec5b1-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871456, "uuid": "a6ada2e4-095a-4eb1-90cb-ea7cbbee4cb4", "comment": "Malware payload", "value": "80b9e3e7f1375b7e0227a553094054c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871456, "uuid": "2ea8909b-731c-4c65-8b18-12ac5158bb93", "comment": "Malware payload", "value": "14aea6779d0cc07661924d66ddc58562d9d8df4bc6e20448de2d11d55638ad3f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871456, "uuid": "9999c2ec-f0d0-4f92-bd9c-91529c40ce91", "comment": "Malware payload", "value": "70849a4289be063e24a82e60678ee0421145ebd6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871456, "uuid": "c610f991-8610-4a9b-a6b9-8322005ae665", "comment": "Malware payload", "value": "243b1ef57b7de380ea60b92c3b1b5dd0f22306494875d17facad444d909639c3f274945674cab2a8101a13bf88b69833", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871456, "uuid": "03eadce8-65d1-4e7b-8fc6-751801713f49", "value": "B233F19137F9E900C6F2C1F0A0E27699274B3D918DB95DEE0C94A5B93F931A0CBE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871456, "uuid": "b29ebb4a-6a47-47c4-aa72-5d2323c26467", "value": "768:05G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJz+l:0/czJJSI7r3Pwh8Rt+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871456, "uuid": "b5d33b29-4179-4ef5-bdc7-9a8f4362b07a", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871456, "uuid": "6c222143-8780-4f56-8abf-71a4611456cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871456, "uuid": "fb5af90a-714c-47b1-968b-a2c13a4f0ebd", "value": "diagram-688820391.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5051fbdd-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871796, "uuid": "958d4b7a-7b12-412f-82bf-6bc420793914", "comment": "Malware payload", "value": "4f104f5d460cf63edc4a46b7ea71d698", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871796, "uuid": "28c2e13d-284f-44a9-9e14-8cfed2ab27f1", "comment": "Malware payload", "value": "14b977f80b029dbd4278bac088c39a0239d0ec5103511412e18870bb8667e5f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871796, "uuid": "50f2437f-a8c5-41e2-bbc8-50b6be20a92d", "comment": "Malware payload", "value": "4aa5f363ffbdbb5b27c3322f741caa071103488c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871796, "uuid": "73f94164-c2ba-4048-b7b7-2089039c6682", "comment": "Malware payload", "value": "bdd2058ce15d46bb5069f00728c3ea4bf372d8a41a70cd8bdeb361f08be69aa7002bc7be0e7da3ed8c005e02f685f647", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871796, "uuid": "ff499e33-ecb7-4f25-bd15-886ae902286c", "value": "B133019133FDE510C9B2C2F1A1E27688365B3C618DBD99EA09C865653FC21B4CED52C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871796, "uuid": "6e968200-ee1b-4b44-91cc-ef93ed0a9491", "value": "768:n5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ4tbzM:n/czJJSI7r3Pwh81tbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871796, "uuid": "73af1638-a9b6-4072-aaf9-ae359d1555f0", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871796, "uuid": "edc9a2a9-997f-4c67-abec-577132bdd5cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871796, "uuid": "c4045de7-8ca0-40b3-846d-de572194e269", "value": "diagram-969589185.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776e0722-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867997, "uuid": "6211e1d4-b077-4f7d-a78e-2b7e40c6cad4", "comment": "Malware payload", "value": "24349593b724fdcc37d94b160d9567ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867997, "uuid": "48a09564-723d-4b14-bf35-c6ff45b00782", "comment": "Malware payload", "value": "14cf22164dbeddb974b8aa4a042d411e0302c6686433c3368daf8abb8549ec85", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867997, "uuid": "bbf09aae-f88e-4461-b98b-4ec618126575", "comment": "Malware payload", "value": "81bcbdd97b9444b17c99376a5ee947a353e36e51", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867997, "uuid": "1e47cac0-0a6f-47a7-bc15-c5b2d3faf874", "comment": "Malware payload", "value": "c7d325b9766c830f14258304fbd8e9cba05eae7f024eb865945debc53a167422cc40d118ec3d074aa393e5e420883f35", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867997, "uuid": "b84300a8-5ad7-408a-8719-16a1c0e6cb64", "value": "F533E1C9EF5BF818C793737B7C882F976EAB0224659ED19857C3309C0292E66661027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867997, "uuid": "22ec8d5f-b9b8-4b52-bdab-85e1b9929b7a", "value": "1536:MAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrpPP:fpoAnd9gucKCf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867997, "uuid": "d6cf8c9c-b1fa-400f-a732-c6bb40de02da", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867997, "uuid": "ec6d7874-4978-4ce0-9329-e6b1ba4a8bb7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867997, "uuid": "18087f14-0829-46c9-9bd1-0162f10da391", "value": "catalog-2039275132.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfd9de4-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913184, "uuid": "9d0db08c-99c5-41c2-bf67-a08897f9d43b", "comment": "Malware payload", "value": "d26793d849c2030c07611d5561708ace", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913184, "uuid": "ad0e4763-91fb-4e6d-9871-553084338358", "comment": "Malware payload", "value": "14e26a79743ae92dd058b8819f79aa71859d387c2d67cb0ee717f8bf0a5d4041", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913184, "uuid": "dd7463c2-9975-4a19-a2bf-c281e1825e8d", "comment": "Malware payload", "value": "2dc4b805f50b706ec3030242461ce535f6ff3a33", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913184, "uuid": "1989cb47-0f72-44d3-ad86-26952ff717d9", "comment": "Malware payload", "value": "86143eab0864c92bf0fd3922ba870f1ecb953c2628c59a3741c8b52743279f1e1965d9048d103d9d9edec8bf4e28ebf8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913184, "uuid": "52b4c9fa-639e-4e9b-bc66-85a521281bdb", "value": "9F33F1D232E7C23AC4D504F1F527AAC952779E88F43490D01E9FDA4126E31B5ADA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913184, "uuid": "5885960e-0a23-4e1a-b41c-7eb1ee5ac2c3", "value": "1536:6EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRh8:vnBrX5Eg5Enjq3axWIfkNwRh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913184, "uuid": "6ccf1ec2-0284-4aab-99e8-eee794f38d9c", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913184, "uuid": "23e76d51-0509-4f0c-94df-d7bd372a4666", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913184, "uuid": "1ec1d3dc-3fef-490c-9c29-562936af0749", "value": "diagram-2064101718.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2ad900-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "de4da422-e258-48b9-af43-cad3f2f538fa", "comment": "Malware payload", "value": "22a0cf5de84fe73459818429c2ada558", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "dd2892ae-6ac2-49cb-a73b-2fc474eae4d1", "comment": "Malware payload", "value": "14eacbe13e426307bbd5a1f105f8eb8258d7dd0fb9351bb1dda8fd14d65e390a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "43b255b5-7bc7-41e9-b37e-02c3704d5312", "comment": "Malware payload", "value": "b6a7cbd46824b34393426969ac2308915cac58ae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "4156f05b-68a1-4931-821d-a594d0a2afd5", "comment": "Malware payload", "value": "845d69ba68eed99ca2d6d54861d401a59e8b07ca6b4cdb3e748d2592a04d499347cc2a151e317a3eed28af51ff3fbcc5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914816, "uuid": "360c39e9-66f0-47cb-bb18-366a74330d7e", "value": "1933F1D56A23F5C6CBADDF9704A623A8535FD89C31643C68093E29C341EB164C4EABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914816, "uuid": "7dd7f341-2ea3-40dc-b75b-7d32611d3a96", "value": "768:lo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SSRobylb:/eKCVQbp4LTaI7ZaiNQMIXCRUylb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914816, "uuid": "f5e68e1c-3aa8-4e1d-8d0d-b8752b2ff8e6", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914816, "uuid": "360edca2-3a63-428f-abd0-2459097cbcfd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914816, "uuid": "a6d42496-d562-4a05-ba73-f803b94c5ba4", "value": "statistic-1312437885.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac39c61a-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870233, "uuid": "4d900236-2017-48e6-a63e-c7f3ee98b52f", "comment": "Malware payload", "value": "a4f8f6d907bc9df44eff17387e54cef4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870233, "uuid": "1541df10-5973-4943-a7a8-d50bb539427e", "comment": "Malware payload", "value": "14eaf684c1e68e0d641eb1d70b978a927bbeecb090389ab8a8f69fec3129b3f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870233, "uuid": "37c77945-7415-4ef1-9698-a0197fe7acfd", "comment": "Malware payload", "value": "d5123a0c213ea2bfb22a49510edf3ab7d41b9412", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870233, "uuid": "5f615b8b-08f0-436a-8240-2d9a6f6ecd62", "comment": "Malware payload", "value": "7b67823e5229418e2c68a903349b470b15e9344bcc81030f873fb49414f438f2e38b67b33528fb8d9fc73a6b96c2c5e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870233, "uuid": "28374ef2-d6a4-4122-a216-d81d3bb57acd", "value": "7933F19537FAF900C6F182B0A0D1B689274B3D61CA695EFA08C476793F931A0CFE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870233, "uuid": "8296f08f-a412-4a59-a636-5d7ab6c3fd70", "value": "768:h5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJe2Q:h/czJJSI7r3Pwh8RE2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870233, "uuid": "0c0b8999-3273-435d-9916-ab25c89f2a6c", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870233, "uuid": "631381a7-9da8-4cde-a5fe-3d4c3dcb4852", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870233, "uuid": "b4c3a8e6-fa31-45cc-91ae-cadd7d152c50", "value": "diagram-1769640353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2960ac7a-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910386, "uuid": "f0971c37-1b11-49dc-9b0b-09020ed14a25", "comment": "Malware payload", "value": "402c0901ed089ba88d5467ed3d0091db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910386, "uuid": "b8c55f23-14c0-4428-841f-486da1b255de", "comment": "Malware payload", "value": "14fbd0ed3338c4f886f2704b1f4e2865acb6aa52421341741d458e498be1f3a7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910386, "uuid": "4c8d7f96-9257-4dd3-bdc0-794467f3ca4f", "comment": "Malware payload", "value": "03186978549c1f1e1209f1d2a31706c25b105a48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910386, "uuid": "5ed3fe9c-9eb4-42d2-bff4-77123a95178b", "comment": "Malware payload", "value": "c5964c53e11790fb04c5c1bba507cd83757a6afa5127d09b11f0b6c197c958618e95c0f02d6d2a933bcaa668a10d5915", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910386, "uuid": "68efbb3a-0ca2-407a-9f5d-8303d4036d6c", "value": "B03301DFE009FAB7C39B53014FA5AB6202FD754CF13096689355C2FAD6832C285799E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910386, "uuid": "7ce435ab-cd42-4086-80a8-1d367f39ec54", "value": "1536:QxTuDqsF1Cnc3P57oj2+nC6uxkLlyx2iB:QxTqqsF41j2Pxml5iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910386, "uuid": "2e3e02e6-5aba-4a44-8018-245710088feb", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910386, "uuid": "09ac8521-e5ec-4d22-b0c7-9292f863422e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910386, "uuid": "91cae6f5-a215-4228-b1bb-08a0e46a18b9", "value": "catalog-1970196328.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14ef485-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913271, "uuid": "a662efc4-e75e-485a-97ef-3a50821c96b1", "comment": "Malware payload", "value": "33cddbd2eeedd0d3d15b48d6a1dae300", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913271, "uuid": "6015127f-5786-4737-b59b-557d696fc4a3", "comment": "Malware payload", "value": "150c76da05d2679f083d51e2eaf057d60b1d0d80353376024c35f1e1c242d12c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913271, "uuid": "e400b575-13f5-41bb-bf11-41b8cf40a104", "comment": "Malware payload", "value": "38bb30be263c568bb6f1a80526602008ea6b201e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913271, "uuid": "92d237a8-c11d-4a1b-947e-1009a8e6aa5f", "comment": "Malware payload", "value": "bae1ec45bba5d60db193f1a7cbbb35720440329072482a093af67814b8d7806190817dac98062dad770e386150ce7992", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913271, "uuid": "6a2a5028-f138-4b79-9897-e8e643fca74f", "value": "C433F2D133D3913AC08609F6F82B5DEA26B78EC9D520D0D06E5FD91112E227AADA170F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913271, "uuid": "12c5133a-75f6-4db1-b503-0ab911132fc2", "value": "1536:nEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwz5:EnBrX5Eg5Enjq3axWIfkNw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913271, "uuid": "1e82298e-b0a8-41e5-9da3-03a650f0d979", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913271, "uuid": "79984b97-5c12-4c78-a336-c4a77dfb3ef6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913271, "uuid": "6d4eedf1-6df7-45a7-befa-6d6d4b5216a6", "value": "diagram-2142637013.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a60289-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870299, "uuid": "7ba1e1a1-7f8d-4202-b523-58a558face51", "comment": "Malware payload", "value": "2c66a6feaf9a0d38e017809cedf32267", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870299, "uuid": "e3288b28-8b26-42a0-aa71-23f20ab31685", "comment": "Malware payload", "value": "1510d27b3b0e72961a377df4c4eeacbfe7fa4413909702042233061e3e884e3b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870299, "uuid": "5738fcc5-2adc-452f-97b1-04e80d7613f1", "comment": "Malware payload", "value": "8987e50693078643968a8a6cab6f93d1a118da55", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870299, "uuid": "45a70cdf-c51c-4788-b2a3-750bfb7545ee", "comment": "Malware payload", "value": "e03a387d792ab8557c7284a8ca1a67c791d5553d6cf0816bca1d284cf72d08e3ebc24deb9cd738d53767b46942d406e3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870299, "uuid": "83500708-3db8-4686-984b-820b3b45efd5", "value": "FD33029673F9A900C5F1C2B0A4E27588374F3D928DBD5EDE4C88A0793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870299, "uuid": "4fa7cd5f-dff0-4735-a5d9-927e33688146", "value": "768:N5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJw8:N/czJJSI7r3Pwh8T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870299, "uuid": "bd9fd805-634a-468e-a734-f0e2fa1178df", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870299, "uuid": "eb9cffca-0ecf-45e7-ad6f-7e8c2d7f2804", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870299, "uuid": "c51773e4-7b2c-4bb6-a0bf-16456cabd0cd", "value": "diagram-1808857017.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844afe45-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874031, "uuid": "3141a69a-91b4-4028-ae7e-9b1c9c6856bd", "comment": "Malware payload", "value": "b508cfd7b4f11a51f2d592e0f48e496f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874031, "uuid": "ffb26748-a684-4cb1-84e7-52bac9087b9b", "comment": "Malware payload", "value": "1517b9f9c36aa34d62175df621ed2dea2f33226b407b3471174f6f0f394e77c5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874031, "uuid": "f7de8dc3-27d1-4b69-a72c-5024b7901394", "comment": "Malware payload", "value": "5a65c5c669432779c3fd84613d3771ff21a64100", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874031, "uuid": "4533e0bc-e818-442a-8b0f-0b048b20ee39", "comment": "Malware payload", "value": "552deea8fad5f07b8dee1284ee5589ddd72ff86fff168a8af8a2053c5508dbcd6a92ab276f2a655b4a53c5dd57cf0b26", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874031, "uuid": "4594aa88-4d18-4de5-8c5f-7a06d35ce4c1", "value": "003312B6D242B5BCF643844A5ECC5E2B423B817062284EB1811EEFD2923D71F1791B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874031, "uuid": "7fe3c732-c7ae-458a-9790-0ea21ebc03c5", "value": "1536:a/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeVuEw:KXKAXh3TCdOi+KSZ4WauEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874031, "uuid": "7d6dc9d9-f702-4d26-b341-49716e8b0d62", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874031, "uuid": "71b1640a-0e1d-40f3-8ed8-79a33505a29b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874031, "uuid": "d995c814-d4a4-4c0f-a7b5-d41ce4d840b6", "value": "statistic-524048659.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902df391-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910129, "uuid": "1f237eb3-7aac-4925-bee9-04272cbee5ef", "comment": "Malware payload", "value": "6e8588510f6876c05a183515e268d991", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910129, "uuid": "bd17118d-8acd-4a61-8f50-10f7925a56c8", "comment": "Malware payload", "value": "151847ba1a031261a36801181d1b08699f0e37140f9e4717a3b49f6161b1dbab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910129, "uuid": "652f7316-89bb-4491-b684-e0205f75e0e4", "comment": "Malware payload", "value": "ddba9eeeb41766ac68296a5e138439029d4ecdcc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910129, "uuid": "6cd09571-313f-447d-a1a6-5b34607a3925", "comment": "Malware payload", "value": "c84ca472305a05ae234fa1d7a3f1073869235bb25d2bda576523228ceda45343697ff35bc11725db67f4c5ca6054428a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910129, "uuid": "9cefb324-5fc6-4a57-a2ee-306106d4fb9b", "value": "2C3302DFA014FAA3C1AB67015FA997A206FC791DE270D158C35AC6F5E5C35C2C12A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910129, "uuid": "04a6c1df-5f1c-486c-8af2-b59d7865c443", "value": "768:Oqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7WL7:/xTuDqsF1Cnc3P57oj2+nC6uxkL7WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910129, "uuid": "e82ca04e-469b-4167-85c4-c193ae25ac74", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910129, "uuid": "14ed1f8c-cb0e-4e06-a722-fa43bdcd2df2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910129, "uuid": "25bdaad9-ba30-4aca-a282-43bfa8a5344c", "value": "catalog-177855547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e406c2-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913111, "uuid": "856d3314-2431-4bdf-8486-4757fef4b4a4", "comment": "Malware payload", "value": "a8806f9e8719245d3773c5bde7c907f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913111, "uuid": "4e5166ea-e1bf-45fb-8d38-b880a1d16757", "comment": "Malware payload", "value": "1518ac953bfd7e558d47f18e1882bf1b60c2a71c0a3b431ba79720e1388cf254", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913111, "uuid": "a8ed073e-0f4b-4a8c-be44-dbbbaea7a768", "comment": "Malware payload", "value": "9aa3ac6f8ed01a60e02cc0b66b83793e584fb772", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913111, "uuid": "3785515c-4eae-43a5-adc9-cfe43bfe5cbd", "comment": "Malware payload", "value": "6d82eb2bf9657bdc2183cfcd79b46362d98fe746a6864fb582a45b939537cdcd98360e8252f61a44eb8d7d9206c5b3cc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913111, "uuid": "0dea133c-f625-413f-aff1-80aa824407c3", "value": "E633F1D233E3D13AC4C205F1E4275ED969978EC9F920D4D02D5EEA4012E31A6EEA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913111, "uuid": "b904f9f2-eefd-47af-aa7e-33e84d3ed271", "value": "1536:7EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMui:QnBrX5Eg5Enjq3axWIfkNwfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913111, "uuid": "5617a8d7-82ad-4b8d-a588-c0088c8df7bc", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913111, "uuid": "f102f4b1-8296-4370-9ac6-2ab1be995edc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913111, "uuid": "93d02794-718b-4ff1-a836-05f3ba18179c", "value": "diagram-201948315.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebc49fc-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916569, "uuid": "a681ad5b-14ca-4c92-8d23-d1be718b2fe3", "comment": "Malware payload", "value": "37e1dc6e8963aa6d38efd3e2ac855c4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916569, "uuid": "b5b0983d-53cc-4529-b21d-43ffd986a071", "comment": "Malware payload", "value": "151c01fde0be3ff48ebe6664ae6c9b1860c6ef85933a35f0784d9f9455a4b891", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916569, "uuid": "247c6414-6f94-4cdb-82c3-f75a10d6934b", "comment": "Malware payload", "value": "bc986c4b84adf9969a70739c1883e2f8a6e847c2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916569, "uuid": "462aeb80-de5d-42f2-9e04-1984635e9de0", "comment": "Malware payload", "value": "97de16e0c4d5db15a1b239072d75d8ddc08d8180b15c648074f51a0ddc1b934fcf725a1f1f469236b1ebb3c454709ee8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916569, "uuid": "14bcf79e-0e6a-488a-8d0a-2a879c4b4789", "value": "363302D69B23E9C28AFADB670C5512E4936FD89C31147C59092B299380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916569, "uuid": "3a1fbe7a-05a4-4409-a976-88d465600ee3", "value": "768:Jo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6Fqp:TeKCVQbp4LTaI7ZaiNQMIXAFXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916569, "uuid": "259fa812-b8c8-487b-981e-d5f78553e9a4", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916569, "uuid": "daba3f04-a025-42fe-b5d4-6f3ba5b988be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916569, "uuid": "a3e6b167-ccd4-4454-ac7b-ed089b00e9f3", "value": "statistic-607808529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ba6684-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911457, "uuid": "64ef9b55-89f1-4221-9616-6855f4e97073", "comment": "Malware payload", "value": "19457f4be4cf4e573a704e4ee7c30778", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911457, "uuid": "3f78ed92-91c5-4f02-b9f5-03d8ec339dfb", "comment": "Malware payload", "value": "152163ad0dd65d87a9419ebb1bfa9101d99dfdda5b8e57ef498406fa49166624", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911457, "uuid": "89cb5a55-0bc0-433e-aecb-10680524480c", "comment": "Malware payload", "value": "2e50c1a9dc03b573148091d7c913c5a6d67eddc3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911457, "uuid": "96b2d02e-70b5-44f9-bce7-bf25d2025fca", "comment": "Malware payload", "value": "beb313007bb9dfde03ea2ec2c99653866b1c10ae772a963da7640a1e475bf6c57caa632a2b679314a111bbabf19d219a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911457, "uuid": "52251b01-ee14-4fc0-a889-25789ccc3573", "value": "B233029F6014EAB3C29B67005FB897A205FC7508E170D16CD35AC2F9EAC36C2857E9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911457, "uuid": "b411f68a-9534-4788-bc47-0f0b79bb45fd", "value": "768:iqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7bKb:zxTuDqsF1Cnc3P57oj2+nC6uxkL7+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911457, "uuid": "d9f33437-8706-403c-827a-0f1c5af29752", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911457, "uuid": "9e649954-6d50-4001-a5b0-95f13e65a819", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911457, "uuid": "06614f0e-7785-48eb-894b-a6c65c370792", "value": "catalog-850693563.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8284e7a-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871622, "uuid": "5373798c-cc43-4d52-be7e-860d402a7b03", "comment": "Malware payload", "value": "7a41ec299684d81d67d76fbf956d455a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871622, "uuid": "989edf97-1584-42e0-9ced-5c2c505d16ec", "comment": "Malware payload", "value": "152637891a6c73dcfbad4014f11162020c9bd58377841b336271d11d800a42d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871622, "uuid": "31ff4c3f-bbf5-44f0-bde3-f7c8145dad6e", "comment": "Malware payload", "value": "cae012da866642b46ba21b577dfe384770f444bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871622, "uuid": "67c35035-6576-4905-8e04-154c04c8901c", "comment": "Malware payload", "value": "1067bca328d9bdb9dd987a3016400d85c2f1cda904e56ab4074678e29145e3d547b8813f9afc9b2e9ba20a71636b1b44", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871622, "uuid": "334198b5-f1fc-4f83-8ed9-a498ecf27c8b", "value": "FC33029673FEA910C9F1C2B0A4E27188374F3D924D7D5EEE4D88A4793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871622, "uuid": "ba8740a5-46be-4fe9-8877-25f1c0da6a03", "value": "768:Z5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcV:Z/czJJSI7r3Pwh8fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871622, "uuid": "76a886ee-e3e9-4107-b534-f3e7efe2645c", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871622, "uuid": "b7122fd7-d5cf-46e3-9dc5-314fa9b30e73", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871622, "uuid": "085581d3-33cc-4900-8a95-72064c72f87b", "value": "diagram-839043929.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c7d8e9-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867130, "uuid": "44522688-05d6-4dfb-999e-6523a602df48", "comment": "Malware payload", "value": "ac3f4192d3ca4f3baf35f45cedbef525", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867130, "uuid": "46c9f74f-d76d-44f4-8170-78424d3b49ed", "comment": "Malware payload", "value": "15351382177943ab7744e793a5df4f59deee4489967a9c843c10d2027f96b77f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867130, "uuid": "c620bd51-2b8a-4c99-99b2-b79b095f975b", "comment": "Malware payload", "value": "00c66a0997d42be758648b378585363340341ec1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867130, "uuid": "c092e51e-7caa-4883-a842-d6045df79377", "comment": "Malware payload", "value": "b540797d21df6c7d6e25c36c2c0cca4d15013dc4cca21f682a1800f6af445c0894d01f2c17ed96cb5256d6021adb6506", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867130, "uuid": "71fc7afc-7c63-41d1-a4a8-f4c68ba69fc6", "value": "1933F1C4EF57E428C7C373AABC842FA77FBB0264148DE1D55BC2319C1196E67161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867130, "uuid": "0066b0d5-6568-440e-8bba-993562248083", "value": "1536:OAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVyE:lpoAnd9gucKCoGVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867130, "uuid": "2acc08c4-6031-46d9-98e7-7eed5efcb28c", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867130, "uuid": "423ec1e3-2152-4420-8218-4826cdeb29bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867130, "uuid": "9923134e-25ff-4fc2-b686-e74336704f42", "value": "catalog-1346353509.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dc5ee6-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874331, "uuid": "6bd744b6-0be7-4362-a867-fc1185c3a221", "comment": "Malware payload", "value": "72bc613970ede7fb5fefaef4dac8fe55", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874331, "uuid": "ddb307f7-79b6-4bf6-acf6-b154a0a0069c", "comment": "Malware payload", "value": "15462522d1ddc937ba50864936706fe55efe5a87d57b1ef222a4377b4b4a52c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874331, "uuid": "2d9dd777-d7d2-4638-936f-f3916334723c", "comment": "Malware payload", "value": "5cc0bc8f666b5ba86017ddff499627fb36f22036", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874331, "uuid": "7421e4d1-e509-45c8-b894-258ea8afbc65", "comment": "Malware payload", "value": "1cd5dd9a90f8aa3aa4bc05da60f232aa27e6f4547204d41038091e53fe3dbde4fb896a933375d6cc7555f83cf80420c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874331, "uuid": "635bb444-92bb-4f1f-9d19-2d8edcdc8396", "value": "763302A3C312A2BCB243C04989CC1E979377427026658EF2C56DFED1A73D7120B61B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874331, "uuid": "cd1dde7d-62da-43a1-9e89-9d8509e901bf", "value": "1536:x/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8L3cR:xXKAXh3TCdOi+KSZ4WpRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874331, "uuid": "db53cca0-fbff-4256-9150-1a1a882ae0a5", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874331, "uuid": "861c6683-0c14-4e9a-992a-f389fb4527bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874331, "uuid": "65027eac-0b4c-4382-811f-e9edc30bc9fa", "value": "statistic-792288245.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e20046-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912789, "uuid": "f66e807f-ccd3-47ec-925e-0124a124ce07", "comment": "Malware payload", "value": "36b51edd72ca0782cf1d9f67ad9380ff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912789, "uuid": "252485ff-dfa0-4e58-b3a5-e4c0f3bc5b26", "comment": "Malware payload", "value": "1562e58494cbd66101dadc2f3272f5b7f7cdf59ae326d89727ac750ec0d15b8e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912789, "uuid": "01c12029-3722-407c-b252-db28b7df24b9", "comment": "Malware payload", "value": "fd19cc2a885e93f845bd60ca2138126a3a339d68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912789, "uuid": "b574c749-e39b-485e-b593-8d2549256ccc", "comment": "Malware payload", "value": "bd023670217e35b2529974e541ec531d8aedb671179caa2fd51173cf59b061ae9451d8fc80b26ac03f1016d4a8191f9a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912789, "uuid": "dd144a40-af5c-4b60-a2c6-b8e8b04403ef", "value": "D23302D232D7E23FC0C205F7F51B5ADA16B78A99E93090C12E9ECD4112E3165ADA234E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912789, "uuid": "b5b3af71-f469-4734-b65b-cf09c94909f2", "value": "1536:mEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwnn:znBrX5Eg5Enjq3axWIfkNwnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912789, "uuid": "fc4467ac-e9be-4c1b-b3d5-9df279483bb9", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912789, "uuid": "6c6ce6ba-fcc6-4c74-8151-96d64e7580e3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912789, "uuid": "df0157c3-4918-4baf-8fe8-c14b2a7f4269", "value": "diagram-1901770165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d0fd3d-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868848, "uuid": "ba80b4e3-9d83-4332-bb1f-e0c8accd1ec0", "comment": "Malware payload", "value": "1d63a59da47fc487a457943cb7f559f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868848, "uuid": "28888447-de16-4424-aaaf-77fb4c239948", "comment": "Malware payload", "value": "156b3c10504793ed66b4db0113c5f7725a9bac5a3617bf3f44063a4cc949a3c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868848, "uuid": "fb09cda2-71f8-41db-921f-82f86ad3d95e", "comment": "Malware payload", "value": "64abf7f6853c6fee9cc58597e52fb167ae38a076", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868848, "uuid": "30052e94-caeb-45b4-ac48-4c03ea663ca4", "comment": "Malware payload", "value": "2322ab4d8d9dd06b70706668484fff8460041f8e3a46894317e7a3dae5571719aa3e6bce856acf5477cf0f82bbaf6097", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868848, "uuid": "bc956b4b-bb2b-479d-9bd6-a5edb140efdc", "value": "6933F184EF57E428C7C273BBBC842FA77FBB0264248DE1D55BC2319C4296E27161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868848, "uuid": "7802057a-a4b6-4068-b7b4-f6bec1b12c9d", "value": "1536:S0AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVjIv:EpoAnd9gucKCoGVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868848, "uuid": "d140d3a8-a293-4ebf-bc3f-7ae685ec1738", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868848, "uuid": "7e92d4c5-0c1b-4fb6-adbb-7530d0c9da21", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868848, "uuid": "6dfe3747-092e-4a42-bc76-ae5a20a9d048", "value": "catalog-745517538.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5628e8-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915706, "uuid": "2303d93a-0082-4bc0-a23e-4137fd40bcac", "comment": "Malware payload", "value": "329e4616df5a54bb845a6d3e108664d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915706, "uuid": "34d82ca5-b398-48a7-8387-1686a4ecbf64", "comment": "Malware payload", "value": "156de313674ffe30515ebe7f4ef877e945b71e75791a87a1fd9913453b176611", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915706, "uuid": "b95ca841-90cc-4775-96ff-172982216337", "comment": "Malware payload", "value": "6ae1d29a33f26198b9d77a8251dd18af1bbfc8a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915706, "uuid": "1a02d2e9-f903-44d4-8cf0-f7160ae1ad09", "comment": "Malware payload", "value": "d322a33ed24eaee3baf6fe0ce587ce7bc640dff999d3b930e68b7340a5df0b5b33429f35344e61cc7a82a5f7e65803c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915706, "uuid": "20aab74f-b503-4326-978b-adfc4b1da425", "value": "1133F1C66B23F5D2CAF8DE93144A63E9635F888D31043C596D2E698281BF118D4FB6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915706, "uuid": "8622cb01-bf67-4814-a9ff-4f4047dd6018", "value": "768:vo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Sz82dna:VeKCVQbp4LTaI7ZaiNQMIXD82dna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915706, "uuid": "cafa4a4d-7b96-4206-a66e-6968491b8697", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915706, "uuid": "4e56b0fb-3175-4314-94be-95eac077c294", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915706, "uuid": "6533f484-8830-4500-ad5a-aa9e1cd9c122", "value": "statistic-2011411664.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f861e9ea-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874226, "uuid": "262b7335-6971-4b18-85e0-3040fd997dc3", "comment": "Malware payload", "value": "1167fddeecb725a94c2ce2a23ff51431", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874226, "uuid": "4c9a428f-f869-4f27-b9a9-54e5d4f3c201", "comment": "Malware payload", "value": "1583cb0d9dc8f4d7f47fcbd9743f362ee4f87b483fbabd281dae195c04b7779e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874226, "uuid": "41e5f753-d892-448b-9e16-39ba849e2dec", "comment": "Malware payload", "value": "bc65d4dd70ee5e26ea53d1c090b640bad694379d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874226, "uuid": "b59b8ef8-740d-48a8-90ad-a5900b473d7b", "comment": "Malware payload", "value": "cd79c716e0b63cbf14cac7baf7b0f42b129c7add2c682894e5512279c772f6dbf115db072833c175bee700eb472be8e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874226, "uuid": "b17cb283-7e8b-43bf-bba7-935c656756b7", "value": "3E331266D243B2BD7243C4898ECC5E6B5237823055689DB1C91DE9E2D23C31E0B5276B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874226, "uuid": "5dc87f2f-37bc-4690-9a11-1bb1a2551faa", "value": "1536:0/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeI82:sXKAXh3TCdOi+KSZ4Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874226, "uuid": "3bd4aa8a-f354-48a8-bdf8-4241ced271d8", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874226, "uuid": "0ed80cd2-d2c2-4862-93cf-410a31a220f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874226, "uuid": "c7c53fde-0927-4c3f-a052-2a6f7bebf71d", "value": "statistic-695031021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55dda82f-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896717, "uuid": "f4b5549c-dfa9-4fdb-a6cd-e1b8cc407086", "comment": "Malware payload (Dridex)", "value": "58788911738c7f243d98dacae5744c13", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896717, "uuid": "fbdd62e9-67e4-47d7-92cf-1a08b4e40a33", "comment": "Malware payload (Dridex)", "value": "158b5d816ceb20ced1e80df4a86061bdb59f4ccd562ad5a18b5f73f61b459645", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896717, "uuid": "d1ff8f6a-ed14-4ae6-9757-214ef7acf231", "comment": "Malware payload (Dridex)", "value": "d4bd93107054d205d07e96b96543d6eb631c604b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896717, "uuid": "63420da4-d412-4207-87bf-6401545067c2", "comment": "Malware payload (Dridex)", "value": "391557c7c8554396c9e6734d066fe669a184e6d736512e1fb15468e99f00af78607e1154c1ce813897871b6c72cc5c31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896717, "uuid": "38ae56aa-0b0a-4aff-8b1d-07583be8c304", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896717, "uuid": "82e48c75-57ab-4415-87af-1808181b5bc1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896717, "uuid": "b9a85da4-70d1-4010-b2d0-00c9870648df", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896717, "uuid": "e6f29e30-2c23-4609-b60d-3459e1c4ab31", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896717, "uuid": "05e69a1d-016e-4e4f-a103-656cecc863e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896717, "uuid": "6b07c123-c434-4bf1-afa5-c33f708258aa", "value": "58788911_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452e98bb-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867483, "uuid": "62e85d0d-706b-42e5-a6a8-c74dc2203ca0", "comment": "Malware payload", "value": "d4bd240f5378a0a044ecc23acd3828e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867483, "uuid": "a1378b32-d544-4094-8723-ad11201731a7", "comment": "Malware payload", "value": "158f07fde2f13a6fd06a826b5589d87afbeb02850a45de778e975b9087391333", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867483, "uuid": "1d53c35b-3b26-4df5-9176-7b7f1099a45c", "comment": "Malware payload", "value": "b66feb30b8b937ed84fe7177a26560b3b05fad2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867483, "uuid": "1c80c3e0-dd46-47c7-bf64-46c5fb73e9ed", "comment": "Malware payload", "value": "b081ecb17de6f40f5af82304d88f107249375b8ab2426f5f923e6a606f7c5bbceae1cda61a4f4e2556050ef948030ea4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867483, "uuid": "25c27a9f-076f-4134-b998-d1c8a0c7f222", "value": "9933F1C8AF57F418CB8373BBAC881F976EBB0354649DE0955AC7319C0296D27561036F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867483, "uuid": "ed32a60e-8a62-45b9-ba6b-ed6825ded37b", "value": "1536:tAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHidJW:KpoAnd9gucKCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867483, "uuid": "52f49918-fb5e-4db1-8495-0e980010a66d", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867483, "uuid": "b9ba0bad-3262-4b0b-9b26-9dd65d7275f7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867483, "uuid": "4fa74a26-510d-40c5-9f07-b551d1e37575", "value": "catalog-1635171314.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8dd72d-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873565, "uuid": "70f467a3-b2f6-4e0f-a734-2e910aa5c4b1", "comment": "Malware payload", "value": "de3e35ff3ab3047131468253257a9eda", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873565, "uuid": "5331718b-0df8-46c7-adbb-19a53d40d994", "comment": "Malware payload", "value": "159297d73b90926da3bb1db9645ca768d9e82d7aca2b6970b7857336877fc43c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873565, "uuid": "ea58931f-76f0-4033-b63c-6914fe56bf06", "comment": "Malware payload", "value": "f926ba9cca6615e4f722c527aac53e42a48c1b90", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873565, "uuid": "75279117-4a75-4f78-9b92-1fe1ce64b0de", "comment": "Malware payload", "value": "9f1eee319e278bb682abad859533386d316f6b2b66151ca5e35b89a781660d50f87ba367a562922a2b6942f368251c67", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873565, "uuid": "f9b3c2af-2f6c-4e2f-af9b-54d4c49749bf", "value": "513312E3D683B5FC7503808986EC1D6F822B836057494D71C65DEEE1933DB2A0B51BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873565, "uuid": "6cc052b0-abce-4d65-b3f4-426cfcd77864", "value": "1536:zs/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeZM:wXKAXh3TCdOi+KSZ4WQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873565, "uuid": "3962cbf4-91b5-4d45-b102-359cfb4a673c", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873565, "uuid": "0c0c5841-4818-491d-8592-ab3e3ec96b63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873565, "uuid": "476ac2cf-9e60-486f-b39e-a47d012a3be6", "value": "statistic-2122636792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592afc51-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912184, "uuid": "f86f67f0-6f38-4c3d-a22b-fea9ed535c04", "comment": "Malware payload", "value": "e62faf6c8303ebb7166837a5612ab4aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912184, "uuid": "0492830a-46a4-4ffc-af44-2a00ad0eeac3", "comment": "Malware payload", "value": "159500335fbe77ea5f1f69f9389ed1f9c182c3033ce746f419a2efd8f5cafc29", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912184, "uuid": "9b507f55-c317-46b3-ba7a-113b008a7113", "comment": "Malware payload", "value": "0e543ec77e257b419e7d82b359b6c0587beb6991", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912184, "uuid": "8e20f5ce-62fb-416a-b0d6-76c8a86bf89d", "comment": "Malware payload", "value": "3ad673a81c04361d6105d6f06b4b4e516ec886742f122ccdf957bd37d37190f789c8ee937c3de6ccc28a92c4639eb4a7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912184, "uuid": "25ae3c68-fb21-46a5-9674-f849aa22001c", "value": "A733F2D232E6917AC4C505F5F52B5AD552BB8E8CF53090D01E4FCA1112E31B6ADA278F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912184, "uuid": "1b174fd4-886e-4693-a1c1-e9975941423a", "value": "1536:zEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRe:YnBrX5Eg5Enjq3axWIfkNwRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912184, "uuid": "86ad6b3b-ba7a-4038-bc77-e6e9beaa9b9f", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912184, "uuid": "d56f567d-c170-459d-a38b-b58d4a92c4dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912184, "uuid": "0bf03b77-7dfd-4d5c-90f1-197ad769865d", "value": "diagram-1441379066.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe1d556-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867098, "uuid": "de24fbb4-5090-46e6-85b0-09151ce528c3", "comment": "Malware payload", "value": "4c0829b7ae163381810306d5ef1d2e58", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867098, "uuid": "24e021d7-1ab6-462f-baf1-aac9b488e22e", "comment": "Malware payload", "value": "1595a08eba97ab3647eb6a37f87cd4e1c3376feb380e1a60e30fa0de9a3939a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867098, "uuid": "a7623426-3cd0-4af9-98f4-0a6a2f8934b8", "comment": "Malware payload", "value": "0f38384eb785583d0f8b51ceaf3f5fd370eae770", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867098, "uuid": "a6f393e7-bc29-4914-966f-fe752c713848", "comment": "Malware payload", "value": "c1651e4d7aeebfd76f4f0cb96769c5758dde67ad62f771a71736b97001d835197ded1f03a3f54136fb85b04d53a381d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867098, "uuid": "dd7e8c16-bdc9-4b97-b03e-4f6d179819ff", "value": "1933F1C8EF5BF418CB9273BBBC482F977FBB0254648DE1955BC2319C0296E27161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867098, "uuid": "5f8e19e1-4c9f-4ca9-aa07-7bf1a3f1a3d1", "value": "1536:FAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiAMOc:ipoAnd9gucKCAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867098, "uuid": "c94077e7-4cbd-4fea-8ef8-a1412fe4d7b9", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867098, "uuid": "fc78d5cc-6f7b-41a3-9c4c-c24d382464b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867098, "uuid": "710f1f9b-b6d0-40d5-a3a1-adf9b8bd7527", "value": "catalog-1327720011.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1197476d-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911205, "uuid": "c6857b1b-4756-4f0d-bf4f-771a4305656c", "comment": "Malware payload", "value": "2889374f245223f15812e090c1aabdba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911205, "uuid": "52a1a111-e665-40f6-ae97-1875d8a9de4a", "comment": "Malware payload", "value": "15a70910ea3635a472f04cea03bb5192408ba24994192feb1adb998b8fa57a5c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911205, "uuid": "4a53afd0-decf-457e-a79c-9cb200e9ab88", "comment": "Malware payload", "value": "bc793b9cf25da177d8bc75e1eafbd9b5399d95b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911205, "uuid": "7eef5ef4-1adc-4bb7-baaa-3360f805efd9", "comment": "Malware payload", "value": "863f7ff8aa9806f0c3dfddaf81e2ea610d8fd05520731e8d1459b2e5d0bccd68536a55b51cffb8758163792f2d30f2b8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911205, "uuid": "909a26fe-3f2e-43f4-8705-58f4f2a6a9da", "value": "2E3302EF9410FAB7C19B67015FA997A302FD7919E130E198C35AC6E5E5831C2817E8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911205, "uuid": "72682105-a13e-45c1-93eb-380fcf62ddd0", "value": "768:Qqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7YL6:JxTuDqsF1Cnc3P57oj2+nC6uxkL7+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911205, "uuid": "d2a9c7c8-e183-4c3f-8a3b-a7e8e3a66f72", "value": 51710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911205, "uuid": "595a79c1-03cb-46f4-9ad0-5e22bad3b6e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911205, "uuid": "4e67a9a9-fccd-417e-9822-2693a6348faf", "value": "catalog-66930390.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9d3c56-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912753, "uuid": "505ec303-c567-46a5-aa21-ec00809b12d8", "comment": "Malware payload", "value": "277df0483298f76ec347b0aecb454054", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912753, "uuid": "f895dd72-5ab2-4247-acc7-1a17986cc9bb", "comment": "Malware payload", "value": "15a8f79161e88056ae0686fbe90e30d5759b18adb686f93aee8187d92aaa8022", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912753, "uuid": "380ec978-21ff-47b6-8772-f402a9f7fcbd", "comment": "Malware payload", "value": "c4bf0fb4050b86f39a7ac3f090ff5247a49be5c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912753, "uuid": "3cda2ff6-b34a-4bcc-a593-193614cf0521", "comment": "Malware payload", "value": "f032f8bc6ea794c76644f73b9c00676b371e3bdb993d8f875253df5ff174dd3c83c60b97d51e2f38e052fec0bd222b8e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912753, "uuid": "c597a060-f87a-4172-be7a-3c6b82c90db6", "value": "6D33F1D233E3D13AC0C115F2F5275DDA6A978E84E530D4D06D9EDA4023E31AAADA264F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912753, "uuid": "6e3a4959-2815-4db6-9c50-70b5bdff3641", "value": "1536:dEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMZ:inBrX5Eg5Enjq3axWIfkNw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912753, "uuid": "9eb7a6cd-adae-4c8d-959a-e91d4609e066", "value": 51762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912753, "uuid": "1e0b3c95-5356-4897-865b-448c3c1b8e19", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912753, "uuid": "04226f98-cd2f-40d2-8621-6eed56961d06", "value": "diagram-1870072610.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a964c4f-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911730, "uuid": "1bbca523-5582-47f9-8386-87fcb45ffd6b", "comment": "Malware payload", "value": "210640a70ae481ffddd8a0517110b9d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911730, "uuid": "4d2c7e86-c9e8-4f7d-9472-bf4e676b41c6", "comment": "Malware payload", "value": "15c6264f65026aba66e5f7fe9bb2164f61f9c1df555729b6a30542ec1f04a2a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911730, "uuid": "68c45da3-1b29-4fe3-8165-809fc89fd08f", "comment": "Malware payload", "value": "93fdc47c69213c799ce9719e1688488d43995ffd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911730, "uuid": "05250c91-4f44-4dc1-95f6-f9288eba21c7", "comment": "Malware payload", "value": "ff4fee8438c44dd364a56b01793339a13ee81c4714357b97a12afba57ef6b325dcbbc1012e2cf3457b2bb9957c5d626b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911730, "uuid": "49145f88-356c-445a-b121-4675f8a57db4", "value": "7533F1D233E7D23AC0C505F1E4271EDA66A78E99F420D4D01ECAEA4013D31A9EDA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911730, "uuid": "97fb5ea8-9cd3-4667-931c-7dcaad5379fc", "value": "1536:tEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwbciM93:SnBrX5Eg5Enjq3axWIfkNwq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911730, "uuid": "6cd763f4-b955-4add-b987-d4d6f1beffab", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911730, "uuid": "c2993b12-ca49-43a9-a245-671a7bb4c14c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911730, "uuid": "f442d69a-3f3d-4a13-9e29-0c6a4556ee85", "value": "diagram-1031591054.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69064fba-b43f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620947000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947000, "uuid": "08164b6c-8bc2-4ea9-87f2-f031664ca5db", "comment": "Malware payload", "value": "08064f90a5724488f432bc699cab1caf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947000, "uuid": "c64cc658-8ecf-4e1f-aaa9-dbe42f216425", "comment": "Malware payload", "value": "15c74cc0fe88887f3d1075c18ce80217aebf50f553cd6550afcc8b5e56dee779", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947000, "uuid": "15d73fbc-de4b-450c-a796-7debf2e705f9", "comment": "Malware payload", "value": "1795cbcb0fb8c4b1dbbec55cc0b5d19e4d087697", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620947000, "uuid": "66c63824-911d-4fe5-acfa-c2670af4d6b6", "comment": "Malware payload", "value": "b2a90346d768cf09e41e659ed05eb7dbc54bdd425bb6cda48999013f9a5e5b5d8a9249cd88916b139fdc48d48496bf83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947000, "uuid": "bd121ccf-f4f9-464f-85e4-d1759573fe1c", "value": "24F3E00AED9FEA88E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947000, "uuid": "70ff59e6-580a-40b6-b8d7-22c6bbd16424", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947000, "uuid": "40399b61-4ab2-46c2-afbf-0821394e929e", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620947000, "uuid": "d7bd6a9c-1bca-41d1-a8cf-fd177452f0e5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620947000, "uuid": "42cb59b3-2181-447b-a31c-fdd93537ae7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620947000, "uuid": "6be546dd-fec4-492e-a5be-bc7cb13bdcdf", "value": "08064f90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d83a788-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915520, "uuid": "df07f0a7-b79c-4ed3-b654-d0eebdf17a2c", "comment": "Malware payload", "value": "5d79768c5a6ded937d92c5ab98700ad0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915520, "uuid": "adb4d3a4-2995-4bbc-b8ea-5d62365ffdae", "comment": "Malware payload", "value": "15c963b72efc06a790b69383da70e60d2b5550bf5a34a077882ba237cf3d9f55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915520, "uuid": "1d8b8739-3d89-4c60-8466-4e69cf2c442b", "comment": "Malware payload", "value": "8760e24582bd0db6695d1146e4a0b0c21eb7dc76", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915520, "uuid": "0aa847d9-dfff-4dc8-ae0e-1e88ff28116a", "comment": "Malware payload", "value": "418fe76e8bcd481823ea9732e739038f22bca893ce19a9d9c03d229da10dfe5a5357865d5f32b63526b40c2989452d4c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915520, "uuid": "ddfaa687-f5fb-49da-b83f-6556f57dabb7", "value": "CD3302C6A523F4D287AACFA3089633D0A3AFC48C32143C995C7E249280A7154D4F37CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915520, "uuid": "8792b67d-7d3f-4dc6-9de2-40eae9fb1bd8", "value": "768:4o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SZEaQEP5:MeKCVQbp4LTaI7ZaiNQMIXWUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915520, "uuid": "7d9156e1-52b7-4d73-8675-d01f1e970fc4", "value": 51775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915520, "uuid": "d214599f-cc3d-4c7c-88ec-35d86316e774", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915520, "uuid": "ae1660b4-353e-44ae-9e35-c19c053f9eb4", "value": "statistic-1850459431.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c508366e-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916230, "uuid": "848d4c61-7795-4406-97f0-1b8bfec8f275", "comment": "Malware payload", "value": "aff161b426a60440bb4fbced8e2086c0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916230, "uuid": "03fe9216-94bb-46ec-9fd5-6e3dc99d252e", "comment": "Malware payload", "value": "15c9b39b9915f60385629b211390d257962a594a56a445380a0cdf3bbe8aaf9c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916230, "uuid": "2c1807a4-5624-4dfc-a1a8-e60f3a450740", "comment": "Malware payload", "value": "f0591e77007db080a61c002cbd857b9d51ba2b80", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916230, "uuid": "3c690dfc-29b0-41e5-a3c5-f43c8ab724dd", "comment": "Malware payload", "value": "d4b31610a093941ed6b31ea9bc5dbd044987734ad5931245cab7aca6b261f85873eb5aadcb3f79f97504bf6b2a45a03f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916230, "uuid": "37e73cba-5e90-4f57-8e95-a8051f36a05b", "value": "033302D96A13F6D2CAE9EE17009633E4A3AFD89C31247C694D3F648240A7558D4D3BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916230, "uuid": "f7210447-0866-4018-a0d4-f84c6394bcba", "value": "768:co4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S9O:QeKCVQbp4LTaI7ZaiNQMIXtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916230, "uuid": "8f63a558-3830-48ae-9ca2-a251715f6cd1", "value": 51768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916230, "uuid": "a8d9ab4b-44ff-41bd-97ca-c9b523146752", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916230, "uuid": "c1ce17e4-8c40-4b9d-aecd-f650bca07c41", "value": "statistic-478325304.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576948fd-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874385, "uuid": "122741fc-08f1-49cb-a997-2c786bc87b3f", "comment": "Malware payload", "value": "b7e70c72c0f74c4f0f9f8aee357a28d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874385, "uuid": "7b7856a9-1e4a-464b-bd62-6488938b5e0a", "comment": "Malware payload", "value": "15c9f83d04102c7afacd1c7867814d357c29e0736fa3eb87bbeaa67b5738eacb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874385, "uuid": "94a62a3e-792a-4f48-965f-f08a38c31f2a", "comment": "Malware payload", "value": "f2ac85b106bbcb0a79c0744012d43dd670d11144", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874385, "uuid": "bf17882b-1c0f-4e80-bae6-aefe9c22ce8e", "comment": "Malware payload", "value": "b7b4f73188652981cbe2cb07927d4d59d01868cb1b0b2a1eacc9748035a710cfef5868de6abe7c3461afde28a769aabb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874385, "uuid": "4072993e-797f-4203-9f13-467053780e36", "value": "A33302E3D312B2BCB643C04989CC1A979377427026658EE2C56DFED1A23D7160B61BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874385, "uuid": "b35096ca-08a0-4691-9d63-3e1ad475c942", "value": "1536:P/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8LjD5:HXKAXh3TCdOi+KSZ4WBRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874385, "uuid": "54114a0b-9d27-4390-8afa-bfddd318f3cf", "value": 51601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874385, "uuid": "f6089585-1256-4192-bb24-ce2fbefecea0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874385, "uuid": "629e260d-91b8-4692-85ad-257d0fa882dd", "value": "statistic-83421869.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34094548-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914269, "uuid": "cce31719-4a13-4928-8358-d2b36b93ae4c", "comment": "Malware payload", "value": "abc9e38e2d01f7948d393597092e4e9a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914269, "uuid": "c991d8b7-766f-4e97-bb9e-fbba46d206d3", "comment": "Malware payload", "value": "15e1806861ef828c88679492785933f5ffb14a62f8a7b3351d9db2308ca680a9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914269, "uuid": "01d701e7-961e-48a0-978f-9b51fb37cb09", "comment": "Malware payload", "value": "f637f11f6541f23ead7af8365ddead7bbbc2a6e9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914269, "uuid": "a39948a0-c80d-4ee0-95f2-a5e37f74e823", "comment": "Malware payload", "value": "ce003dbefee6048fe67811b207908e657850ce70cb8b115986046d7962eded263018d27059af75ed3dc64c15786203c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914269, "uuid": "c3bf795e-95a7-4e04-a6c1-bb2a0263232d", "value": "B63302D232D7D27AC4C105F5F42B59E65A778EC9E83094E02E8FDD0122D31AA9DA274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914269, "uuid": "6c47ce28-4be3-4fc1-91f2-d9a97f605964", "value": "1536:NEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnQN:ynBrX5Eg5Enjq3axWIfkNw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914269, "uuid": "2ea374f4-7403-4136-a139-a148bd6f2331", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914269, "uuid": "2f917eb7-fcc2-46f7-bbea-1046cf24f862", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914269, "uuid": "ed85d81f-df31-486f-b969-9f0983268ed0", "value": "diagram-914616726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a62dc7b-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872350, "uuid": "4bf48f02-09ad-4b43-b621-12fbe63bf75f", "comment": "Malware payload", "value": "f925d8a0c5dd34269bde85c63b7817ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872350, "uuid": "c4e8fc6f-4e67-4f99-8c45-747899eb8427", "comment": "Malware payload", "value": "15eb9c655c6df0236565cd912f77eac5e77a8b1fdb9145d6f3248330177cd16d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872350, "uuid": "93c75ab2-3d8b-4bbf-99ce-48b2b13df7a4", "comment": "Malware payload", "value": "f45e95ea96674299d84cd046b4845550166776c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872350, "uuid": "6c48fb96-82d1-40e1-acdd-932e16b4ec94", "comment": "Malware payload", "value": "0d496821d36561ec6fac78a4c6e5248888ab538b8b9e5f9e7dcb4fb5f766026868bdf17595e597f86564af50ef2e6c7a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872350, "uuid": "c92443f9-5813-4cc4-a9ea-fd6f4c8ed48d", "value": "443302F2E692B6BCF542C1854ACC5A1B523F82706A2D4DA2819CEDD3923C71E0B5169B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872350, "uuid": "23226118-b9c2-4763-806e-7d375b5bf85b", "value": "1536:kK/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Weif:LXKAXh3TCdOi+KSZ4Wzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872350, "uuid": "6b337899-8ec4-4446-adf6-86d0d23c088c", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872350, "uuid": "eb7f06fb-d2cd-41c6-9815-3e87ad70b940", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872350, "uuid": "684d649f-8dcf-4174-a4b4-44b1674a59fc", "value": "statistic-1394237410.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ecceef-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916926, "uuid": "04528aaa-c967-428c-8b8e-aad3b6c305f6", "comment": "Malware payload", "value": "dd6940a1a0fbf20641134ecedf287343", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916926, "uuid": "2bfc75ec-14ba-49ba-83c5-e472b91641f1", "comment": "Malware payload", "value": "15f3374484e8fcebfb9a4feefd8965f2dbefd8e9e384e42cbd2dae959390396f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916926, "uuid": "79267454-8b68-492b-9fca-b737f1a6c770", "comment": "Malware payload", "value": "d9810feb4f812f3ad16f9dca57b98fdd6b7ac347", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916926, "uuid": "90e37727-921a-471a-94e5-2ab4ce488d5f", "comment": "Malware payload", "value": "558c7054064dc8a679ad2faf965f0bc773e1b7c7d1afbe1afe966cb965ec35ce1d4c938f8adfc558ed92a29c8679f8c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916926, "uuid": "e222349d-8cd3-4a6e-8e33-eefc60673822", "value": "DC33F1C65B23F5C6C7E9DA67049673D4635F88DC30643C5C6C2A658380BB198D4E7ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916926, "uuid": "05309c7c-989b-409c-b8e7-220e675c6c28", "value": "768:Qo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK8NWK:0eKCVQbp4LTaI7ZaiNQMIXd1NRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916926, "uuid": "a0eee49b-f2e9-4a76-81e3-a7693c23ead9", "value": 51769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916926, "uuid": "61e0272c-748d-4d0e-a1b8-77d8e8baf741", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916926, "uuid": "0af567da-6e1a-40c3-b8ed-161e881bcd51", "value": "statistic-883413723.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194d86cc-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873422, "uuid": "28ac5a7e-b9bc-45b2-b1a2-71a80fe80648", "comment": "Malware payload", "value": "208ce257a7ef8e1748418cd46ada9d1d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873422, "uuid": "2c841f26-0b89-4b9e-920a-6d9a58420c0c", "comment": "Malware payload", "value": "1602b8004fcc4beed7375bb77d9f49392ed80e92652e73ebfdc9cb9d519adbfe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873422, "uuid": "5524a51a-a939-41cc-be85-d588d3d6d41e", "comment": "Malware payload", "value": "25bf103d1dd57746731d4f5ee2d51c7e695a0b03", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873422, "uuid": "6e8a568e-e926-4afb-b9d4-d446e43424e6", "comment": "Malware payload", "value": "2ddd0ba5544b838b0bc1eff7bfdfeb66238a6e19f3938fc87e639aa5f332ed1933666ff9c642242accd66e0f24737461", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873422, "uuid": "c2d2fc6f-2e4e-4aa9-bb5e-150a6e955a74", "value": "433302A2C352B2BCB643C04589CC1E9B9377427026658EE2C56DFED1A33D7160B61B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873422, "uuid": "14e1d5cf-5706-4529-bcfb-61538178c62b", "value": "1536:pd/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8L8bp:/XKAXh3TCdOi+KSZ4WBRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873422, "uuid": "c69ed8c7-df22-48db-b8c5-7918368fbee7", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873422, "uuid": "6fe936ef-f475-4819-8bc0-98c49d6ef69c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873422, "uuid": "b1b5af41-bd32-4d07-a44e-9bcd6d79fd70", "value": "statistic-2021182319.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20f398a-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911904, "uuid": "7a57de62-c54f-455b-9bf4-1ea9d891ed77", "comment": "Malware payload", "value": "89f56558d7caf771b5b11ca263bd6213", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911904, "uuid": "f6b6e02b-2455-4762-b21f-e139b9cb9c57", "comment": "Malware payload", "value": "1618ed336af2b90b794e9d6b4ba54273f851f6a7b840b6b4cb7baf79dc4c87b2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911904, "uuid": "a8e2b5b0-0df7-4d4c-be35-2792a6a6f170", "comment": "Malware payload", "value": "f6e8ed4f5abb46235547426fa956810d0c9cadad", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911904, "uuid": "aa3bfa2d-e8ef-474b-aa11-aabfaecd0c07", "comment": "Malware payload", "value": "e64c558435658ebe55332f7302444b0f5c111c9d5a29efdad9b72b75365db3b846b99fe2ba288ba19a1393486d053c15", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911904, "uuid": "d5d5e004-3d14-4834-8142-dd1f2fa4aaa4", "value": "4A33F1A232D7C23BC0C506F1F42B5ACA66B79EC9E930E0D11D8FDD1112D3165ADA264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911904, "uuid": "d752ca22-698c-47ca-a88f-295a6c660c97", "value": "1536:fEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwu2eHj:snBrX5Eg5Enjq3axWIfkNwu2eHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911904, "uuid": "7eb95adf-7d67-469b-aee4-1cbcc5837759", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911904, "uuid": "9de56774-67b0-4705-a55b-c4f8a6a0b281", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911904, "uuid": "428d5686-f43b-455f-abab-95deac09e109", "value": "diagram-1165350147.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb705a7d-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911597, "uuid": "bb51ddcb-1a0d-4b94-bbbb-cf39a991408f", "comment": "Malware payload", "value": "f0470ba6463dbf6c3eb3e2396edabec9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911597, "uuid": "36ad65fa-7a48-4db8-8df0-637ca5e04a6b", "comment": "Malware payload", "value": "162b78989c28b7f4174b2942ac249c7d1888e12002f35f78e32ed12d9efcda75", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911597, "uuid": "13577fee-093e-4a59-aeaf-d0d348b93c3f", "comment": "Malware payload", "value": "f6ee87731dc02ba12cf77a01b95b2c9696fa0e53", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911597, "uuid": "e0991443-77c4-4bca-bc64-9e0cb9e05b4a", "comment": "Malware payload", "value": "859585dd5129919874845f572ec6b71b76a257e27ac9bbcdde91fca39361b5239f0abe13e0435351cf86a758e14c2749", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911597, "uuid": "ef76e73a-0d42-40b9-a413-6fdcf86d35f7", "value": "413301EFA014BEB7C1DF93005FA65B6116FE7A18D070A254836AC6F5E9836C3803A4D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911597, "uuid": "0964acfd-9e46-4362-9ab4-74bbb4e6e1ef", "value": "768:Lqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LdC4OA:OxTuDqsF1Cnc3P57oj2+nC6uxkLdC3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911597, "uuid": "2b005c90-db73-4671-931e-9b791aa52cb3", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911597, "uuid": "a41653dd-09b9-4c8d-89f9-74c9b9fe63a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911597, "uuid": "60af7f8e-a7dc-42dc-a7aa-90cb79460ef8", "value": "catalog-947081130.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c6edb4-b3e1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620906571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906571, "uuid": "a84c4bbd-ca23-49d1-9184-186cee29c201", "comment": "Malware payload", "value": "df2c61edaf62a9b850837634547e7850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906571, "uuid": "c4ac345c-8229-42a7-a654-d87b00b80531", "comment": "Malware payload", "value": "162e258bdbde8ab7439c2a83ca24b33afe03128fea12fd53cde4af37049fdaae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906571, "uuid": "6ae2ce28-cfb0-4130-8ebc-750132df2e4a", "comment": "Malware payload", "value": "9f7e09d2ad40a35ffbec7af72c14ce7dba5f9ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620906571, "uuid": "7ef2f99e-7084-4027-b5cd-a827bf9d0a89", "comment": "Malware payload", "value": "805e2bd0f5732cbfaba6e6e73fd0eeab0ae1778c2bdf052a8374e9e70ca1047f71addaa6304a616eb3d546842da8504d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906571, "uuid": "c7ba6f14-bce9-40c2-a590-3cd9d1b39982", "value": "D8F1B521ABD84236DDF79B385C7253802275F3C65DA3CF1E68C5111E6D323899B72B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906571, "uuid": "9f26ab87-ff83-4fb5-9803-3717396acfbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906571, "uuid": "0c3f1d2a-5f8f-4127-9633-24b6a2af5180", "value": "192:SV9SDI8OpcPA0xa53ozXA9w8oqgA9ugWmMRcd/tgw:SWI8bo0xk3oA9w8p9ugdMRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620906571, "uuid": "95599a7e-f34f-4b0d-9228-37b89ebb7446", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620906571, "uuid": "6691d279-c4f4-4e56-bb83-0961ea004fc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620906571, "uuid": "2ae7d24a-41c1-48ef-96a8-971a3a95011f", "value": "New order _WJO-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83281192-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870593, "uuid": "84785ac1-afce-4bb7-b3f2-aa0db2de7f60", "comment": "Malware payload", "value": "99674b7ed0f3635066a6c6a4e32a27da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870593, "uuid": "e661cdc6-5b52-4479-b562-832bdf914a5d", "comment": "Malware payload", "value": "16342e7b97f6e017d9caee279ea3c14eda1e1ce827bbe0893e6ba87fe26801bb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870593, "uuid": "c2345a06-205e-42e0-b75d-dc0d54b11f40", "comment": "Malware payload", "value": "720024abb8b3e770b36337b09cc0c3d1750fa295", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870593, "uuid": "c8e43ec9-4ffc-486e-a733-2b448d72e788", "comment": "Malware payload", "value": "73a7e868e5ec198996b0a56c240a68ec84a0f999c0fae4e620a039ead7faaaca3176074be851c430a74757ce15a15f75", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870593, "uuid": "f6b44a33-3e0e-49f9-bc41-955ac459c0a3", "value": "B633029673FAA910C9F1C2B0A4E275C8374F3D918EBD5DEE4C8894753B920A4CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870593, "uuid": "6214aa20-244b-410c-85b7-06a41c37d3aa", "value": "768:T5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJo5:T/czJJSI7r3Pwh8r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870593, "uuid": "b2744946-ba6f-494e-9817-1b60c3074333", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870593, "uuid": "d761f60d-ebd8-45f7-9a1e-f25ce20a5810", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870593, "uuid": "c4a621e4-fd6d-406d-929f-a26c26cd3ba9", "value": "diagram-2012266264.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bad1b9-b3e6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620908980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908980, "uuid": "383cceb5-d762-44a1-af77-d6e697cc87b1", "comment": "Malware payload", "value": "d6b769730aa107fd92581da422029c02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908980, "uuid": "0babbb7c-59cd-4be1-8d7d-e36e23710954", "comment": "Malware payload", "value": "164a9b88620cc09a7da0a7ec912011d2bab70a2a9cde88c39a545832ad3035bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908980, "uuid": "2bb34a61-d824-40ef-a2dc-3fe7082990c5", "comment": "Malware payload", "value": "a370bebacd2525b2e321ed7af1984512a722ab39", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908980, "uuid": "42439c4e-5dd4-4a3a-b60e-f8f0dbd156d5", "comment": "Malware payload", "value": "2992c9fdd6897109ff33023680de8f403f352cc0a7bff9f69cfdc8a021d72a007807f95402ef95f70b920654f65ff88e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908980, "uuid": "35074c00-c391-4337-b270-32e2fbec22d3", "value": "7533029F9404FBA7C2AF93016FB5976205FD765DE130C028935AC2F1EA836C2817E9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908980, "uuid": "c1ddfc92-169b-464e-bcaf-1266e8470e5f", "value": "768:nqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYM/Q:qxTuDqsF1Cnc3P57oj2+nC6uxkLulQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620908980, "uuid": "7001563a-372f-4282-acb2-ab5d1c169e33", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620908980, "uuid": "afba59d4-2e07-43ba-8346-d57e75b0fb0f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908980, "uuid": "53d8cf1b-c7de-4359-8634-08f21460f933", "value": "catalog-1033705740.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225c371e-b389-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868713, "uuid": "515b3f16-e1d6-4eff-8fd9-a973fb998cc4", "comment": "Malware payload", "value": "9e23a8d6dff14fd6d1dced0da2cc8e2d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868713, "uuid": "e8472a15-1815-49e8-9688-6fec57c89510", "comment": "Malware payload", "value": "164d84d1f3157d4445f0cc12e8e1318ac0076b5f44e220f6410740a3f2034493", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868713, "uuid": "9ace7de5-5fc0-4d57-b186-73c28aabb905", "comment": "Malware payload", "value": "963bcf0075f77493be3e86571259e1389bcc6e09", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868713, "uuid": "8c73c23d-c671-497a-9a7b-63ab467475ed", "comment": "Malware payload", "value": "d36fcd407e23c45dc5d026f32711635724bd5045830f115b5d691ccb369ba2cb876eca0fb116d9ffe93980ef4b2ff7c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868713, "uuid": "b44496df-f8cd-454f-a3b3-93b06cc50f78", "value": "3833E1C4EF5BF858CA837377BC482FD66EAB125464CED09597C6309D0296E33621427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868713, "uuid": "62b4f9ac-f92e-4534-bd74-6f6df54a6853", "value": "1536:AAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3tF:bpoAnd9gucKCQar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868713, "uuid": "eb47a306-4f09-4a0f-a197-f62734ee18ac", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868713, "uuid": "0cc22888-bf1f-4bf9-8494-83c21c495eca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868713, "uuid": "e1b49ebc-592f-4b8f-b4b8-c2259698634a", "value": "catalog-616365887.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84166213-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916121, "uuid": "4ac44283-a41e-4e24-9086-739378cd31ba", "comment": "Malware payload", "value": "2df07eac7d95cc642ea258b1790968e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916121, "uuid": "341e1456-2882-4162-a4ba-9bd6974d4aae", "comment": "Malware payload", "value": "1655bfa4a6c62594688a39a815f5f81d0fa0ceee00b8081cb1d96d0fe7d5bf78", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916121, "uuid": "7dbe32fc-df42-483a-8b05-4cc9fc8e26b2", "comment": "Malware payload", "value": "c86167242ed05505b04e90609ea2c6b79658ba36", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916121, "uuid": "b2a8b813-0f66-4ccb-b33e-207beeae7dfa", "comment": "Malware payload", "value": "ac7d933fa718366e1902c85fbc1b44db377ad7bbee06e2610b93430ba9c10195fdf7fac8349413300c6e33a12f10b7dd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916121, "uuid": "717eb54b-bad9-4855-b192-5fae694bafb7", "value": "1C3302D69B23E9C28AFADB670C5512E8536FD89C31143C59192A699380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916121, "uuid": "47cc306b-b55a-47f7-94b4-03d7477a4dc5", "value": "768:Xo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6Ffv:teKCVQbp4LTaI7ZaiNQMIXAFoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916121, "uuid": "0fd217dc-4e99-4b53-aa64-504f51fdda79", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916121, "uuid": "2e41d2cf-b5ad-463a-9466-ed3c6b901045", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916121, "uuid": "c63c3924-8b6d-4d95-9571-df9325d6b5e7", "value": "statistic-394014786.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85f85bb-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915887, "uuid": "5228777f-92ec-40da-a89e-5f472ac9b59e", "comment": "Malware payload", "value": "df91e1d4d532a2b11fc0fec2bd02d206", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915887, "uuid": "16c18096-9ade-48b0-8102-9d8483e0137f", "comment": "Malware payload", "value": "1659ee0ca261260a39c71a51f04ec0c3d0ecbb1b3c16cbd5b224ea5c879f7df0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915887, "uuid": "090a0d5b-6542-4680-97dc-b40deaa2e999", "comment": "Malware payload", "value": "6fde862e9dff810b547ed2cce0a71d2d9204a6d2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915887, "uuid": "dec22ab4-5268-4621-8865-29d46ad6c42e", "comment": "Malware payload", "value": "b16727468b7104bca5eb6f1809fbe81b975e5db0e8890eefb9b18f5f1cfcb0416b499a93669ee55304db10b22395bea0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915887, "uuid": "2c637fb8-26af-427b-bac6-307d9bae7fda", "value": "A03302D56A23E5C6CBB9DB97049623A8535FD89C31643C68093E29C340EB564C4EABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915887, "uuid": "f22d8ff3-7599-4aae-ad92-d68379b3548f", "value": "768:lo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SSRoIyl0:/eKCVQbp4LTaI7ZaiNQMIXCRzyl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915887, "uuid": "96d10455-110b-42d3-b14a-dd74bbf0956d", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915887, "uuid": "3139d834-63b2-491a-b5de-e08775af7042", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915887, "uuid": "61ae9087-c9d6-4f7e-a325-24189f63c69b", "value": "statistic-2132389158.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b031d83-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867573, "uuid": "cca309ff-c156-45ae-9ed7-f75feb51d7e9", "comment": "Malware payload", "value": "907fab62fc6ab2ed044d59e82d6fd15f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867573, "uuid": "b81d0e57-851d-4113-97d1-d4cf695aa0f8", "comment": "Malware payload", "value": "1660b94a3e1112e1beb22dcd507d7ec94b2b5da19e8ae861995560b48c0bd4a5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867573, "uuid": "1b3161eb-4c1b-4194-a2c3-1ef5a9f06e3b", "comment": "Malware payload", "value": "f3efe0e946b6360f6de6c84b4aba8d877ff00215", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867573, "uuid": "db5c0f85-586d-4dc1-b8c8-b577d71507cd", "comment": "Malware payload", "value": "c7bc5c40184b91fbfa4be39b4c73b61ecac2c44e75d5b9168063f7817e45dda0e45fb62d98ce759ec96cb4aa5d0dc2e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867573, "uuid": "9d705c3e-01a1-4f82-be2e-7b59068264bb", "value": "0033E1C4EF97E428C7C273AABC842FA77FBB0264148DE1951BC2319C5196E67161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867573, "uuid": "04bcabae-93b5-4670-9f92-4909309cc180", "value": "1536:CAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVqI:xpoAnd9gucKCoGV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867573, "uuid": "bfd46bb4-aaf5-4109-bbb4-261e6cbc1ebb", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867573, "uuid": "864385de-9338-40da-a60d-ceb6376ebbe6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867573, "uuid": "5df048cf-ab20-4eb4-9c61-784b99960c32", "value": "catalog-1708525487.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47d15e4-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916713, "uuid": "3c8f74c7-5e75-4552-b320-36a93e4d009f", "comment": "Malware payload", "value": "4c433fcd52fed4b9e5271187d45a2d31", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916713, "uuid": "ce348e06-5571-4599-ae4d-8c642c492308", "comment": "Malware payload", "value": "166972b99c5a36ff5bdf2cb85764ca17fae28698c267fffac6d5268063a812dd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916713, "uuid": "d7f4d110-ce1e-4cf9-a3fd-803dad9fdb5b", "comment": "Malware payload", "value": "b543a5847cb7498383e3f2785bb7d5af65913947", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916713, "uuid": "c28fdcb8-f0fd-48df-9b51-818276d2c79c", "comment": "Malware payload", "value": "793e0e62fe6045b01dbc47c5c1b69c65981281ef7248a31c8400870a0d25c1c0c98e2a4aa317c5f96f6597405145fdc1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916713, "uuid": "f79352eb-1f23-48dc-860f-9b37787988b3", "value": "A233F2C26A12F5C78AFADE63044522E9635F98CD31283C695D3F758241F7158C4E67CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916713, "uuid": "f2e9b2e7-eb55-43de-87a6-13129cba54ff", "value": "768:Fo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkoQ:feKCVQbp4LTaI7ZaiNQMIXUoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916713, "uuid": "cc64d5bd-f2e7-4b26-97fb-dad681c90d51", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916713, "uuid": "38e2ca18-0f99-4317-954a-bda674b534a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916713, "uuid": "217999e5-50df-4037-a721-ff2e80df28eb", "value": "statistic-741422946.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad719ec-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873425, "uuid": "36542122-0f64-4841-9aa3-7450efc217fc", "comment": "Malware payload", "value": "a5928f1e048dc9fdbba2be07a4e1a86b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873425, "uuid": "e2574674-9fa1-4853-b1cb-7e02262793b3", "comment": "Malware payload", "value": "16865593fc7644897cde409627710d78c2cf4f87e419672487010037d95db90c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873425, "uuid": "9dede6b9-0079-455a-8d90-8184c172f4c5", "comment": "Malware payload", "value": "47a53dfae792831e3b8251c8c06456bdda45f496", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873425, "uuid": "6bb6732d-c9ef-4666-804d-418220fc9685", "comment": "Malware payload", "value": "aa51e43891471b11def0d0fd48654269c3034550eab0b20cba59c9cb7452b3861831947e029cbed69dd9bc257c50652b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873425, "uuid": "4af05c63-44ee-4c8b-bef2-0e792e03eca9", "value": "BE3302A2D312A2BCB643C04989CC1E979377427026658EE2C56DFED1A23D7260B61B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873425, "uuid": "55ceb634-d079-43f0-be78-0f3764fca31a", "value": "1536:ku/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8LG8g:DXKAXh3TCdOi+KSZ4WBRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873425, "uuid": "29bb6bae-6a6c-45ed-a927-7901629a0607", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873425, "uuid": "e03d9b9e-b04e-4a4e-b885-5fdcbbc3658c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873425, "uuid": "ff18efc7-b35f-407c-97f3-804d5fc1c253", "value": "statistic-2022299716.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880e1ad9-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874467, "uuid": "9c71d017-86fb-45a9-a925-1cfc14fe54e3", "comment": "Malware payload", "value": "424a4e83e6e1b76efd4b95bf8459f6db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874467, "uuid": "13f063f1-c0db-4ab2-99d9-3cb41e3b9f73", "comment": "Malware payload", "value": "168bc805245caf069ac6f261789315ccc1011528908347393e4c23e546c7b6e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874467, "uuid": "ec6166e7-3f50-45eb-843e-19cfa0f16e2d", "comment": "Malware payload", "value": "937ed747e2dd99c4ed7f68305e4f7735c081afaf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874467, "uuid": "8e2a5a54-1cb3-46c0-88ba-aa6f63b8986b", "comment": "Malware payload", "value": "ac3791efe2d4b1c9f9fee686fd8864f04f553df8b43a914d9b237841b598b1d44a56a26369e7a03cd22be6a7cefb8b34", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874467, "uuid": "e77b777d-fcd4-4917-92b4-8260eed4444c", "value": "653312F3D702B6ACB64381494E8C5B47923B817067595EF18218EFA1D33D7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874467, "uuid": "df36324f-953a-4524-955c-0113b72e5530", "value": "1536:N/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeB9q:lXKAXh3TCdOi+KSZ4Wc9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874467, "uuid": "58e13278-2564-4153-b2ae-a37eaf6b5ad9", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874467, "uuid": "6cd427f4-e8a0-45fb-bdbe-441325c3b23d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874467, "uuid": "d18b2dc5-cac5-4c28-8d11-fc8c82d9de57", "value": "statistic-893928491.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d04fa8-b38b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869819, "uuid": "ebdac837-1e8c-4a40-9fc7-1979b8d7c899", "comment": "Malware payload", "value": "7e3cfa0cf5ca5c0ba24cc9d514e3b972", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869819, "uuid": "a0d1d142-0ad2-45eb-afc3-9c2a13f57cb9", "comment": "Malware payload", "value": "169e3d9de0c25eb17e5bdd945880e8bbec6b887a3e1cfc2a941799dfe295ef6f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869819, "uuid": "910067dd-0174-4384-8aa5-f937dcd0ec9e", "comment": "Malware payload", "value": "df0c37b9e32ea12a58c284cf2ed3ce26e6be8e74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869819, "uuid": "13de8a14-0add-4225-9969-e97419e537ba", "comment": "Malware payload", "value": "ac2c1bbcab7ce09e41d89d851ea4783ffc3958bde6eccb5bbe0bfd69d7adf757ba0591a5d4841a1f76d8e845828d062f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869819, "uuid": "581ce751-175b-4e54-ac04-29d797f720ba", "value": "8E33F19433EEE910E6B2C2A090E275852B4B3D918D7D9DEA0DD475B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869819, "uuid": "5037bb88-ea69-4320-8635-f08fbeb7b9ea", "value": "768:E5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccL5T:E/czJJSI7r3Pwh8aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869819, "uuid": "31c9b318-a9db-4dfd-8efa-251974a3e939", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869819, "uuid": "7fcb2c26-7cc0-4c72-8875-bd74993cdf40", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869819, "uuid": "20ef3a1a-81f4-4083-97a8-d9a399a4bc23", "value": "diagram-146056458.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a919677-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870042, "uuid": "7ea14de1-d331-4332-ba7d-0e304b9f6ba8", "comment": "Malware payload", "value": "e4fdf81c7b1acfc7fc2670793890cd7e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870042, "uuid": "444f50fb-c5d7-4bb3-8c12-48b689de37b4", "comment": "Malware payload", "value": "16a2d19c46fe75a70122b674b05da238fad4b3e5fbb8b6689553348f0cc8baf0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870042, "uuid": "c06ba52e-3e81-462d-8f7f-91a7c3de657e", "comment": "Malware payload", "value": "bfa5e44c861665203e2d6de07d65dd7a66cf2f91", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870042, "uuid": "d270f2ab-707f-424f-a4f9-6c5b8c4d068c", "comment": "Malware payload", "value": "faf09d946658133bb6029bda39c5f44cf77c3041d26809f26f45383d0e37a4f993ae10ded8a1b71ae02eb74dff80bb0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870042, "uuid": "1d55efc5-65e9-42f0-9aa0-e3d7ccc02de5", "value": "863302A473FEE510C6B1C2B0A4D2A5883A4F3D91897D6DEA0CD4656D3F831A4CFE62C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870042, "uuid": "858d9e35-8044-488f-836a-6f3754369752", "value": "768:v5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJ2IwhRTGx8CD3VIWg1:v/czJJSI7r3Pwh8tv8x8q2n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870042, "uuid": "c1d05e86-e0bb-4fdb-8b58-cbb3d5738fcf", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870042, "uuid": "97e7e2c4-3c49-4feb-a116-c2084aec44dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870042, "uuid": "cb940035-bf2e-46a8-af9e-7707f7fe4fa9", "value": "diagram-1601913354.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81aea8f-b3c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620893419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893419, "uuid": "f6f58432-ca45-4c5b-81ae-0d5f529ebd27", "comment": "Malware payload (Dridex)", "value": "711c429adc0866cc120c5c816d41fecd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893419, "uuid": "f8e6cec7-b235-496c-9b43-d726b4c7de6c", "comment": "Malware payload (Dridex)", "value": "16b6c149151c6d6549cda984209b71b23ec2a4a02cf519d13076baa128e34e39", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893419, "uuid": "1e1d9b5d-cd04-47f6-b19b-be8b59cdfb36", "comment": "Malware payload (Dridex)", "value": "02d4e592cbdf6a39ea300266bc0124715500fc8a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620893419, "uuid": "7b4d0f64-dc36-48d6-8a5f-508990c5022e", "comment": "Malware payload (Dridex)", "value": "318ccd2b75dc3872259ad1ca727d09a671276718b4c130c350f96fb19d58986a4b9c8a834382d5682d8405ed8fa04052", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893419, "uuid": "5a670073-a4e3-4881-bceb-050a24a600c6", "value": "5DF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893419, "uuid": "2c508725-7f94-4b83-bf92-bb50e7d5f0c0", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893419, "uuid": "a2b3993d-31b7-4c53-b737-65ca303605ff", "value": "3072:z9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:z9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620893419, "uuid": "010f7a24-1180-4eb0-9b4e-4666e4918c2d", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620893419, "uuid": "3282e8ae-1d7c-41af-9a0b-cb50fbd88f8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620893419, "uuid": "eaef4427-25b4-472e-8217-afe7958f36e5", "value": "711c429a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01831198-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871664, "uuid": "bb71f1e4-f673-471b-b762-c0b1b2855397", "comment": "Malware payload", "value": "45021982e97a3729c9e9badaf52617a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871664, "uuid": "2453f18f-5d2d-415b-9b79-12c408b9fb14", "comment": "Malware payload", "value": "16cc85c4b345b7676709ed6a47d372d9610439b8b1e077f44bc6a8076626d4d9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871664, "uuid": "9eb934d8-de3b-4f57-9283-9bde94b8c419", "comment": "Malware payload", "value": "095215f3ca97b8f927dc61c71727d7788cd70812", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871664, "uuid": "32d97a71-82ff-439e-ba86-ebdf732c2311", "comment": "Malware payload", "value": "94fcf3f618b193cf3e3bab9c23adbb6fca489e56dc0fd1207c3460cd3723cd21cb43ad25bf1ce1b6d62569a5406ed198", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871664, "uuid": "905c7e38-9824-4b42-823e-328f539ca024", "value": "1033029673FAA910C5F1C2F0A4E27588374F3D928E7D5DEE4C88A0793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871664, "uuid": "1d9b5103-6abf-40f7-8743-35432d78ba84", "value": "768:l5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcz:l/czJJSI7r3Pwh8fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871664, "uuid": "f0dfb3b1-8bca-4158-a6db-9b0e3947638f", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871664, "uuid": "e86986c7-df23-4c30-ae83-abaf3c409a44", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871664, "uuid": "93b9b13e-baea-48fa-8aa1-891520b39c2d", "value": "diagram-872877772.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df90d47b-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915845, "uuid": "5fa373c7-54d8-4259-8628-1db4dba76fa8", "comment": "Malware payload", "value": "338b3050063214bf17a69b2204621d44", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915845, "uuid": "8ed683f9-4386-4641-86e4-502d983335dc", "comment": "Malware payload", "value": "16d5382b21f63d802422c506a53f371d50b0be1b23f903f53de8c5a945ba73e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915845, "uuid": "0568b476-20cc-46ca-b60b-8922b64df9dc", "comment": "Malware payload", "value": "c81f6f172f2372650eda91e2d980fc491f0d4d1e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915845, "uuid": "92d5ad37-4ce4-426f-ac7b-fd12acefddb1", "comment": "Malware payload", "value": "dce46f7799bd165844d391519ba6684927cd59227f8e40c4eb12e5e570b252a3e93aabae74b4ef17fbd493e9238ffe2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915845, "uuid": "58edfd11-981f-491b-ae24-1d0319df3090", "value": "3C33F2E65B23F5C2CAFEDE63044523A5939BD4DD71283C5C552E258240FB558C4E3BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915845, "uuid": "8eb5ed2a-013c-4c19-8778-b6c8a6cc2b38", "value": "768:/o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S/cs:FeKCVQbp4LTaI7ZaiNQMIXvcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915845, "uuid": "0a1a6a5c-6228-4b29-be0c-a7cb0aaa09f8", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915845, "uuid": "03b2a433-f049-4880-b852-23b404297f3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915845, "uuid": "cbf85731-2f73-4c92-9e8a-24e69350923a", "value": "statistic-210445792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03021a6e-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870808, "uuid": "150cd383-2a87-4503-946d-4faf0c548e4f", "comment": "Malware payload", "value": "9e5d82d73b91f79eb80182aeacbf0a28", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870808, "uuid": "c882f7e1-b28f-47d6-b4ab-8e284b61ffe8", "comment": "Malware payload", "value": "16dcd35b826c762a3aab5ee3a04c72a992a5d4792448967d2a35bcd030b05d71", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870808, "uuid": "d95063fd-db91-470f-9c83-e51f289b4607", "comment": "Malware payload", "value": "d37b5f2caa3f733eb76bc574271678ca8914824e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870808, "uuid": "e85ffea8-15a1-4f03-855c-2d7cdd80dad4", "comment": "Malware payload", "value": "912e301d5e82c856f1d9c8f609f61e68a9c93c7e9a2e271eed8a9ac8bf28c7b8534ef08e8362b4119257fe72c3c21ed2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870808, "uuid": "dd768770-4f6e-4eba-8e2f-48464d6d69d4", "value": "6833F19433FEE910D5B2C1A090D275893B4A3D918D7D9DEA0CD465B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870808, "uuid": "8d4843e3-6c6c-423a-9fe8-d51cd99b4058", "value": "768:i5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccE5i:i/czJJSI7r3Pwh8Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870808, "uuid": "50c91119-9b55-443f-81fb-22bdc2bdbb51", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870808, "uuid": "ac830eb3-9145-477f-bb75-f1b677048e26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870808, "uuid": "0ce74a91-6ea3-4cd7-b06e-1e98b058c43d", "value": "diagram-2145856894.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dae198b-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896756, "uuid": "8d687de3-d39d-466c-aea8-8db56c389c49", "comment": "Malware payload (Dridex)", "value": "16600624b91d17bffe86daa9c05fb8a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896756, "uuid": "87761be9-26b0-4992-8a64-e053149ce7ca", "comment": "Malware payload (Dridex)", "value": "16dd368d548be61fc742fb7c26c8fe3b029309dc7860c9903c6b9c8559a9373f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896756, "uuid": "cca4703b-ffe1-4248-b169-d437d4917633", "comment": "Malware payload (Dridex)", "value": "50d0e2a6d49be9d97b361d622ecafe4fb0c2d4bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896756, "uuid": "ed49e143-764b-4aa1-a242-87b3298d8785", "comment": "Malware payload (Dridex)", "value": "8cf0da702f0507b26c9bddee7466d7e0579f1aca7c7064ea287234bff9aae8fce9781c5234dbb5b206fc46677f5e07a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896756, "uuid": "85215ba0-9f44-4254-b8e5-b20e192d7e08", "value": "DFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896756, "uuid": "97bd7845-3171-408e-9e32-c228eac89de2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896756, "uuid": "26c38df4-253c-45c9-83e4-5db1a1a0fee1", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896756, "uuid": "5c2f9116-20f8-4a77-b423-88c6f3ac8c62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896756, "uuid": "42c56fb2-a70e-4e4b-9d80-e3cee808aad9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896756, "uuid": "957b2cbf-f4fa-46dc-b596-47f7fd47ca76", "value": "16600624_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56537a0-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909762, "uuid": "33ce0024-7cb2-48e5-bb72-f67676856719", "comment": "Malware payload", "value": "68af21bcf548491e1056b9162f51ebc0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909762, "uuid": "73a6c25c-6593-4697-a659-d9369516edde", "comment": "Malware payload", "value": "1706b56dd13c8ab54b0ee4cc43dca93a7404055907f22581eea1d753611a9025", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909762, "uuid": "86d45572-2062-4539-aa37-9514e550facc", "comment": "Malware payload", "value": "9bb671dcf1e4d5d2bf3f8bc8d3711541d3b6bd13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909762, "uuid": "91c2e9e5-1cfe-47bc-82e5-edc8494f08a6", "comment": "Malware payload", "value": "3f4aa9440baae920ec374c40df8d39ff5ecbcd714e4627c8e2a6a9163ffb6c5c3f16c58de4b74aad491152233fba05cf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909762, "uuid": "2502f7bd-dc15-49a2-808c-23bd488c63e9", "value": "133302DFA014F9A3C19F56011FA6976116FC7A1DE2309158935AC7F2E9C35C2C12A8E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909762, "uuid": "008d5e19-62e7-4dae-85c1-7bdb6ffa12f1", "value": "768:fqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNyLo:SxTuDqsF1Cnc3P57oj2+nC6uxkLTNyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909762, "uuid": "3fdc0027-d801-4a66-b7ed-dfb8be1aa328", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909762, "uuid": "8b7ff387-5e5a-4651-a419-1646814d27da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909762, "uuid": "bab0a943-f19c-44e4-aaaa-11f765e5acd9", "value": "catalog-1479940801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c57e68-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912224, "uuid": "4d099f34-063c-40a5-8815-16bf96b5669b", "comment": "Malware payload", "value": "d1724110ef8d776db1fab7ef0bcf9ecf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912224, "uuid": "109437f9-910d-4d08-ac6e-8ec7c169f592", "comment": "Malware payload", "value": "1713eee69c9343f8266f36b881588748ae7c1a98b34f89406fd2fbf4720a4353", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912224, "uuid": "e2cd9a26-dda4-4c0d-8141-41ebadd90e7e", "comment": "Malware payload", "value": "2aab8e5895771b10f9310c9553736d10da1354fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912224, "uuid": "d00a1b84-c8a8-41f1-b7fc-c325c84cba21", "comment": "Malware payload", "value": "6247c246958ac47965df0236134e9053d9b7dd325da8830a422ceacec6e89e4d56350fd05bbe7f45ef97b3aa9dea6c29", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912224, "uuid": "444541b7-5a6c-4e6c-b9ff-ee0758742487", "value": "5033F1D132D7D13A80C505F5F91B59DAA6678ECCE530E0D02D9FDE0122E3165AE9260F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912224, "uuid": "f4427103-46e5-43ec-9983-06054f31d739", "value": "1536:oEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwwnyG:dnBrX5Eg5Enjq3axWIfkNwwyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912224, "uuid": "0a4179b7-2631-4bc8-852d-74484a8572d3", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912224, "uuid": "d5b66bac-6a3e-4fef-85af-e73a9a19b5b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912224, "uuid": "02967f98-056e-485f-a498-09e63b28644a", "value": "diagram-1465586138.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808e0c39-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872736, "uuid": "159bfc94-6c50-4b44-8d3f-e18a4c534d77", "comment": "Malware payload", "value": "529897f8943605d02199e527091e117e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872736, "uuid": "13bf7f2d-3386-463f-b02b-53b29a7e656e", "comment": "Malware payload", "value": "171c57a52ea935bea8b2407f733b7db59b23b34eadf1e1ed8aed4037c57f8167", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872736, "uuid": "ccc6fdd9-7319-4d94-92cd-030f4c386f7a", "comment": "Malware payload", "value": "46e8578c6dd6bcd7247770c739a59ce70088b2fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872736, "uuid": "5ea3b3af-7e73-431a-9797-953707bb68b6", "comment": "Malware payload", "value": "ab6acba9bad2c07da0fc85b3c7b9d1759b400b3818df32a9046fcf67ba8dd44ec4bc00af03816eabd59b038033172e9a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872736, "uuid": "b563dffb-4f1c-4813-afc7-b4c0332bafd8", "value": "043312F3D602B2ACB64381494E8C5F479237817066595EB18219EFA1D33D7170B51EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872736, "uuid": "6a0d0fee-d7d5-4687-959c-7555e1ece1e0", "value": "1536:JG/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeB13:MXKAXh3TCdOi+KSZ4Wc13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872736, "uuid": "e1bc1b1d-ae45-43f8-a7ac-1074f4780118", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872736, "uuid": "8ed2f719-e5ed-4cfa-a93c-44ad5d181e5c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872736, "uuid": "66d5af16-21cc-4b14-9bc5-d5ff82faf7c5", "value": "statistic-1665992550.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04d6bed-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872360, "uuid": "1b0ded2e-02b6-4836-9934-3a9efd9e3f08", "comment": "Malware payload", "value": "624453ea6d5dc8bc09fad795238f6f47", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872360, "uuid": "e5a2778e-1013-49fa-8e6a-3c9ad4ac28a3", "comment": "Malware payload", "value": "1726f6a2581e8e5088c65569c5e6b9924fbee92bf2a0cb20620272980d08efd4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872360, "uuid": "92b439f2-2377-4ac2-a394-50065d386b29", "comment": "Malware payload", "value": "23d3d2ab36b7d3d7f6b9a35872354acc03b808b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872360, "uuid": "f99ebee7-33e1-48c8-a6e0-1481cfbba426", "comment": "Malware payload", "value": "7b4aed5712d96636a91004562cf2d6bc2049632d6f78a69bc85067bcbe577bb3340ae48adecf71e418d47f9793d7152d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872360, "uuid": "c875471e-fc41-439f-bf1e-0d7d63d645c7", "value": "913302F2D243B6FCB643C44E4ADC6F66423B42B046690EF1C15DFEE2923921E0741A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872360, "uuid": "1d2fa8d7-e8e0-456f-8e48-781d0f8a5d23", "value": "1536:C/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFK:iXKAXh3TCdOi+KSZ4Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872360, "uuid": "894513c1-8ef6-4bbd-93d6-746a3c511b7b", "value": 51601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872360, "uuid": "b1cb5f5c-3fb3-4208-8d6f-8d76ed9d0ebb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872360, "uuid": "ec221c2c-70af-433c-89b0-6c5e666cf20c", "value": "statistic-140050721.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4580ed17-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867913, "uuid": "b0a3259e-3d79-41aa-acb1-d0d1cbf7c311", "comment": "Malware payload", "value": "bd1ef609d263849e3d221ba8bd5206c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867913, "uuid": "6dd0d901-0fa6-4c83-9c85-5cbac0a0efee", "comment": "Malware payload", "value": "1739c4c42f99448be486c2d7b135cb2d5e6a04344f454c7e7debf3230ae37c13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867913, "uuid": "1f09c89d-4bb4-4a09-bcc3-450201af6876", "comment": "Malware payload", "value": "56dbc73a8ed84d731e76a6bbb2b9a756f0bf380c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867913, "uuid": "05acd8b9-8bae-4d9e-8a8d-e57e8bd4bd7e", "comment": "Malware payload", "value": "443a61e120f7fe58578bc0ab8a4a190ac0dbe6085ba0f82c111ed4887ea4b7939e16a2b3781380bfc8602621a37fedca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867913, "uuid": "f3609e90-a4d9-4e99-a1af-609244b50bab", "value": "E933F184AF5BF458CB8373BBAC442F97AFB7026459DED19867C3309D01C3E6616142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867913, "uuid": "d86dc039-9cf0-47d9-a387-9e322e6fd94f", "value": "1536:xAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSd:mpoAnd9gucKCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867913, "uuid": "415246b7-10d4-4088-a5cb-d3ed292b3497", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867913, "uuid": "305cbab1-b847-4fde-86d7-44faf79a07d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867913, "uuid": "42298913-e9ef-45d3-9d40-ac1a0573805c", "value": "catalog-1972993100.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7aa37f6-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913309, "uuid": "40490bde-207f-4021-8590-b62fb6c12398", "comment": "Malware payload", "value": "4f1489bb927bbd2f044a557dbf6d4149", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913309, "uuid": "5a0011b0-4a39-4818-a94c-a8b0d78855f6", "comment": "Malware payload", "value": "1740c73661364f6eb5057b72cb6e33278e64b38feab118514165ae27689c98f2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913309, "uuid": "2e19fb8f-33ab-4a3b-9e10-26d550eacc20", "comment": "Malware payload", "value": "84b07597d511aeeab79d0c921b19e8b321a9264a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913309, "uuid": "aeefcb0e-cbd7-459d-ae46-74dc89f5b651", "comment": "Malware payload", "value": "41803c6a29fe0162c13c31783fad3cae4b19d731e797288aa00785985e345a225e828891af468f0d96a4d038159cd601", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913309, "uuid": "f7481d4c-83c4-47e1-ba90-c089f955370f", "value": "1333F1D232E7823AC0D504F1F5276AD956B79EC8F430A0C01E9FDA4126E31B5ADA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913309, "uuid": "1e0f7cae-dfc0-44ab-89f1-fce9feaadd75", "value": "1536:8EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRoV:JnBrX5Eg5Enjq3axWIfkNwRoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913309, "uuid": "f902ea5a-260b-466b-a418-3ed0994d6d03", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913309, "uuid": "62f6becf-ebaf-44c6-ac33-e9ffab58170a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913309, "uuid": "45b5f1ed-16b9-4a42-b09d-4ef5bb9c3c8a", "value": "diagram-239903516.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe2354a-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915014, "uuid": "61844fa0-2ebb-4c32-8523-f92abe2fbb58", "comment": "Malware payload", "value": "ab569a00a0c68b336a618882ae514661", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915014, "uuid": "e31ba87a-bab6-413c-97c7-8aa52346916b", "comment": "Malware payload", "value": "174551a6d390780e8efb9e33044ae08c0e02c2c4477fd29d01d03b5323bcc987", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915014, "uuid": "1891f582-deea-4dcf-9a9b-b1b6bddc077e", "comment": "Malware payload", "value": "8b13b4abeb2825e1e7076fccd67147c50751b186", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915014, "uuid": "1a37024f-0511-4e14-ac85-75656953e429", "comment": "Malware payload", "value": "f4ab94c677051d91d139677fca2ea4096c6631109283e20a827d606b2293fa84185c87fede2f5ac15a97bd05433bb7d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915014, "uuid": "ceff42e8-1895-46e8-9ffd-9a07b4d7019e", "value": "343302D3AB13E5D38AFBEAA7085252D4936FDDDC32147C58192A198345FB168C0E37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915014, "uuid": "da278aff-bb7f-4e5b-9a2f-37cff87431bd", "value": "768:No4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6Fhf:XeKCVQbp4LTaI7ZaiNQMIXwF0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915014, "uuid": "79139362-2394-4be0-b290-0bd235ef046e", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915014, "uuid": "f63a5116-23d4-4c9e-98d0-34972c02f704", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915014, "uuid": "c077d92b-a122-4cd7-a21f-e623cf10c340", "value": "statistic-1476177214.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d171dc0a-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914533, "uuid": "e8024f54-7c46-4562-9cb0-bd5fc9c63285", "comment": "Malware payload", "value": "511e2bb4f1148ba8b395d5d81b2d0fb0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914533, "uuid": "da74e1c4-0abf-4531-a613-d733c930cd4f", "comment": "Malware payload", "value": "17461926ce304deba1fea3256d5aa6eea9583c6c2cdb11f12d104db77632a8e2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914533, "uuid": "c9856891-a3b3-45e0-b192-9880413b9d98", "comment": "Malware payload", "value": "bc20e2b0ed1ae31185a7cfd18927381304cc3335", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914533, "uuid": "0806a074-dcaa-4d27-b747-918bd6ad1c5e", "comment": "Malware payload", "value": "0d05eb4f09ae6cb916eb0c57a0146d07076b00eec92ad428ad6d7c66f7df9cd767a1f95196c0a071d5fec4546288325b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914533, "uuid": "b42be147-a0ff-4d11-bcc3-b5d4288b1424", "value": "6033F1C56A23F6D286BEEEA304561395939FC8AD31243C58183B658281EB15894E7FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914533, "uuid": "f1114693-1687-45b8-9cb6-4e56885cd587", "value": "768:mo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkfDUle:eeKCVQbp4LTaI7ZaiNQMIX07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914533, "uuid": "307fde9e-08a7-477c-97ae-831640718c55", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914533, "uuid": "f434ad38-733f-4b72-8d74-c9a5d15d164d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914533, "uuid": "328c5fbc-da19-4d99-8f9d-1745c071f3b3", "value": "statistic-1112827827.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e61bd7-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913147, "uuid": "ce4d7462-da39-478f-b814-81cb7d812b2a", "comment": "Malware payload", "value": "566403018cfefc53be25341ebcc2604b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913147, "uuid": "ba081155-b7fe-4f6c-9270-3be910f60109", "comment": "Malware payload", "value": "17476c256ec7b4f4ba94720ca1ff706ffcd4a76c0fb565fecbeda28e2ab0cbd9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913147, "uuid": "8bda8871-5e33-410b-ba6d-6a07d5a4ad0f", "comment": "Malware payload", "value": "798e85b51c0a369890f4dde8d72314c2996e4f12", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913147, "uuid": "bab39c60-5ebb-4556-8cd8-5163dd4a4cb5", "comment": "Malware payload", "value": "75d4e3d847d33e136f4a9f580bb3fd70389bfbb583c6fb3fe9dfac1d5a1907f60b1a4762c6e7c5b79375979eff49283d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913147, "uuid": "acd8e910-76be-4cb6-98e6-1e0181fe0180", "value": "5033F1D332E6D23EC4C105F1F5176ACA52BB8E9CE530E0D11E9FDA4022D31A5ADA178E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913147, "uuid": "a5ed99b1-9708-4d89-9ea5-c1883e906bf4", "value": "1536:cEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRV:pnBrX5Eg5Enjq3axWIfkNwRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913147, "uuid": "49e1f423-e80a-491b-a625-7899139caecd", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913147, "uuid": "aebabf0b-8ceb-4777-8697-9a21784c32b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913147, "uuid": "9b9a767c-c9c6-43c2-b9a3-46186af1e285", "value": "diagram-2035553291.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23c0a30-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914937, "uuid": "bb1f3659-6727-445c-92a6-c67511b81ba6", "comment": "Malware payload", "value": "921843f18549d789ae7c245c78c56281", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914937, "uuid": "7abcb577-f078-442b-b183-4aece9edd2d9", "comment": "Malware payload", "value": "174807f16dc84a0a7c492345cc21a044dd92bcecbab265200ee25e9a3173fb4e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914937, "uuid": "f93bffba-c52f-478c-9282-50c73bb4d8a8", "comment": "Malware payload", "value": "b88ab6be47b30e1628ba46c53841fca685b5ef83", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914937, "uuid": "891b4e09-6864-4d8e-b507-ec1398f0eddc", "comment": "Malware payload", "value": "2b35e7aca99cc95670d1de6f47b7f2510a608534b647cb8b936a899e63b7ce26d8f86295326f6517fccc58f122fab72a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914937, "uuid": "a7fb98b1-1a0e-4629-8f05-ec2d97e0b505", "value": "EE33F1C65B13F5C6C6EADA57088633E4536F98DD30143C6D6C3A658280AB1A8D4E7BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914937, "uuid": "f4fef2d1-830b-44e0-8c6d-adb94b72ea0e", "value": "768:Bbo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK8+o:HeKCVQbp4LTaI7ZaiNQMIXd1+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914937, "uuid": "af85b253-7e82-4290-a2ed-e07f465b6077", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914937, "uuid": "9c5d9bb7-2683-4bdc-a347-64ad2ff90f9d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914937, "uuid": "47217daa-fa90-4fda-b2bc-09210a6c2c0e", "value": "statistic-1410058343.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76c8738-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916718, "uuid": "7f517c39-48c1-4b0f-98c9-2c7146ed9f67", "comment": "Malware payload", "value": "9f9633433bd6635e5fa5ee8e02c5919b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916718, "uuid": "a15430f4-4531-4997-9810-c06d78e43c43", "comment": "Malware payload", "value": "174ce292b1cca76ebd9e0517eded8f09b02ff6aceeadef06ae567782fa8ad2b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916718, "uuid": "a8e21ad0-3872-4366-9409-44116acc3c73", "comment": "Malware payload", "value": "5c3036909361708e6cab4669ee46beabd48ca201", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916718, "uuid": "84295aa7-4248-4ac7-ae5d-96ed03a77f39", "comment": "Malware payload", "value": "c3136f818c8181b5d807706ff65bb769444326d4eca065134e3aa586270b9943ab747504b4f2c47553f80ba1dfcf4557", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916718, "uuid": "97e33dd9-e171-40e3-bae7-70ba87534783", "value": "FB3302D69B23E9C28AFADB670C5512E4636FD89C31143C59092A299384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916718, "uuid": "eb0dc611-155a-4759-86a5-26c6f35275bc", "value": "768:Hjo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6F1:peKCVQbp4LTaI7ZaiNQMIXAFYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916718, "uuid": "77e3c8f2-66dc-43a0-821b-e72686c501e1", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916718, "uuid": "ba94f0c6-b33a-4891-9c0e-6229a09a4eef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916718, "uuid": "24ce5134-8f2b-44ac-bca7-59b978bb9b4c", "value": "statistic-743710226.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398d7ba6-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916426, "uuid": "2a87197e-ca52-4f31-b862-fa41eb5cc55b", "comment": "Malware payload", "value": "0ae7bebc584926e1210b4d3f7fd726b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916426, "uuid": "e1f7f175-5940-40c4-adf8-9c3494156d31", "comment": "Malware payload", "value": "1751c4a51e63dc932b8aebd469bb87ae29ce4dfc29bbc08f4869a0e45774883c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916426, "uuid": "f5a9b8f7-33a0-44fd-92ee-be53f603a518", "comment": "Malware payload", "value": "511780f7f841b4ee8d6cdc907b6512b28bd4b58d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916426, "uuid": "1155b963-ecc9-4a61-93d7-8866cec24318", "comment": "Malware payload", "value": "17ee3cb8bc11c02fc0e308d0b194436d49f058d3b609735674722b4c4b83f7497d6418ff0aa5ce296ac92120fc224152", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916426, "uuid": "ed77cef7-0100-402b-b221-9898c3957567", "value": "7133F1C26612F5C68AFADE63044522E9535F988D31283C695D3E759241FB158C4E27CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916426, "uuid": "40e0c6ee-15e2-4381-bdf3-14183fb5644d", "value": "768:mo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkUB:eeKCVQbp4LTaI7ZaiNQMIXUUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916426, "uuid": "0c91b0a7-fc54-468b-8aee-b5d189a3c19b", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916426, "uuid": "e0e3f120-4b43-4b03-8171-869a787c7476", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916426, "uuid": "1763acd6-e6cc-4098-8dbf-bbb3ef86d945", "value": "statistic-596610173.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbbad4b-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870554, "uuid": "483be097-e878-417a-9592-d98901813f05", "comment": "Malware payload", "value": "4b4f620710fa4b16c3ab043bb0950e95", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870554, "uuid": "7ddde3c9-e7d4-48d2-8456-c5a81c69dabc", "comment": "Malware payload", "value": "176938d6b9e92d8dd1ed8fa825fa4ff2c67da610fb40b71fe9fa3253884fc3e4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870554, "uuid": "a58d5cd1-1c53-4f09-92b1-d9018fb681ac", "comment": "Malware payload", "value": "fccf2af8abc0a31843f4bd51f884f74d91eaf750", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870554, "uuid": "dbfa9e27-4f13-4e8e-bb2e-7c7298160a6b", "comment": "Malware payload", "value": "03305a73adc49f40bcdec45eb4c66296b068713c2df9e4a227e6d54c1c78bdc98fa35835caa11b7e2f81f6e1323455bc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870554, "uuid": "68826200-3f31-4d49-a3df-c96558c8e871", "value": "FD33029673FAA910C9F1C2B0A4E27188374F3D928E7D5EDE4D8894793B921A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870554, "uuid": "ac142dd5-2ca7-47ad-b150-b2e92769ed62", "value": "768:z5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJon:z/czJJSI7r3Pwh8rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870554, "uuid": "586e6e35-b1cb-4d10-9d36-c2178a1bfcfe", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870554, "uuid": "5c505536-d1d1-43f3-8a60-6b3e62aff250", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870554, "uuid": "cc4eb75a-6642-46d8-b8a4-cb3934cd47f7", "value": "diagram-1994377294.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae5448e-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870257, "uuid": "39fb6e8c-7d0b-4271-b7dc-5504f332c7d2", "comment": "Malware payload", "value": "4f46f7f4cb66072823a85a00e15ef343", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870257, "uuid": "3e66fb8e-3713-4a49-85d4-e8f850a33f25", "comment": "Malware payload", "value": "177017287c6b20a6d0642d4e637dd28068d8dbfd7bb72d101b44db40d28dd12f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870257, "uuid": "2694c0e4-c596-4f67-adae-9c8aa599065d", "comment": "Malware payload", "value": "129e6205c666fdfe38f4a20036750a07619ec61b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870257, "uuid": "53cc6449-2ed2-4528-95f9-c74e0194566c", "comment": "Malware payload", "value": "53c4ad7f38ff79ac7592a2fa79dd54898bcb25f68e23667c3f79fef011d7458daa368349881d8d81988a2646f42f0b67", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870257, "uuid": "0dec8cef-7fac-407b-afd8-66f49755eb36", "value": "3B33029673FAA910C5F1C2B0A4E275C8374F3D924EBD5DDE4D88A0793B921A1CEE16C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870257, "uuid": "51e75412-b61b-4933-a844-1d7393b70612", "value": "768:b5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJcg:b/czJJSI7r3Pwh8fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870257, "uuid": "5bccc73b-32f4-46ed-827e-81cd316f3c6f", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870257, "uuid": "e3f52ee3-3e60-4168-ae2a-f210a27e4285", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870257, "uuid": "9709473b-36d2-475f-a45b-5d56529c6736", "value": "diagram-1786420014.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b05611-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916874, "uuid": "1dfb27da-ef62-4e90-8f51-3fc0e37efded", "comment": "Malware payload", "value": "9ab92a838b664046b5e361d75e6d558a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916874, "uuid": "6c3be872-d2cb-4639-9972-8a76636d9766", "comment": "Malware payload", "value": "179fd26dd52b980a32f312a9ed17fdbd1e69bf7412f20d9c01f972aec242d6a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916874, "uuid": "b47c54b7-d8ad-496a-ad75-8a4f1f817132", "comment": "Malware payload", "value": "15cd2d60346177b8a57a8690d82e7feb4326dec9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916874, "uuid": "c03e8af6-fe16-4ce6-8c9b-5bdf1af84732", "comment": "Malware payload", "value": "c0a28b714d346c4deff71d8ad1e75fe50d0b7f4acf817ef1959e90721773856541cf1f1b770a031b6581588aa2990664", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916874, "uuid": "99b4733c-17a7-4419-98eb-1b27fe1d8cf6", "value": "A73302D6A513F5D2C7BACFA3089623D0A3AEC44C32143C995C6E259284AB158D4F37CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916874, "uuid": "02f902c2-be6a-462e-9556-a5aeb68f2586", "value": "768:no4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SZEaQENp:deKCVQbp4LTaI7ZaiNQMIXWKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916874, "uuid": "fc8b7a3b-7ec9-4d18-8525-81c0fa74a954", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916874, "uuid": "1ab50a9a-3661-4360-bc51-154079308e0f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916874, "uuid": "c067e19b-185a-4825-9942-5413709cf0f7", "value": "statistic-855395110.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f73620-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867746, "uuid": "ce9d4d93-92f5-48d4-bd81-d6e6514bf5b4", "comment": "Malware payload", "value": "432f94794c37d1a47f328fd35dde9f6f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867746, "uuid": "92e85332-b53f-4826-b9cd-0847e7240424", "comment": "Malware payload", "value": "17a541cd66a86fe85523d28c60c15465289f09af54aeb7a96cb85bb6d72e79cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867746, "uuid": "439f2166-a82f-4438-8a4b-7864e7d0b1fb", "comment": "Malware payload", "value": "5b4b87c662e1808a6d6b1951d8f66bf81efbf04c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867746, "uuid": "98da15de-1853-4747-81a3-f32d53bc3f64", "comment": "Malware payload", "value": "60237d6ac322de9158ea1ccd0c50208a1134a2b68f1b3314639a8e0533976da6adf275645129f8e884bb3691821b1e59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867746, "uuid": "bd4e6009-63e3-4a80-b85f-9b774a893454", "value": "C533F1C8AF57F418CB9373BBAC882F976EBB035464DDE0951AC6319C0296D27661036F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867746, "uuid": "3a71d7b1-b6a0-4f76-81dc-8436994e0f13", "value": "1536:cAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHidJm:PpoAnd9gucKCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867746, "uuid": "89e67643-d081-4f78-a70f-e3a047b55415", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867746, "uuid": "a4a0a61e-61d7-4c7c-baaf-df67e83363e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867746, "uuid": "51d3807f-c328-40a9-a40d-2f16109dfe41", "value": "catalog-1835465751.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e98f293-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910448, "uuid": "e6e27014-e900-4c8e-860c-7e61805d9fb3", "comment": "Malware payload", "value": "8e6f23938acc673f184dbf6815553319", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910448, "uuid": "4a884770-d659-4d3a-ad05-1923f3790898", "comment": "Malware payload", "value": "17ac448075a0012cfb3256531714208d8445e31cd928a5e2730d5020ad589012", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910448, "uuid": "98fb0438-3c4c-4137-9a94-978ff6bb8a58", "comment": "Malware payload", "value": "e5337386bb0b5fed528db424b34aaf20a4543da5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910448, "uuid": "a770ca30-0305-461d-9cf0-efd843713f21", "comment": "Malware payload", "value": "372cf4acb4f1332a0b077762e027ddd6ad1b335bf794faccf54270fc137a931394d7ec01cfcf816940a0c469eb3c5b5d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910448, "uuid": "7fe9dc5e-b960-43a9-a937-24e39288bb20", "value": "DB33029F9404FBA3C1ABA3016FB597A205FC765DE130C0289359C2F1EA836D2817E9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910448, "uuid": "1322e32c-213d-4b51-b050-e299aafad7bc", "value": "768:fqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMxZ:SxTuDqsF1Cnc3P57oj2+nC6uxkLuLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910448, "uuid": "cd8c5974-2d45-4f55-8239-44759cb97f66", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910448, "uuid": "583008da-f63b-415e-933e-24da22baf141", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910448, "uuid": "02269e4f-9c66-4c6f-95ff-19199d09562c", "value": "catalog-200342936.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9523c8-b3e6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620908943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908943, "uuid": "826804dd-eb67-4629-b4a0-74a7cc36d857", "comment": "Malware payload", "value": "21d05ed3d3cc006675d46bd4f4697e8c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908943, "uuid": "4e8b98fd-9927-4ffc-bde2-d6dcb7d42745", "comment": "Malware payload", "value": "17b65706abbe45e498dc215e9d537e313de824c6df590be090d0aa9e9cb2ff1a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908943, "uuid": "19a6d145-a3ff-4335-96d6-31ab93647a9c", "comment": "Malware payload", "value": "cb2f8de7ac22a965fdb8f5ed7f9cbf7dd0c5f23a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620908943, "uuid": "10dd1b79-0692-4e2e-b5a4-ad392b26b68c", "comment": "Malware payload", "value": "8bf1865d472ae510f9c7e1c44e5f7f02f5b10454cb6dab0a04537d247d41e5a56d4b84ad6739264eb29f20307f0e7259", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908943, "uuid": "7501e177-b847-48d5-a646-2fb74736255d", "value": "9533029F9404EBA7C1ABA3016FB5975205FC765DE130C0689359C2F1EA832D2C17E9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908943, "uuid": "ab7464dc-5a7c-4a6f-8200-b16f8340f4d3", "value": "768:zqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMeR:mxTuDqsF1Cnc3P57oj2+nC6uxkLusR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620908943, "uuid": "a7968983-2d8a-4a88-aaec-e36001755baf", "value": 51710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620908943, "uuid": "849d0b76-1656-41fa-a2ed-0e65f15c431b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620908943, "uuid": "f709f2e6-ea6e-4df5-9d08-351e43399e46", "value": "catalog-10035639.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e843ef-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914427, "uuid": "90aff376-6448-439f-a5cd-db0ae1828538", "comment": "Malware payload", "value": "2924e80812063123c6e1501b0525e70e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914427, "uuid": "4d96e5d6-72ec-4a56-a329-3f6038d7b8c8", "comment": "Malware payload", "value": "17c1fcc925f6e1c00574edd175855b419fc7db4d1c5a880a9abd6a7203a6d8ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914427, "uuid": "40defdfe-93b1-4780-ba34-8016ba41c477", "comment": "Malware payload", "value": "7f40cbb43f5d62fd39ff751646845d2fa8f7f70b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914427, "uuid": "b2d11e28-492b-4723-8cb3-3aacab571b4b", "comment": "Malware payload", "value": "52e45e9542cfc79a98cb8d570d59bb20439368c24c54a7f3ba5fb9db535cc4bedc993ea5d41ec0f1219a6ed790fc6f70", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914427, "uuid": "43b2fbf4-37e7-4422-b00d-512ac13b18d2", "value": "223302D69B23E9C38AFADBA70C5522D4536FD89C31143C59192A699380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914427, "uuid": "42d870b4-e1ef-406e-93c0-331c67d99f0a", "value": "768:no4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6Fjv:deKCVQbp4LTaI7ZaiNQMIXwFUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914427, "uuid": "5ae6aa60-691d-478e-a043-242817e75f24", "value": 51774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914427, "uuid": "8dcf2e2c-04b1-449a-b8e4-605bd6c863d0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914427, "uuid": "1751879f-297a-411a-9998-3d5a45fde3e5", "value": "statistic-1033555592.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9d741a-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910685, "uuid": "17ce6ba7-1739-4282-9ed2-e58c1030e360", "comment": "Malware payload", "value": "60852d961f037cea99edc2ad37364e9b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910685, "uuid": "425444c0-0810-42f7-ba53-83351ff1d5ba", "comment": "Malware payload", "value": "17c3baf17d9554c9a4b2b97531a543e2b85c8e610e94166aff92b8a379ff02b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910685, "uuid": "ae5a57dd-8571-4423-a0b2-446b7935c499", "comment": "Malware payload", "value": "91eda43627be6375370b7ada1d311f2051ade1b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910685, "uuid": "1ec82d7a-ed46-491b-973e-75de41597b02", "comment": "Malware payload", "value": "b5b24cd23c05d7899fe7213e5905debbb49eed1d6fa8f6744a66c9bec0fe6dc10e7c5f356c64ca8f07f7c28837fbe733", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910685, "uuid": "593211b0-509f-4e4f-9c37-dff11c00ce36", "value": "B43302DFA008AAB3C19F57016FB69E720AFD765CE0309164836AC6F6DEC36C280795D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910685, "uuid": "720578a6-b0ec-4e3a-a396-5a01451efc09", "value": "768:Pgqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOWvOg:RxTuDqsF1Cnc3P57oj2+nC6uxkLOW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910685, "uuid": "11c5b370-6b68-4d28-8a9f-61280cd11719", "value": 51711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910685, "uuid": "a9007a08-f1ce-4ffa-a99a-49f7feaa9f9f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910685, "uuid": "9dde0618-77bb-4889-9b30-03128d59494d", "value": "catalog-268659284.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ab82c5-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912599, "uuid": "ae31a5e6-fbd9-4a53-8617-56114848651a", "comment": "Malware payload", "value": "59f27e5e357f63da5c1f1b090d4dcab2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912599, "uuid": "539a44a9-0e7c-426f-a987-84d4bc0e7718", "comment": "Malware payload", "value": "17c48be2e40e6896e97d1c826577ef0f866d7d8a145127ef1dc5a7b6eb47a9ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912599, "uuid": "804a3ff1-b411-4752-a4c1-3d9f05368246", "comment": "Malware payload", "value": "b58d05504d13dec3ffe6dbef3f3410d870dec53a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912599, "uuid": "4e37ca8c-a4de-4c6d-8129-8fc036656ddf", "comment": "Malware payload", "value": "5dd402319ce1b5cf7413f0ba03f6c3f3324969eba2a19cfb0e49c6f2bd6caca8928023a8b47583490186c1addd10c3ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912599, "uuid": "f24cf0ad-f9db-4bd0-a477-120cec24e22e", "value": "7C33F1D233E3D13AC4C505F2E5175EDE65AB4ED9F820D4D01D8EEA4022D319AEDA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912599, "uuid": "46bc8564-f968-4070-b5d1-6e5cc8e67a49", "value": "1536:gEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMi:FnBrX5Eg5Enjq3axWIfkNwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912599, "uuid": "2e2a74bf-06c1-42f2-a0be-3aa9d1d08ff6", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912599, "uuid": "1c14adb1-7fb7-4e16-809e-98eec3feb85e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912599, "uuid": "a487721e-fda3-48c4-9cfa-0e1a322c9d62", "value": "diagram-1763215717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9281b794-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867612, "uuid": "8cd85b17-e79d-4a2d-b8c2-75401ff6f4a0", "comment": "Malware payload", "value": "d17e188cdfa810a43b98415e6226b6fa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867612, "uuid": "40237032-3770-41d1-99bb-782fd3c40729", "comment": "Malware payload", "value": "17f3725ce04a997ca7b938b856914f87d15052a29e3865c13fb43c0100367c2b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867612, "uuid": "40d79395-13e2-4d69-af2e-0314498dd574", "comment": "Malware payload", "value": "9119488772e59db587fe3f2533f7eb6cdb3d23eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867612, "uuid": "9661f598-a36c-46be-9259-1b00abb86e10", "comment": "Malware payload", "value": "6a2c71f7724b4b8745b6aa39bf7b0cb87a4082d72b738cd4a13e2b7c456c8588693e42ff73559dfc8c29cb958f1024e0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867612, "uuid": "40777d25-d4d2-4e1b-bb2b-04e168bb40fa", "value": "1633E184EF57F518CB8273BB7C882ED76FB7026454DEE4995BC3319D0292E32561026D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867612, "uuid": "86de5ffd-9293-490b-a8e6-824773bbbebf", "value": "1536:tAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiNqK:KpoAnd9gucKCIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867612, "uuid": "aa563e90-f4e1-4f5b-b90d-ea6abab9f3bc", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867612, "uuid": "ff0326c4-fc03-49c7-9cc7-9ef30874f7cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867612, "uuid": "8d99a94f-56e4-4eb2-bfd1-f6501550e6f0", "value": "catalog-1746597319.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad9c55c-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912643, "uuid": "c18bf928-d2b0-4787-b9a6-9d3fa3f41cf7", "comment": "Malware payload", "value": "5460c067de10777fb49d48446f11bf52", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912643, "uuid": "fe2b561e-0a06-48d2-9adb-7cec0f037b50", "comment": "Malware payload", "value": "17f7a504869634bc0622744b1109a9fe5d1daa2fbc5075e01d317db1e5ed8df7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912643, "uuid": "23f8e106-1361-46aa-ba5f-9b8faa705384", "comment": "Malware payload", "value": "acef57d936b1cdf851e6c838b626a9e8a6946f62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912643, "uuid": "f23cda7f-8929-4004-9553-fffc4dca3f26", "comment": "Malware payload", "value": "4abbb981e30b886d60e2a2e330ac36ccdf05018c16f1d5cff9ae907ed450f9d10de966bb6f78283568ec648665febd2a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912643, "uuid": "72417bfa-f0a3-40fd-ae58-c593f01dcb43", "value": "7233F1D232E6D23EC4D505F1F5176ED952BB8E9CE430E0D01E9FDA4022D31A5ADA178E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912643, "uuid": "a02d75ae-a45b-43cf-b23e-4e585f96342c", "value": "1536:REnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRF:enBrX5Eg5Enjq3axWIfkNwRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912643, "uuid": "b72cf05c-f2b1-4f6e-bde5-83c96e33ec1b", "value": 51761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912643, "uuid": "448233de-9377-4385-9d9a-496a7717a89a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912643, "uuid": "bf37d010-d870-41e5-ac3d-57a09b114d0b", "value": "diagram-1792452597.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff897ae-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870776, "uuid": "66f3e5e8-56aa-4a10-8466-f64b2c977ef0", "comment": "Malware payload", "value": "28deaf21545e9e5015167186302c9db7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870776, "uuid": "934515fe-571c-439d-8e3e-5effcb5d88ed", "comment": "Malware payload", "value": "180f091fdbd63757e71461f00bcb8b4724707e8cec8491960d2241026495f4b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870776, "uuid": "e46859d7-d757-4e80-a2f0-bc87cc598ae9", "comment": "Malware payload", "value": "ebdf335aaef815e7e7ada7a59dd6f3fd6f5021ff", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870776, "uuid": "d7c834aa-4b0a-4c4a-a9ff-f6c7c928cadc", "comment": "Malware payload", "value": "7913fcde024a6b0de19cdbce3443bbf8791b7df8437c62a361230b1fb2abb960cc2ab2215ac14f0490d0c767237a176e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870776, "uuid": "9caf8432-9d3c-4cc8-ac5e-59b4d26a5fdd", "value": "5633F1A537F9B900C6F2C1F060E26699274B3D918DBD5DEA0C94A5B93F931A0CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870776, "uuid": "7c7d760f-cc33-439c-9e2e-9c897f030d61", "value": "768:t5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJoe:t/czJJSI7r3Pwh8R6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870776, "uuid": "1bda271e-6f8a-40ce-9a76-082e658a4b45", "value": 51595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870776, "uuid": "c2f1e6c0-d5bb-4270-996e-396d2fae25b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870776, "uuid": "bc543236-f7b6-44a5-8ad6-7001f107bbbb", "value": "diagram-2123637851.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b49e89-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910193, "uuid": "686f6391-bc40-4758-9c0d-353d05ddb8ec", "comment": "Malware payload", "value": "d3b4a15cf2dd0368d5ba3fb9c57c8b66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910193, "uuid": "e0254e31-7bd5-4f22-9157-23d710bf6bba", "comment": "Malware payload", "value": "181a7bb73ebba540f932d601658c3cf934ae7d2697a254d959962d6e0a9bcd93", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910193, "uuid": "990c3140-7f97-4e1c-8862-fe74480c9863", "comment": "Malware payload", "value": "a5a1b3965e207c3253f16a9105724c50c266458e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910193, "uuid": "acaa372f-a521-415e-b718-6921e4e5293b", "comment": "Malware payload", "value": "6a13b1137989808ef7694821532846a70594b0dbadd948187e412acaa6b78b80fd9d34f2eb291a3d97471114132561ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910193, "uuid": "6e8f7c26-6a8b-4bee-9a98-cf8805140597", "value": "3C3302DFB414E9A7C19B67015FA9E6A206FC751DE230D15CC31AC2F5E5836C2803E9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910193, "uuid": "d464a05a-6104-48a1-954e-b85aaa43f38f", "value": "768:Lqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7IOzzObaG:OxTuDqsF1Cnc3P57oj2+nC6uxkL7x2OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910193, "uuid": "e763d7aa-49d1-446c-bd2f-bffed5197149", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910193, "uuid": "db52e342-a972-4ef8-8961-a86a12f4d00b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910193, "uuid": "22f0651f-6a90-46bd-ba26-67875b5e009a", "value": "catalog-1824046396.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a0a848-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909673, "uuid": "2b36ba39-d414-49bb-b0a1-4b6a6acd7a3c", "comment": "Malware payload", "value": "893ab5f516ae0446aa31c63a46eb7a60", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909673, "uuid": "16b77e50-6fc8-4f9d-bc56-199f6c4ca92f", "comment": "Malware payload", "value": "1827583e6b73a134f656ee0060999fba967844e3a51f25421d6c709318238f3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909673, "uuid": "c8986007-54b2-4b55-8f02-f5fa5587249c", "comment": "Malware payload", "value": "5fb87416407c9659006a53e7024977094641a23c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909673, "uuid": "5fa1955f-bd64-4da6-a9d6-f339eef2b03c", "comment": "Malware payload", "value": "635eb087aad56bf2358b7637046f41f4a9179b5f5aadda91970401bfff4c85762c7b4c7004cee16299aedee597debf7c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909673, "uuid": "b47395b7-5837-4db5-a11a-caff80592745", "value": "7E3302DFA008AAB7C19F57016FB6DE620AFC765CE0309164836AC6F6DEC36C280795D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909673, "uuid": "1a1d01c6-dcbb-483a-a8f7-04310f36a029", "value": "768:gqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOAvO:ZxTuDqsF1Cnc3P57oj2+nC6uxkLOAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909673, "uuid": "57ec11ec-826b-4a93-8abb-e46f12b459d1", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909673, "uuid": "2c0a5772-9268-44e8-b10c-16b58e53da86", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909673, "uuid": "65b655d8-8a17-4dfb-830b-4e33b51470f6", "value": "catalog-1410006152.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5549d8a9-b38e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870946, "uuid": "6806e0b5-c291-409d-8917-e85ee45e2c52", "comment": "Malware payload", "value": "2a1b2da9da9e4da39e5d95859ffacdd5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870946, "uuid": "2be57dda-0114-4ef1-bf8f-557fb3aceef8", "comment": "Malware payload", "value": "1834fb5bcd3ce54acd6a1370cdbb761e1244548ace97ab13d451872d1ba8f47d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870946, "uuid": "56be3a94-421c-45a3-9e51-caa1f3939485", "comment": "Malware payload", "value": "9f9a9da2c6fed655d2cae3caba43fd284a4974ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870946, "uuid": "63d9f921-255a-4c30-98eb-e2b654edcb3d", "comment": "Malware payload", "value": "1abab29e5bd72b857a8c0700e81d845ac1f2cc13330e1203965e3c83e706eb9f81d86a3ab30e50558dcd2850ca3cdb2c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870946, "uuid": "9ea4d715-af9d-4ce8-bb08-37bf74ee0150", "value": "9533029673FEA900C5F1C2B0A4E27589374F3D928E7D5DDE4D88A4793B920A1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870946, "uuid": "393659e4-103b-4da8-ae83-0cd5e91664b9", "value": "768:t5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoD:t/czJJSI7r3Pwh8rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870946, "uuid": "4fb3d99b-6f84-4b68-a3fc-94a4a14e3430", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870946, "uuid": "22fb53cc-4046-489e-b824-dba6d53b7d76", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870946, "uuid": "bab8c491-d569-4b84-94b7-4f2ec2ca91d9", "value": "diagram-314184755.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655005e6-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868396, "uuid": "49933f64-0da9-4b14-bdcc-295f90ff33b0", "comment": "Malware payload", "value": "2685aa8bdc837253f4e16a0798c14b2c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868396, "uuid": "a4671667-9feb-4727-9760-e991ee361881", "comment": "Malware payload", "value": "183c5770185652dd2c1aa331d80c8cfaf393e88767baf634fd1376a147bd646a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868396, "uuid": "e16743dc-4c19-4762-b735-51ee3d1e723c", "comment": "Malware payload", "value": "05cd7e9d80b6c68a91e9269d9bacd88e675f0fd5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868396, "uuid": "1d6c5d1f-01ce-4b14-ae5a-803f725d3b1a", "comment": "Malware payload", "value": "c140454fd8aaaad96577d7887e4e5aa6b6c21acb5e084f6126b469ccace40594f375340616abe78cdea235700b01ad87", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868396, "uuid": "1f455606-dc57-4003-af29-5f4154be10bf", "value": "C333E1C4EF1BB858CB837377BC482FD66EAB126064DEE09597C6319D0296E32631427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868396, "uuid": "9b1d608f-dc9d-4d16-856f-cf90af0bfc55", "value": "1536:cAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiHb3+JMB:PpoAnd9gucKC7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868396, "uuid": "a1bbabbd-a7c4-4fac-8442-004fa76e5b96", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868396, "uuid": "ddefb892-c468-4ded-bb3a-3e2fb34131bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868396, "uuid": "6760f158-4ced-42c9-b2fe-16f7ea7bdc26", "value": "catalog-379905000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40813f9-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914028, "uuid": "fe96a83e-44e8-45bf-8670-3b90121fb7f7", "comment": "Malware payload", "value": "428e92e32d51253af81eddeae4bb52ac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914028, "uuid": "ea04e272-61b8-4cda-b862-06402403363d", "comment": "Malware payload", "value": "183d126be0da534959296b2d98f710a3b4b8a08d54d53db9de25b966ace43111", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914028, "uuid": "8f70b221-b45a-415c-bca2-bba394e556a3", "comment": "Malware payload", "value": "e460f93bccf1e541fd314c324b6c9d253411eb3f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914028, "uuid": "e0dfee05-a39e-4816-9834-f228ef757bbb", "comment": "Malware payload", "value": "da3e59cc3641ba115d2446fa31942fa4160d1aa2e00af434312f961652e652abd265fd665c543cb28d87ce87d38f808f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914028, "uuid": "d5e89829-bfa7-4f1e-9fef-32c6115d683c", "value": "4833F1D232E6823AC4C505F5F52B6DD661B78ECCF430A0C05E5FDA4122E2165ADA278F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914028, "uuid": "aa3ac088-3858-4606-ad8d-8273942f3e34", "value": "1536:xEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRgC:+nBrX5Eg5Enjq3axWIfkNwRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914028, "uuid": "7b41f949-313e-4315-9850-5bf33a8aed8e", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914028, "uuid": "ba099b5b-5e8b-4388-b6bf-e0cbbbb4a748", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914028, "uuid": "d8a951aa-0634-417f-9680-637c083ec336", "value": "diagram-741183612.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f5b860-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916955, "uuid": "8244c7e8-5f95-4510-8880-9245c0aa44c7", "comment": "Malware payload", "value": "456bdee2e6528dbb0ed3de40c146d5b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916955, "uuid": "b8a8cacb-4436-48d2-94db-40b049d0f33d", "comment": "Malware payload", "value": "184160dadc928e182975d12650c6e262350dd73f994827712e2761d6fde754e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916955, "uuid": "3217c891-1aea-40d1-8927-363bcf3ee8ab", "comment": "Malware payload", "value": "b32e62e570c7c887c00a3296bd53dc43f57aafa7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916955, "uuid": "e214ad69-71d5-485a-b943-2972d63bdd38", "comment": "Malware payload", "value": "096db56afc4d23e89c3259adc54f726cf1f060fae45efc2dc11224e2f9d068926c60142539a6b91f18ba95787ee26713", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916955, "uuid": "0798a43a-6988-4042-bebe-72686ac22c19", "value": "9633F1C26612F5C78AFADE63044522E9635F988D32283C695D3F758281FB158C4E27CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916955, "uuid": "354c6934-9ab7-469e-9b65-326f62571745", "value": "768:Qo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkPR:0eKCVQbp4LTaI7ZaiNQMIXUPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916955, "uuid": "33175058-30c9-43a3-a792-62bd6c9fb0f0", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916955, "uuid": "f7310d2c-62b2-407c-afa6-712b52b18aa2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916955, "uuid": "c0e2401a-27f2-47a9-a5a2-549ecded1c33", "value": "statistic-903690907.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9813fe2-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912426, "uuid": "8e2c5a8a-286a-40af-b742-b4b462a97d40", "comment": "Malware payload", "value": "fbac6a23133796ce48f975ff9be312f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912426, "uuid": "53daa3c1-7b54-41ae-b7b6-0c9b266aa2cb", "comment": "Malware payload", "value": "1850775c49077dcda0efb2aa91a7efcb40ff4f03e0a22bf6686d7a940e0274cb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912426, "uuid": "c9360844-a394-4bfc-8b0f-855fbcee75d1", "comment": "Malware payload", "value": "c08ab006f93f453c34e46a85e671b0834cfe2e25", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912426, "uuid": "51e2ae88-f244-4f95-8606-6c824496c300", "comment": "Malware payload", "value": "1cdc010dc318c5f133880a9eefc402c850dc84a3e100f48d4fc2b4aa4e4a39c969757eb06bf5f8ebbef116edb88a3086", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912426, "uuid": "18ea7d9d-37e9-420f-be25-63e68b8b72c9", "value": "6133F1A232D7C13BC0C506F1F82B5EDA66B78EC9E920E0D11D8FDE1113D3165ADA264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912426, "uuid": "fdfc7814-44df-42fd-aeec-14270d1b1e3a", "value": "1536:GEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwe2hHC:TnBrX5Eg5Enjq3axWIfkNwe2hHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912426, "uuid": "8719b980-5ce8-45da-a96f-a1fc3759b4b4", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912426, "uuid": "f783f404-a09a-4372-9328-0403494784e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912426, "uuid": "fd8638d4-c9ce-43da-97b4-0ba3a263b780", "value": "diagram-1620034237.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110fb3e7-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909056, "uuid": "1f558075-65e4-455e-afd8-335eea5232a7", "comment": "Malware payload", "value": "01e24603a280c1f4d2226ac949a8a6d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909056, "uuid": "79b41d8a-ac10-4a19-9714-0947ee1b3446", "comment": "Malware payload", "value": "1866b94c9b036972ae80ef4ffda72115c5b035911540730426e2e88539861443", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909056, "uuid": "a55b894d-3e47-4b46-b36f-7b4a2ca7e898", "comment": "Malware payload", "value": "26f026ef5d955683a03f4ea05c82076efb2a0e6b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909056, "uuid": "3277afa0-5b1f-4825-85ee-746245aea741", "comment": "Malware payload", "value": "565983283bae0c7fb24f50867dbe2d92dc3af115c2e5afcece205860f7875111b318879c8b723111be588368a5977479", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909056, "uuid": "b8af38d2-8aae-4b81-9615-cba7ec65185d", "value": "7233019FA048EEA3C19B93015FF2C69302FD795DD1709658C369C6FAE5836C5C03A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909056, "uuid": "8b6b1123-5153-4bc6-ab78-7a97289b1def", "value": "768:Dqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0BCu/dD:2xTuDqsF1Cnc3P57oj2+nC6uxkL0BCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909056, "uuid": "9d80243b-f2a2-4546-80fb-ea387a42787c", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909056, "uuid": "c06d2587-95c7-465f-a67e-e0551f340d64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909056, "uuid": "1d95e8e9-2c76-4e64-9c93-f0ddc5899a81", "value": "catalog-1096811611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d061d4e-b3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913076, "uuid": "20f43246-d2a5-4177-95cf-b1b8ac1a73a9", "comment": "Malware payload", "value": "a4f8b3fd6fdcf375dfcc7201cc91ed1c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913076, "uuid": "2af144e3-2b7b-4c6d-af9a-1ca8d1923046", "comment": "Malware payload", "value": "186829a2eea86b0403819b014ac788bb0659eebdfae84e1979b8a2bfab86a20e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913076, "uuid": "4b98b5d8-285f-46f5-a261-d22da689be73", "comment": "Malware payload", "value": "62de7389b32d67162a1a92fb33683c7f7310c9fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913076, "uuid": "f6495de2-e612-4d82-9153-d9752f61f75f", "comment": "Malware payload", "value": "db7290dd8329301a258628612528f4e8293178208fd9f32ae0998d258dc7252268d3c2749255ca48b11ab902047dd846", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913076, "uuid": "5ab3324c-ef56-42c4-a4d6-712832c584ee", "value": "6333F1E233E6823AC49404F5F51BAACA56778E98F530E0C05D5FDE4121E31756DB264F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913076, "uuid": "bf1ed99d-b7ca-4d88-b052-9efb9a71af86", "value": "1536:8EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwR2vZ:JnBrX5Eg5Enjq3axWIfkNwR2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913076, "uuid": "832b4459-1505-4351-ad0b-a979ef3d17b4", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913076, "uuid": "5f234ec6-15ed-44a8-aeff-179b740ac813", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913076, "uuid": "7befe7d8-2dfb-4b63-a923-754065eab98c", "value": "diagram-2001972119.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a25e059-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867947, "uuid": "1a1f00e7-b41e-4ede-876f-56211d8cf235", "comment": "Malware payload", "value": "c4326f9baba19a55bb368d3919c265f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867947, "uuid": "93fce5a0-40e4-4f1e-82bc-b8d2cbab352c", "comment": "Malware payload", "value": "187054fb86c2e967ceb4457ac426f54a3919edde3bbc777d5e6973fe9a50823c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867947, "uuid": "a3b8f72b-074a-4cbf-ad39-7b87fab61e19", "comment": "Malware payload", "value": "0e47f96eb348eef447bda86e000da86e7a24e7ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867947, "uuid": "c632bb69-d51c-4612-9d30-a5fcb19c8ac5", "comment": "Malware payload", "value": "d49dd032b2b5be387a7454e3fc47360f9ede79ec42b4a10499ed27b80ccd4c330738efcb4c75177cd23e6f56e352a309", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867947, "uuid": "93449cc8-22ca-4cf8-b09f-47d0a0210c17", "value": "C833E184EF97E428C7C273BBBC842FA77EBB0264548DE1951BC6319C4296E27161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867947, "uuid": "f75b3902-c693-4bd9-bd8e-5229d3cd69d9", "value": "1536:/AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVaV:YpoAnd9gucKCoGVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867947, "uuid": "7bfac930-fcd2-47e2-ae79-f81fa756e799", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867947, "uuid": "cb9f7154-5c26-4f10-b15f-8babceb9974d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867947, "uuid": "55d424a0-1735-4284-a234-16a902d3299e", "value": "catalog-2005337039.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b9f834-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872183, "uuid": "66961d32-637b-4b83-8b66-09d95e8069e1", "comment": "Malware payload", "value": "83904d8b470631c69d21732749f8ea61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872183, "uuid": "a59f56e9-4d47-4432-a4e9-22d7c1658e5c", "comment": "Malware payload", "value": "189264a5a8231e57a2ca6ad1b976d97bdee18ad66cb5bbd96386d77b9258b572", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872183, "uuid": "c37a251c-3770-4a4b-9648-26b9dc3a853a", "comment": "Malware payload", "value": "bd7aadfaed2d37ff85c07f3b04d350a07f1fd93d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872183, "uuid": "32999c02-6883-4be4-80fb-426b8a0ab027", "comment": "Malware payload", "value": "9581107cea28fc2220229a8a1c49d1ad70bada3b7288b4d4df21047b7374e40f2e9ed1abfadeffda720ba43e1ca6fe58", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872183, "uuid": "cce06665-b1b6-4cda-bf8a-71d287090cdb", "value": "603301F2D243B6FC7643848E4ACC6F66527B42B057690EF1C15DFEE2923921E0741A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872183, "uuid": "7d9ac94b-f804-453a-8dcd-c8f1ce3e18bf", "value": "1536:0j/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFs:OXKAXh3TCdOi+KSZ4Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872183, "uuid": "7783cf8b-3b23-478e-beb8-d5f6aec94040", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872183, "uuid": "6dbf1e1f-9d7b-49c0-bb53-6ae973bd0df4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872183, "uuid": "8cd39ecc-24d8-4367-9a51-1a46e2017502", "value": "statistic-1277373443.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd7a36-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914878, "uuid": "a0521551-3dba-4b22-8ed4-264693b831c4", "comment": "Malware payload", "value": "44f8ab94e9ecbf36fb6d561822690cb2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914878, "uuid": "e0d7bba6-c42b-4f7c-b50d-5d593b6e11ae", "comment": "Malware payload", "value": "189e13c3d7faddf852710c32d2df7cbdfaf6f20136d93c84b30daf59b9d00dcb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914878, "uuid": "e9a426f4-059d-4766-b214-86c0535ab9d7", "comment": "Malware payload", "value": "54a362561fdfdeeec9400b201c172c9d66ca57bd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914878, "uuid": "72d28763-9a52-48c4-b8ec-f480066e66a3", "comment": "Malware payload", "value": "2234f516cd7e75846cdb58e97c16e963d09baf6ad742d976fdbcf1c98ccedf53a1bca7b6232dbe0b7be22e467684ef3f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914878, "uuid": "041cc8b5-a196-4414-87f6-e5ea87753b8e", "value": "683301C56E23F6D286FEEEA304461395939FC99D31243C58083B658281FB15894E7FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914878, "uuid": "65a5e6b9-ebb5-4c1f-bd98-5564ea83ec8f", "value": "768:Qo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SkfDUl9:0eKCVQbp4LTaI7ZaiNQMIX0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914878, "uuid": "590123a1-ab4e-46e4-9b17-ca3f4c88faf8", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914878, "uuid": "0e78077a-0af5-4864-bb36-f2798fc31501", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914878, "uuid": "69450cd5-13d6-4224-ac66-014b5f2f2253", "value": "statistic-1372035151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167cc867-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913790, "uuid": "52d307c5-6581-42c0-a56e-ff50e8d311e4", "comment": "Malware payload", "value": "0097e944bbe5013090373a2038df239d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913790, "uuid": "c1777d92-5048-45cc-b6f3-4e9f0db5bb0e", "comment": "Malware payload", "value": "18a785380d46fa208ea7e77e1bb2ea572f550b8ac558c8b5170f080b431c3249", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913790, "uuid": "015f05e7-591b-4de4-bd12-4b4f0bf845c3", "comment": "Malware payload", "value": "831cfa79df901927a34ee0393fc646584316ea80", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913790, "uuid": "d0598f8c-6676-45b2-ae49-4e123ee16cfe", "comment": "Malware payload", "value": "e70c5440836c35b2bd7026be4e20252c44e3b094f36d5da95d4854de16c20dcde143c7ec5bc447e6cc027e0eb9d87b3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913790, "uuid": "dfe0a966-baab-4283-abf7-68e036647ae4", "value": "6A33F1E232E6D13AC4C505F1F92B5AC962AB8EDCF43090C01D4FDA5012E31A6ADE274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913790, "uuid": "b6ff246d-5405-4a97-a359-20165ebfd068", "value": "1536:eEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRsF:bnBrX5Eg5Enjq3axWIfkNwRsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913790, "uuid": "05ec6ea9-f8a6-49b7-8c0b-9072c523c6e3", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913790, "uuid": "ee08ac03-cc5a-4345-a314-408e66fb8b9a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913790, "uuid": "8be60e1f-8d15-481d-933a-f35b80a07202", "value": "diagram-54876162.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ed7038-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910294, "uuid": "c9a70bd2-2263-4d2c-ab2e-f43c9bb24f3c", "comment": "Malware payload", "value": "f30b1752431f6786ed9f97febbcd274c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910294, "uuid": "f0ed3644-5397-4e6b-a853-45e4046c6eee", "comment": "Malware payload", "value": "18ac2b170ec0f2290010ac517325ac45b7cff794e9a9b49a8ce531c869fcba46", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910294, "uuid": "cdab4a68-8fa1-4459-8eb6-792b1c58ef90", "comment": "Malware payload", "value": "4ca1867b0a85d595a9b1876aacde42e42cfff324", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910294, "uuid": "ebf9c2fa-1590-42e1-a42d-ed1a944672fa", "comment": "Malware payload", "value": "f4668789d737dac31f4a0fdb02b0b37f2119abde7c815a4a45eb8f10952e9722c55c430621267a90e4b1a312a54a7add", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910294, "uuid": "16753bf3-372b-44ce-bb57-ebcbc8b00907", "value": "BD3301EFA059BAB3C29B57014FEA97A206FC7948E070C264C365C5F2E6C36C5847D898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910294, "uuid": "e902eb5f-4d9c-4df5-99b2-6190cccf11e0", "value": "768:Rqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LR53:MxTuDqsF1Cnc3P57oj2+nC6uxkLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910294, "uuid": "3ccffcc1-e091-4b58-9656-f322dbe60823", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910294, "uuid": "baffbfc0-c8f5-44fe-b50c-a5b9a3872ea7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910294, "uuid": "2ecc2993-013c-476c-9deb-28ee9ac40132", "value": "catalog-1886492290.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9f9f41-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871847, "uuid": "949ad4c2-5d14-46ea-9967-6cf51f902c9a", "comment": "Malware payload", "value": "a14919dd38d92ab165505fbf1f30c598", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871847, "uuid": "db3e3e85-6ec2-47c6-bc40-c245b95eb5fa", "comment": "Malware payload", "value": "18b5861b6a757ef870ef77c5850f2f33459d64e6e3a458c61920186b271d13c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871847, "uuid": "96661f1a-b1d7-491b-a710-ca24d432a31d", "comment": "Malware payload", "value": "8f32dbe1258ae00867990cbe8534b01231dc466f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871847, "uuid": "f44b71c5-81b9-4250-956f-a47585c2aa52", "comment": "Malware payload", "value": "75ba4318f395f5f4edc3f74e38740ed7e2db76445bef596680ab446dd2c6546e9325a7f42c1e52aa34994d0533e84139", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871847, "uuid": "1c59107d-8a80-4f30-96c0-df508527c9e9", "value": "C033F19537FAF90086F182B0A0E17689274F3D618A795EFA08C476793F931A0CFE16C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871847, "uuid": "2f3f65cd-f8b0-4a2c-86d8-f7c07df6128b", "value": "768:k5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJK2T:k/czJJSI7r3Pwh8Rc2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871847, "uuid": "3ea6fab7-1ace-46ad-8e2c-ff12ee3c6c90", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871847, "uuid": "88c320e9-dc80-4d50-9522-5ad8976cfc24", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871847, "uuid": "791da551-ae99-4f9f-ac29-72af94b0a35e", "value": "diagram-990544855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd6b344-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867524, "uuid": "6d4db5fb-6068-4a63-8e16-86d8e8c71ab9", "comment": "Malware payload", "value": "c026da687a48108d8d9f97cc78ae8b69", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867524, "uuid": "1fb94f0f-cf37-4834-81fa-6b265006e42d", "comment": "Malware payload", "value": "18b96d7a6f512fa54b5cc48d49d77651728c4ef24bfa0b42e08ed71ac6ca73c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867524, "uuid": "fcb2e35b-5a90-4276-b448-de7165211c35", "comment": "Malware payload", "value": "1f0e4c09f19b4f44c40c4198c0734496a59fd360", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867524, "uuid": "db39ca9b-41c7-4102-8d20-32c7a559d0c2", "comment": "Malware payload", "value": "6fd643c47aef902fb7e0c0bb21a319c928c60fc6dade2d53cf1576971ab48e37905bb4f58ea7e018d425c9dc1c43374f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867524, "uuid": "5718b103-b226-4a3a-98e0-bd97e9665926", "value": "A033F184AF5BF45CCBC373BBAC442F97AFB7026459DDD19867C3309D01C2E6616142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867524, "uuid": "4ea50feb-1ef3-4043-86ca-f80c5667a733", "value": "1536:VAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSu:SpoAnd9gucKC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867524, "uuid": "cc4f91fb-0f1b-4c56-9ff3-5d8c0a1d2c24", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867524, "uuid": "0a9967de-a3ab-4611-b72a-234c82b673e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867524, "uuid": "b1ecb812-6847-433c-b156-be22edc5197b", "value": "catalog-1671733701.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89116055-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870174, "uuid": "affee6b8-6d50-45f2-84c8-f8e9228aaeb2", "comment": "Malware payload", "value": "be5099d760087cefac4cb62cdcc5caa0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870174, "uuid": "3006591e-4cc4-44e8-929c-210883c65e22", "comment": "Malware payload", "value": "18c8ecd8e9d7b6e89a27f13a827c88d2cf1324ef5b244b09106ab26bf162a345", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870174, "uuid": "5a7760af-1d08-4c0b-966d-4b802a74549a", "comment": "Malware payload", "value": "b09bdbcef5d79e22ed3a72d333f354d5e7941efb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870174, "uuid": "39493677-8fbc-46cf-a3cd-b042ee3db24c", "comment": "Malware payload", "value": "fd97d30e01ffe90b4368d407257c613074f00bbc79831eab82c890fbd1a77604196eb13bfa21a95659d5475a9856ce98", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870174, "uuid": "cdf659a0-49ab-4c65-9748-47d0d9e3efd9", "value": "5433029673FAA910C9F1C2F0A4E27588374F3D914E7D6EDE4D88A0793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870174, "uuid": "cbd2b264-7b17-4b33-8709-74a216c2d40a", "value": "768:b5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJc8:b/czJJSI7r3Pwh8f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870174, "uuid": "54f58809-c642-4451-adaa-a4d48ad30cc7", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870174, "uuid": "09c1d3ff-19e2-4bde-9677-209b856973a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870174, "uuid": "8d729ff8-52d6-420c-80d4-fcd0929e85f3", "value": "diagram-1706863757.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607bdc18-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911767, "uuid": "feff3f08-c077-4772-99ed-09b2982f1d71", "comment": "Malware payload", "value": "0a4cdf3d651024763dd2e4fc719b4318", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911767, "uuid": "957278b0-f991-4041-b429-631722bd4f95", "comment": "Malware payload", "value": "18cd0e9821940f91e60275b4292d4f0c2d6af6141ab10be994e5e5f6e4b91282", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911767, "uuid": "41c8f46d-e8de-4d71-90a7-82e109472ac4", "comment": "Malware payload", "value": "2b15266c238dcc2f9c55316e4e1ab735bb25f34a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911767, "uuid": "39c29a93-6f9f-4800-b984-79b7a0aa0214", "comment": "Malware payload", "value": "cdd6e83a17f9ea01de8f67a4ae9b0fb0325a240b513a23f71b70da5981fc7669fe75dfc091dacb69d0a4287a8d1a5181", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911767, "uuid": "65e510a1-089e-41a7-b252-fce3b2be7c70", "value": "E33302D232D7E23B80C105F6F51B99DA67779AC8F83094D16D8FCA1213E31666DA270E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911767, "uuid": "8cc66203-5f09-4edc-85de-b057ce5b369d", "value": "1536:QEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwnU9:VnBrX5Eg5Enjq3axWIfkNwne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911767, "uuid": "36e301f6-bf98-480b-a22d-99471142ec08", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911767, "uuid": "a77eaad8-1a89-4842-a356-c08d1d3b8712", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911767, "uuid": "dbf6c6a7-f758-4453-b7ee-be03167890a7", "value": "diagram-1048578526.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a825a1b5-b3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912746, "uuid": "f940f842-c238-4adc-bbde-e63bb991ca4b", "comment": "Malware payload", "value": "36ed06aae73b20dba9abcab774a1ebac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912746, "uuid": "cf251433-2cb7-4b54-8e38-d3dcc577dbd4", "comment": "Malware payload", "value": "18d1707fbb1588d8df0b9e29017e61378fa4516f0df1a3bb626b2de301646bd0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912746, "uuid": "66e0f773-6b11-4095-809f-d0bc9a57ea52", "comment": "Malware payload", "value": "2c8a53b35c83699e09f4259dcbbd923ae57e5c6c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912746, "uuid": "b8916378-60c9-4638-bc1c-ee73b59733ee", "comment": "Malware payload", "value": "77790d0e9f0cf05ce512065aec6e5e6f86383416d75522f762c90da32252fe160defc8d151211b6dc5845c4085ccc96d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912746, "uuid": "327232a3-f69f-44f1-be29-e73284718a8d", "value": "983301D132D7C53A80C245F6F92B6DDA66AB8FCDE930D0D02D9FDE4112D2165AE9220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912746, "uuid": "1284da73-f677-4c71-a096-63832a8fa1f4", "value": "1536:JEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnS:mnBrX5Eg5Enjq3axWIfkNwYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912746, "uuid": "da0c53df-15a2-4108-917b-be905caaee27", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912746, "uuid": "bb7ceca9-172b-4fd5-9270-db4337ab4bde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912746, "uuid": "b1d4e89a-5998-4cbb-bf60-73ed26c14114", "value": "diagram-1856563477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e8b1c5-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910727, "uuid": "d6b521ed-c1dd-4797-9409-ba2ba7403eeb", "comment": "Malware payload", "value": "8015220371b8566e7cfb5799f8bc6423", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910727, "uuid": "503178d7-d625-4e9e-b75f-2e77f28ff6dc", "comment": "Malware payload", "value": "18e282a237c2dc56bd1a0235f8c0d91d8d6e0983b02dfe8511e6a0a685cf6b15", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910727, "uuid": "dc6f49a8-28bf-456c-ab6e-d13f342341d4", "comment": "Malware payload", "value": "957ec1977680e6d33e197b34cff842b184f6b7d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910727, "uuid": "621e5613-d9f5-4a58-86d4-4984580a6ed8", "comment": "Malware payload", "value": "fe671a62a196655066453dd2dedd3df6d221fa7bc056ee0c0959c7c0a509627eebc306e615a3f5c762157a35f2fde8fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910727, "uuid": "fb967feb-abe2-4374-966d-5bae025738f4", "value": "A83302DFA014FAA3C1AB67015FA997A206FC791DE270D058C35AC6F5E5C35C2C03A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910727, "uuid": "15430b26-3c79-4b41-9e7e-ca73112ed9a9", "value": "768:jqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7dLS:WxTuDqsF1Cnc3P57oj2+nC6uxkL7dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910727, "uuid": "e3266e00-0b41-4b1d-b59f-e62cdc95dd40", "value": 51713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910727, "uuid": "c5aa717e-6720-4308-b4b8-570366a8d33c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910727, "uuid": "466d7b8d-6875-44d3-9250-10858a659e18", "value": "catalog-296152941.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d52060-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867777, "uuid": "004b1fe0-c1fe-4cff-ada9-b778851aa5e1", "comment": "Malware payload", "value": "7c016de9fb87a56effcb67bdd6dfa3dd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867777, "uuid": "3c233603-9c5f-4a74-b984-b5bd7bdbda8d", "comment": "Malware payload", "value": "18e823cf10c6f2110212bae880a7f549003ae4c8a37e6adf593605b8a8241b34", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867777, "uuid": "cc1b28b2-0dc6-4f2f-b7cc-102885f24ec2", "comment": "Malware payload", "value": "a66906d0e4dea8fece0bcf35cda611fb71c81cc3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867777, "uuid": "342fa001-75f7-4d10-a409-a03567c7fda7", "comment": "Malware payload", "value": "664851096e36662808a693405063d9647ce96d4824b8050f4cc707787cb7506a26f2abdec5ea0db5c32d47b3f64a0098", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867777, "uuid": "3eb28c98-80e5-44d4-986b-36be9f095951", "value": "9D33F1C9AF57F818CB8373BBBC482F977EBB0254649DE5A51AC2309C4252D33661036E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867777, "uuid": "95add021-cc67-4456-b6ef-8ab0e79e35ee", "value": "1536:zAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQ7g:0poAnd9gucKCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867777, "uuid": "d13d1eae-6f79-40d0-a544-972b10bcf3dc", "value": 51575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867777, "uuid": "fc70305a-7ec8-4103-90fe-c5d18d072329", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867777, "uuid": "6aff43b5-f3d6-414a-a09d-12ee69727232", "value": "catalog-1855739907.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab59951c-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914040, "uuid": "0c9023b8-b02c-4a86-9d0b-3d11abf3fff8", "comment": "Malware payload", "value": "fcf2734665affddf22e3990134be1e91", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914040, "uuid": "ce655c54-d0f4-4bf3-89a8-b0c3bb24785c", "comment": "Malware payload", "value": "18edc1198c5fba97719c20a9e6d374237633cc326e6146c12c8137c1641ce058", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914040, "uuid": "8d39df5c-79f0-4a20-9309-8074ae25394f", "comment": "Malware payload", "value": "eba6c9b5810e32f3b743c7fb1b3ce6f492e8baa5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914040, "uuid": "02df3aed-4b3e-4122-ac5f-047bd27d201c", "comment": "Malware payload", "value": "b2a8f51174296ac07a3cbb37f7ca395721390b742650d5c7c4d74ad5292cf4a7d7137b2b938c0ba03085aa90494b0809", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914040, "uuid": "32979829-ebe1-47e4-aa92-ea973907320b", "value": "D033F1D232D7E23B80C505F6F92B59D626B78AC8E83090D16DDFCA1213E31766DA170E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914040, "uuid": "057cd4af-6aeb-488f-8247-fbd104bf85ce", "value": "1536:DEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwnf6:InBrX5Eg5Enjq3axWIfkNwnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914040, "uuid": "66026aeb-a237-4de9-8b03-3c0027fd0c10", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914040, "uuid": "effa48e3-cd89-4135-b62c-8d68e8fdac03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914040, "uuid": "dd8146f2-8ec1-4675-8963-ba5127067580", "value": "diagram-744973722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c0f18b-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913650, "uuid": "53821c3e-0106-46b4-b71b-80f85b6494b5", "comment": "Malware payload", "value": "dc396977f4dbfd9376acf0957ea10a65", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913650, "uuid": "b5f28b75-cf0a-44e1-94bd-1d9182a24b52", "comment": "Malware payload", "value": "190a75a5d9705213238ee6fe312b62bc1a3edfdc89fd98b3c02bdaf56a3c5645", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913650, "uuid": "20cb7d8c-eeaf-4b60-8c4f-7f38c282120b", "comment": "Malware payload", "value": "661e48fde7dae8c8ede23d01a5d065c355f56531", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913650, "uuid": "1aa44b55-0c93-4f85-bb74-36023fd2828a", "comment": "Malware payload", "value": "c9e04ff46f587e56ec2c4c24af940ddb896167733d6432e1d2f6f9bc1a7aa79c10bf1faba743eeaba6579bd951ddd33e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913650, "uuid": "dfc15e21-77cc-4ba9-975d-3c714d6e94ce", "value": "6B3301D132DBC53A80C245F6F82B6DDA66A78BCDE930D0D02D8FDE4112D2165AE9224F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913650, "uuid": "31ce0821-1ebf-45d7-aab0-4bf1ab58cd52", "value": "1536:NEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnE:ynBrX5Eg5Enjq3axWIfkNwYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913650, "uuid": "35295b34-608b-4782-8129-32f45314b47f", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913650, "uuid": "a95fda92-1e72-4ee5-9103-6dce65a110e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913650, "uuid": "ac1459de-36e8-4bf4-bbeb-db6ecf56e969", "value": "diagram-456126550.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da34365f-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872887, "uuid": "8b6063b0-1b77-4a1a-9711-d01e0e1049cc", "comment": "Malware payload", "value": "7bf76f0e8d18b606e0db3bdabcbb7a28", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872887, "uuid": "df717159-8574-4b00-9fd5-2607c00b28d9", "comment": "Malware payload", "value": "193bdb9fb5620bf8753a5fc394b20fcef7c1abb0c3cc02031ee4d09e0ffc235f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872887, "uuid": "84bb3b84-347a-4473-b7d1-eb2cfbee43c9", "comment": "Malware payload", "value": "68e4fa640c2400d9cd2538beec53d9f816f47ff8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872887, "uuid": "cab14393-0a83-4b41-8425-91ab2c2616c1", "comment": "Malware payload", "value": "cb14389bea98c6895cc82095c09d029c4fed03ae1b70754f9744bcfe92abc260da3c908b9d257fe3b318efdd412d8d08", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872887, "uuid": "f6285c8f-a1bd-4c1a-b0a0-3c44fddd3d57", "value": "4A3312B3E643B1ACB743C4CA49CC5E1B433B427056688EB1CA1DDEE192397161B517AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872887, "uuid": "7d077951-e797-4f8e-b46a-51d40fccd3a0", "value": "1536:sk/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexHg4:xXKAXh3TCdOi+KSZ4WUg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872887, "uuid": "a7825eb7-530b-49a3-983f-7674f0f77073", "value": 51602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872887, "uuid": "a60ac0f6-46ef-4f18-9633-6a18a4ec3351", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872887, "uuid": "bcead588-ce9f-4172-9c36-56e48938780c", "value": "statistic-1774205213.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2d2161-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871920, "uuid": "63bad497-3d0f-4548-bd70-90432425846a", "comment": "Malware payload", "value": "f427c8c2b8bbc9969fa65615fd834196", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871920, "uuid": "d5f3bcc0-b3fc-49ac-afe9-de86e4b2854d", "comment": "Malware payload", "value": "1964410ae063128f2c2329c3f32af11d0aca8b5d9952ed9f6b3cbc4f6bcc5d7c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871920, "uuid": "3c59e401-f6ec-4e06-a16d-19f38f59efa5", "comment": "Malware payload", "value": "e695af67fdeff56b5b21c86ba7412c8be3dd5f57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871920, "uuid": "55975b81-820a-4b5c-bf16-09733d505449", "comment": "Malware payload", "value": "79f93b9d61ec3648afb5d9262d578636e45f7392c464b1923d40fb3b882295487488296df3c4288a9605d432bbc780a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871920, "uuid": "5d689db0-c893-4080-8687-f086aad9bde8", "value": "D13312F3D642B2ACB64381494E8C5F479237817067685EF18219EFA1D33E7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871920, "uuid": "3da22d1f-accd-4a63-88ca-d90484bc620a", "value": "1536:lh/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeeeL:fXKAXh3TCdOi+KSZ4W7eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871920, "uuid": "bd207ed9-9912-4674-9757-4cecffc1d5e4", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871920, "uuid": "3f36bee8-6df1-463c-aca5-1c91b0dfb5dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871920, "uuid": "d2eacbf0-cde1-4805-9409-1acb3a55596e", "value": "statistic-1050554537.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d360974e-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871587, "uuid": "df0fd435-10b4-4548-9d0f-6fd8136d73e2", "comment": "Malware payload (Dridex)", "value": "ce9a5575024e8248313ca61f06c4f7a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871587, "uuid": "ebf21498-9900-42af-a30c-10fdff676479", "comment": "Malware payload (Dridex)", "value": "196f523aa43528feea629d6908a1b092bbb742ad8b01de2ace154e00a787627f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871587, "uuid": "de2fb84e-131d-4a5e-b630-083ce86e58ff", "comment": "Malware payload (Dridex)", "value": "a9f3688bd3e3d6f29bab837080ccb991f1df0fac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871587, "uuid": "2357470f-37f2-4db8-8ec1-20d4459fa929", "comment": "Malware payload (Dridex)", "value": "10121b499e7018954bcb9e42b031d3e79e9a6c572827bcf14146e39a19443f6cbf2550cfff33201158e282d271fa614b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871587, "uuid": "689bd948-86ef-4da8-8ba1-ee3d1a629b63", "value": "6CF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871587, "uuid": "03412dbb-9410-49b4-b087-600bd4beef87", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871587, "uuid": "56730885-14ba-489d-b084-d56f160c7390", "value": "3072:C9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:C9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871587, "uuid": "012f4735-35f1-400e-bdc1-019e892a2f25", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871587, "uuid": "2f11f0e5-3769-41a6-a226-4f6ee7e36e44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871587, "uuid": "7089f9a9-7cea-4335-8552-15d964e5aa1d", "value": "ce9a5575_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1daacaaf-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911655, "uuid": "b66bf530-49a9-4550-b470-bc02a159f898", "comment": "Malware payload", "value": "920ccf904b3c03ed8453d78b6a50e86b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911655, "uuid": "dbbe3ae6-9c90-4168-aa0d-f2b39425ec28", "comment": "Malware payload", "value": "19701e828a396e4318eaf9726db3ddc36686869b133a9e98b437a6f94d05547f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911655, "uuid": "29a54b80-c005-4033-b611-5ae3632b61d0", "comment": "Malware payload", "value": "c1e96cf25bdfe76a21b09f096de9570829bd9a9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911655, "uuid": "2918d355-6913-430d-a018-a3b4569bae94", "comment": "Malware payload", "value": "2d0d06d96ab195fa588207e9dd0e7a61c6890aa5623d8b3e4a5f6056e0d81c7d40d2c745ab4f3c1e7bd229ed77a5d3e4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911655, "uuid": "12801f5c-28bc-4533-bdef-ac9f6be2a440", "value": "F53302DFA004EBA3C25B93005FF98AA215FD7958E1708168979986F9EA833C2C53D5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911655, "uuid": "ee9cd1ff-ce0c-440f-b3a3-27766f492a85", "value": "1536:0dxTuDqsF1Cnc3P57oj2+nC6uxkLYtXqM:0dxTqqsF41j2PxmyXqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911655, "uuid": "964f0bc6-a042-45c3-84e9-ca2b9aeafc1f", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911655, "uuid": "10e9a7ea-be19-43aa-aac5-4ac56d13ca2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911655, "uuid": "df2a62fb-d651-4887-9694-eb9caf8186d3", "value": "catalog-976140930.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5788a91-b384-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620866893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866893, "uuid": "56bee105-7b7b-455c-8ca0-12ca8fb96a76", "comment": "Malware payload", "value": "f4b707f0ea2e9512478177df4c4fb850", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866893, "uuid": "b247f2fc-097c-4bfb-96fe-682c414a14a2", "comment": "Malware payload", "value": "19790a339082e12e1a2d85fe5e114f70d4dcf9bfc851e4b022530ca5f11525b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866893, "uuid": "2f137b49-c12d-4af0-bc11-595b8e82776a", "comment": "Malware payload", "value": "1d2e4ce30f05d7e7e3da5d319dc4aaf421c92435", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620866893, "uuid": "ea2aee6e-7a21-44fa-8448-8d2e6bc58d1b", "comment": "Malware payload", "value": "f1dd91d30101b7f892e5a3c62abb73e2d8a6a9bf8e78f3eafbfd6edef2ad24164837ed29b823eead4986c4155c1136aa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866893, "uuid": "ecd7147a-55d5-4211-bd05-3be82accffa5", "value": "9033F1C4AF5BF45CCB8373BBAC442F97AFB7026459DED19867C3309D01C2E6616142AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866893, "uuid": "e0d85a20-78f2-4dce-b5a2-8f564c880a7f", "value": "1536:uAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiSv:FpoAnd9gucKC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620866893, "uuid": "e6eb22a4-00f0-4a5c-9ac8-68f40bd3abb1", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620866893, "uuid": "302b53d8-aeff-4966-b978-519736bf8aff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620866893, "uuid": "c4c60d29-55cc-4a99-9587-a40b423ff39d", "value": "catalog-1167684060.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45801453-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867054, "uuid": "99aef76a-c232-4418-8a0e-7768b923992c", "comment": "Malware payload", "value": "e6360efbb6ec2da9800e45ed240dcf0d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867054, "uuid": "9daebf3d-3605-4696-b12f-24278b5ad2f4", "comment": "Malware payload", "value": "1988ecd767884a7fb6abb1f3379a678ae0007f24018b0479e2f2df75cf82a6b3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867054, "uuid": "445b9118-a7cf-4b0c-ae50-46a6453b9f21", "comment": "Malware payload", "value": "35d1f5cbee8db18d5cc74a8d04b6d0a0549bd707", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867054, "uuid": "1b5851d6-4414-4bb0-ad25-3f44574a5ee2", "comment": "Malware payload", "value": "a85d251ee669ae8346da8457ef556ec081efe633fc8fbd16caef3e73d922dfaa5fff72fe39293f841e2baa47b379a8e3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867054, "uuid": "2b46b745-35f4-4d9c-8fda-40dfcd26a7cd", "value": "CE33F184EF5BF818DB82737BBC892F977FBB0264608ED45917C234DD0296E2356102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867054, "uuid": "9e2afe56-f920-4065-9fc1-00969682b5f7", "value": "1536:aAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiqz+y2:JpoAnd9gucKC64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867054, "uuid": "296ab5be-7f33-40d8-b5af-8b91d54bf356", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867054, "uuid": "22ce1846-883b-480a-b346-42b29ee26485", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867054, "uuid": "d404173f-3780-4bba-aa4b-58250ad6b121", "value": "catalog-1286066877.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93dbc5c1-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896821, "uuid": "f69d7db5-5fd5-45a2-91dc-1d65a2a936e3", "comment": "Malware payload (Dridex)", "value": "012e7f66ca267ac5e633c8ae23b87b82", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896821, "uuid": "8d374770-3840-4f1d-8aee-a9f38fafa9b1", "comment": "Malware payload (Dridex)", "value": "198dd74a30600e239ab91d8a22db85c8a567ccdce3959b6963db6d46e68dbb7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896821, "uuid": "78120274-6dc7-4d5e-b8ab-0b4768fd3a0f", "comment": "Malware payload (Dridex)", "value": "de5ce2c29fd24b89d98dbed8ea0cbae43495c1c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896821, "uuid": "411cc7b6-b7da-4bfb-8cfe-954f16f40c48", "comment": "Malware payload (Dridex)", "value": "f0d6eb84a786a2449b025023c82ba3f341b70bab569100f5df07d2ec8ced645e48348f3501b2bf20ad268a7c2cda7012", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896821, "uuid": "695d3685-49fc-40af-95d5-6e793b22110d", "value": "FEF3AE93E16FD1E4F6234A3040F5F47B7A7C248B86389D28C7408E7E95EBE29C06E615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896821, "uuid": "71210518-c645-420e-9804-757deadc9a1e", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896821, "uuid": "814732f0-2a41-49f3-a5d4-6f8fa63f4cfa", "value": "3072:W3b4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:W3XvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896821, "uuid": "8ea1dcc2-03f1-4aca-888f-6261847606b0", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896821, "uuid": "1b0d72a8-4ead-4bed-8c4f-6b092c67b935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896821, "uuid": "c09d561a-90ad-4338-a81d-10404a640999", "value": "012e7f66_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28d5cd1-b3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915770, "uuid": "ef463912-049e-4ac4-b5aa-28f8539d61ca", "comment": "Malware payload", "value": "1f9126582e8abcf38b2111fc56c837ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915770, "uuid": "570b043b-13a1-4962-ac9c-c3ea636ac65e", "comment": "Malware payload", "value": "1990bd65153311cd1df0b2ae5300686d2936b2ea0015b98e86b4aa1a028ba6c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915770, "uuid": "b5458cb4-dff3-41f1-bdf2-ae0b6aad6dfc", "comment": "Malware payload", "value": "20c89a10917b93b89dfd0a05a255407c8d273737", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915770, "uuid": "32644170-1b1a-4384-887e-81ca989c89ec", "comment": "Malware payload", "value": "73a3d9afc03ca112f6e9c26313d68ce153731ecf68b266985dde245fe83e82d48cf8b724e192c615eeb0dfc7eda31cee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915770, "uuid": "1368132b-fe37-40f9-9e8c-206b45a48429", "value": "1B33F1C65A13F6C6C6ADDE67045263E4639FC4CC30643CA8682A658281BB198D4E7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915770, "uuid": "2bcd5b3d-f10f-4c63-87a8-462b8c4fa719", "value": "768:ko4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7STZK84yg:oeKCVQbp4LTaI7ZaiNQMIXd19g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915770, "uuid": "9a63c0fc-071e-4484-957b-7f81c69108a4", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915770, "uuid": "53235a78-e62e-4cf6-8615-5f47642c5545", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915770, "uuid": "0742abb3-072c-4db3-8e9c-4760c58517fa", "value": "statistic-2058580133.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3dcdc0a-b41d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620932522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620932522, "uuid": "55111265-3837-459a-a7d0-45206760c12c", "comment": "Malware payload", "value": "dbf361dac97fb93d87b97ef4abe00edc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620932522, "uuid": "62d3a4c6-2aa4-4d93-b8ea-ecf37ba05ddf", "comment": "Malware payload", "value": "199d33993f8ac10fa3227149815fbbf5d647fd549482f966ff8aa91ff75d8371", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620932522, "uuid": "dcea8ca0-93ae-4c39-845f-d404498e478b", "comment": "Malware payload", "value": "334b0a7a8b615983aab3ee8e215d67b25a8b289b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620932522, "uuid": "91e80e9a-5b61-4f52-9684-6deaf04e1de1", "comment": "Malware payload", "value": "12ff9851047c1c998d1370fca576913eecb43c0fa4cccb309397677e2e2e7529e788627b5a7018fb0444512b4135d186", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620932522, "uuid": "ccb35b83-2e03-4b1e-8072-e3684c39555e", "value": "34F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620932522, "uuid": "921ef308-e4a2-40b8-96bb-b83429e14a40", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620932522, "uuid": "f59ace28-c9b0-439e-803d-63c8a341b3e6", "value": "3072:89F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:89F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620932522, "uuid": "e4ade126-304d-4221-927e-5704c71cb387", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620932522, "uuid": "5bb1be65-d871-471d-9531-bd65771728dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620932522, "uuid": "f9a2b3a7-8567-428e-9573-d8445087b4d5", "value": "dbf361da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d1b680-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872504, "uuid": "a686f31c-801f-4f4a-8326-c1927c6ff5d0", "comment": "Malware payload", "value": "7abcd0a70c64b7881d9847e0b9664336", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872504, "uuid": "c405e5b2-d670-4a04-9533-af4d1bf32a38", "comment": "Malware payload", "value": "19a160df72fa11c4787550c8a7c89802ae020c1d97185442816365cf533823bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872504, "uuid": "0d301703-8849-43ab-86fa-55715d587acc", "comment": "Malware payload", "value": "f19141bfabdb151d98ce6d0e6339b77f2ff9ebe4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872504, "uuid": "b6b1c95f-261f-4681-a151-0ad57d710c88", "comment": "Malware payload", "value": "3f65f96cf890174beb6403cc495d1f16f6a8c286da7f4c245342ab30eba3bc6981017ee585423c17d584f8069a9156b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872504, "uuid": "a8b601df-5ec8-47ea-ae8f-58ed585606c3", "value": "2C3302F1D603B5ACBA03418D4EDC5E2B523742709B598DB1C58DEFC2D23971A0F90A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872504, "uuid": "5ccb84d1-12a9-4ed7-8199-55b9f4e00cd3", "value": "1536:+S/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WedM2:9XKAXh3TCdOi+KSZ4Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872504, "uuid": "29beb5ae-6c49-447d-a300-e0d132b5f1b2", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872504, "uuid": "9ad96f48-79cb-4b2a-b6c2-beb3b1dbd083", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872504, "uuid": "c5af3053-d974-4ec0-99a1-d77c3c492eaa", "value": "statistic-1491059326.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4a6550-b3e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910012, "uuid": "1355d603-c8e9-4d8d-8983-983e06b97117", "comment": "Malware payload", "value": "3edd7804a43e68530fb2dd405fe5e9c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910012, "uuid": "93fa2c8e-e893-45a4-8765-1954ac38434e", "comment": "Malware payload", "value": "19ab0ee6f634ad2af68cecb5fc69ed6c5dafadeedd65eba09f4845a5f455855c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910012, "uuid": "4990253c-da9c-4890-969e-1a61cc922052", "comment": "Malware payload", "value": "a910ecdaa5ca571017a4d3433e0cc4e047100831", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910012, "uuid": "18ee446b-111d-4abd-a723-d3feee4d9110", "comment": "Malware payload", "value": "37d327a04167f440c7424875485953507f6f1daf3a164495f930e2b437e1facf8aa1d8f612538f76cc7281640f36c8d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910012, "uuid": "3ac6faf9-1d58-4154-8e80-2ef8e37c5879", "value": "DF3301EFA014BEB7C1DF93005FA65B6116FE7A18D070A158836AC6F5E9836C3803E4D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910012, "uuid": "ce7c08ef-a901-4a30-966b-1de550aed16d", "value": "768:Uqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/Ld9l4Ox:9xTuDqsF1Cnc3P57oj2+nC6uxkLd33x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910012, "uuid": "46f0b329-cd17-4186-b610-f0bd0ad2b20f", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910012, "uuid": "6cd23ba7-8843-42e8-ac14-dbf44d97fa9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910012, "uuid": "13a1bfb6-0dc9-4835-9f3b-1c8bfefd9361", "value": "catalog-1678852087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcc75c3-b38d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870480, "uuid": "a61a923d-a019-4610-b171-4f1bd0428120", "comment": "Malware payload", "value": "1ff27f3d05c162199a6ea0c74807749b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870480, "uuid": "186433a7-426d-479d-909b-476b568bc97c", "comment": "Malware payload", "value": "19ab5fab9cc1142f86c89bc00353669dc8ebc8429a080403edb57408d5b3b735", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870480, "uuid": "a77bf938-5c23-463a-baf5-66d5057807fc", "comment": "Malware payload", "value": "bc901eec699b7ae8663fab0067135fa927844925", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870480, "uuid": "e431203d-6820-4507-88e2-8b5429448c4c", "comment": "Malware payload", "value": "1a0b80e4b24dcc8c8ca483de7f1597caa440c43e4136341d36d5d6676fbf077c242d462b8030d3add6fbde9c91484f4d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870480, "uuid": "6cbe317e-5bcb-45f4-9feb-1cc6168dbe09", "value": "6533F19433FEE510D5B2C2A090D265863B4B3D914D7D9DEA0DD8A5B63F520B0CFE66C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870480, "uuid": "4cc8ff92-d485-4bd5-bd35-ebaec268f2e9", "value": "768:e5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJccI5g:e/czJJSI7r3Pwh8Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870480, "uuid": "e38fa45a-bcc6-4772-9757-85a509b0c7ce", "value": 51594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870480, "uuid": "f46da760-7517-4623-a5f3-f17098e898f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870480, "uuid": "1fc06a3e-cd44-49b3-8d94-cb4c3ac88bca", "value": "diagram-1942151907.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fbf324-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872910, "uuid": "f8db3e5f-aefa-4d38-a270-e1c08110a40f", "comment": "Malware payload", "value": "8dbaf752cf596b5f74b08d931eb23636", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872910, "uuid": "08e9185e-cead-4de6-8201-144ad6c01148", "comment": "Malware payload", "value": "19acfd02d1d4c9dd4ca1b0beb1e6671c1fab141ed4b27283ab3959c49dc79e92", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872910, "uuid": "042bc99f-86d6-469c-b7b9-cc0898c5686f", "comment": "Malware payload", "value": "d021dbb06eeb8759fd87d0bc63963bfb8638705c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872910, "uuid": "fdcfb0c1-1e22-4bf7-8120-99e6b61491e2", "comment": "Malware payload", "value": "8d1589d14685d082c57b9f6d1c30e73c1a051758be85f88b1223ed6cab09bd773a2c8edaa9b96076ee8b46772229769e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872910, "uuid": "47907d14-49c1-4eea-84a0-9c222ea8fb72", "value": "523302F3D602B2ACB64381494E8C5B47923B817067595EB1C21DEFA2D33D7170B52EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872910, "uuid": "ba3b155b-0b92-4936-ac71-feaf61bdc081", "value": "1536:Pf/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBCN:PXKAXh3TCdOi+KSZ4WcCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872910, "uuid": "d7f88385-464f-4815-b3c2-39b31f99b7d7", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872910, "uuid": "4f5dd6c3-b5a2-45f2-ba9b-6212e3ad8048", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872910, "uuid": "a0d167c8-b06a-4304-a937-f6f24598238a", "value": "statistic-1792852801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913dea2e-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867181, "uuid": "e20c92b0-0df0-428b-a6f7-72718d4c055f", "comment": "Malware payload", "value": "e7937a429f09efeb3ee9e49c9170a394", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867181, "uuid": "898e7968-e770-4cb0-9d50-658a45dd391e", "comment": "Malware payload", "value": "19b73bfc77c48b9319c754fd771d65859f893482e603e2e069c9b17ff32ccdb2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867181, "uuid": "4dad25e5-bfa6-4775-9bff-9e7f90af1c79", "comment": "Malware payload", "value": "c5f6af5e6752c629c12209a28fea73b41b06bc64", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867181, "uuid": "e2d44f22-f0fb-4bfb-88a8-2ddd271639a8", "comment": "Malware payload", "value": "041bec744c444faf62afd8001318789714069a7c61b4f84662f1b62ee1da400e8a0b22f3522f6b2c91bfdbc6ded0b93c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867181, "uuid": "0bae36d1-99d9-4d27-aa2a-e8111e4a97cd", "value": "0F33E1C4EF97E428C7C373AABC842FA77FB70264148DE1995BC2319C0196D67161426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867181, "uuid": "96a98c7c-ecc3-4e0f-a5ac-a13c36ede6f3", "value": "1536:ZAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGV2X:upoAnd9gucKCoGVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867181, "uuid": "4827ea62-81da-43b9-bfd9-f01036e82907", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867181, "uuid": "2f4d9c72-5d79-47a4-a835-df076c565446", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867181, "uuid": "8540928a-aeec-4268-868d-adc1dbc15928", "value": "catalog-138834695.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f08e0c-b3d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620901850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901850, "uuid": "d982cf67-4cdd-4925-beaa-7819da0447a2", "comment": "Malware payload (AsyncRAT)", "value": "0ab7390d9f14e1fb11758ee3ac8db43b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901850, "uuid": "a625a4fc-b13f-4eab-9e95-77f1ffa778e8", "comment": "Malware payload (AsyncRAT)", "value": "19b94a06c11b89d6083bd82f363eac6a6aa2dc63582df4833a374fc7347a6eed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901850, "uuid": "2877bf98-3161-4e31-a01d-e458019dab57", "comment": "Malware payload (AsyncRAT)", "value": "e8707360063c4cded77a609f32c101a03afc8cc7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901850, "uuid": "6866e4c3-475e-4789-958a-8075885cac88", "comment": "Malware payload (AsyncRAT)", "value": "5a939a1147a70c1e303ce0b4f50e86c6873fd9ef180b63efcfcc903ff754ae823633f886f44288393fd2bce07020aeaf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620901850, "uuid": "b62c5911-c45d-45e4-83c1-7bcf66d188b7", "value": "E5233B003BF9812BF2BE4F78A9F22145867AF2673603D6491CC442DB5613FC19A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620901850, "uuid": "7447afe1-ee67-4ead-b217-685a9b5c9623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620901850, "uuid": "5699a131-d88b-4363-aa19-fee095302920", "value": "768:auwCfTg46YbWUn8jjmo2qrZaouqelDZPIbmI6b10b19krmGtl3f3ju725At1eIBc:auwCfTgp/2iLOSbmJ+b197Ml3fzTuLeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620901850, "uuid": "7080fd5c-e0bd-492b-8eb3-af35c1f1a17f", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620901850, "uuid": "3efa5e86-57d7-4c50-ae9f-6ba73a043436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620901850, "uuid": "a6e7e550-46d2-4ac3-a13c-06e801ca326e", "value": "03_pgr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b3e201-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868472, "uuid": "e8e07e16-ffcf-4772-ac4c-98dcd438f54b", "comment": "Malware payload", "value": "17ed2fba6ead76529ae924082b9a25fb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868472, "uuid": "e3e54703-ab90-4c2a-b415-c9dea0abb25c", "comment": "Malware payload", "value": "19b9fd82aa4b5318074f638e67ba4132b64da4a2a65a3e4dafa94e0211ba2b26", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868472, "uuid": "e98728ed-d58d-4f9e-a35f-f18440086ac4", "comment": "Malware payload", "value": "9d04255bbdb75d2b7a18947f85106e96214f3e45", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868472, "uuid": "e2594308-1516-4514-b2c3-c94095e65a97", "comment": "Malware payload", "value": "8ee5d5e2755c84a091dbf041cc0dc0b9ae8e2ec4caa8fa889b9efc5c6940e2321ff50b1ab18585cc50b565431399c3ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868472, "uuid": "d4a4dbb5-ce98-4e7f-908f-ee3392b4acf0", "value": "4633F1859F57F418CAD7737BBC482FD77FAB1224648DE0945BC331DC0296E2626242BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868472, "uuid": "7540f525-7a38-418f-b1fc-cf1242317ec0", "value": "1536:wAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiMy:rpoAnd9gucKCMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868472, "uuid": "d10c37d1-68d2-4054-a17b-2c7d23c0d121", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868472, "uuid": "b2c76da9-8d5d-4a21-93dd-d5ec082227a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868472, "uuid": "2f2efa8a-ea2e-4509-96ce-02b81704b1bc", "value": "catalog-439696328.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad15194-b38b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620869747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869747, "uuid": "fae8161d-5840-4ddc-bf1a-82c1aa38eac4", "comment": "Malware payload", "value": "830c38dc050069044a3359b7da032b4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869747, "uuid": "67aeff82-f546-4c02-b258-3d2707255e04", "comment": "Malware payload", "value": "19d2f575c544fb0bc7a3cccbfe35ade1e3435e6190a61bdeb1fff5e6ea4f1283", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869747, "uuid": "3556fcf5-cb40-46a2-86a7-a8d674de8b12", "comment": "Malware payload", "value": "01607da9d6bc57ae5a62e85205124639ec1190a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620869747, "uuid": "9804d835-8f94-40f1-8d10-05047ad98d79", "comment": "Malware payload", "value": "1d6cf0600ac4aacf8338437331e19b252faf4de74a749a7717f0e47b12b925220b2bd107d30680b846b5ff74820ab877", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869747, "uuid": "71f13005-fda6-4a5d-aab8-4960bb73c674", "value": "0633029673FAA900C5F1C2B0A4E2B588374F3D918E7D6DDE4D8894793B920B1CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869747, "uuid": "4acd874e-ade0-4f54-8824-bf1fcbecf1f4", "value": "768:l5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJo/:l/czJJSI7r3Pwh8r/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620869747, "uuid": "d89fffab-b8a1-4274-b7e7-99a6db32ffc7", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620869747, "uuid": "5da40524-5c56-4df4-82a9-be7161d5095f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620869747, "uuid": "bcf9340b-a3bf-42fd-8583-388b018eddd1", "value": "diagram-1391477905.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931e7578-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868043, "uuid": "b91e5521-ceb2-40fd-8837-e9962e742c1d", "comment": "Malware payload", "value": "b5cfc05099304a409886a28a6c0fbb60", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868043, "uuid": "72ffedb9-a12b-4d92-bc2e-e32e19339962", "comment": "Malware payload", "value": "19d995d0bb04218133d3bcb22fdecad9a063e671302691c162b94da5197defb6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868043, "uuid": "4126e449-2652-4205-91b3-9c87d42ae639", "comment": "Malware payload", "value": "c170333615b2c0982fe615efa9980f699813760f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868043, "uuid": "43f01efe-558a-4ab3-9dbf-b30b035e78c9", "comment": "Malware payload", "value": "182296e662d587a5c83920a26b44214389ba91c7c7f738c5c3e68b4d0ebe55d1051e90b38deeea93585c68d15db15b68", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868043, "uuid": "1719cff3-41b0-4731-b6d6-1f799560c758", "value": "6333F184FF87E428C7C273AABC842FA77FBB0264548DE1945BC2319C0196E27261426E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868043, "uuid": "dc824818-e250-412c-a737-7cfae04498b2", "value": "1536:VAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHioGVOk:SpoAnd9gucKCoGVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868043, "uuid": "0fb49140-b9d9-4f51-8ccd-41e211f1418d", "value": 51573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868043, "uuid": "aef3cedd-773f-425a-8b3f-7a160448c0dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868043, "uuid": "444d3e62-9e33-4c37-822e-c699aa53c9e0", "value": "catalog-206373561.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552761e7-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867510, "uuid": "1c344d83-62f3-4932-aa8d-dc1edfa83001", "comment": "Malware payload", "value": "c54193a58f29aeea0dcef112b6898d8c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867510, "uuid": "70a4ae60-b990-405b-adc3-d8b82b17cabe", "comment": "Malware payload", "value": "19e2211aa2f915e65fbbe3cd6fe25c6873b1929caa86a03527f253e41fc8aa45", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867510, "uuid": "c92b93c2-43ff-4879-92b2-69fcdadc8ac7", "comment": "Malware payload", "value": "e79b8c401fe4c52e2895282f4da236147dd317c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867510, "uuid": "1d822f6e-0b46-42be-bbb3-d0a03278bdc5", "comment": "Malware payload", "value": "1c1e5ddca0acf8e511d9e4ae9d2b4c9f4a0edb19768448e798684dfb7447e9a9928f95fbf82f097cc332396eb13b751a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867510, "uuid": "b2a80262-f233-467f-bac1-2afbf4b077c1", "value": "DD33F184EF5BF818DB82737BBC892F977EB70264648DD45917C230DD0292E3766102AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867510, "uuid": "6f289054-f511-47c8-a869-1ae31da80806", "value": "1536:UAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiqz+VP:HpoAnd9gucKC6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867510, "uuid": "51211c2c-84bc-436d-8632-f5cd173aae6e", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867510, "uuid": "6c6418b5-7016-4ae7-ba19-e9e368398ac2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867510, "uuid": "4461860a-7ff4-4040-b396-603066f356e8", "value": "catalog-1655477500.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61af3436-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874403, "uuid": "f8fbc712-5c1b-4abe-8695-11679a37fc70", "comment": "Malware payload", "value": "da0814aa346d9d0fc83b5a08d6618fe8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874403, "uuid": "8d0e04f6-b81f-4ea9-aecd-f1b8fb58827d", "comment": "Malware payload", "value": "19e8ba79ff7cb5a7383211ddd0bd1e3eda1843fc3610166ea35de4957e5b9672", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874403, "uuid": "f10a7933-b12d-4d92-a790-b84697303ddc", "comment": "Malware payload", "value": "626db11a8d327cf2ff7e479b179a07828917d616", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874403, "uuid": "8928acc2-9fca-4347-b92b-17073b741958", "comment": "Malware payload", "value": "31e01757b14c150d6f5030f64ee07e00bbf8704af73d6d78a7386900fc8effd10a61c278e668d7f0b9b0cf653fec1126", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874403, "uuid": "adb674b2-8fe1-4ee8-bce2-c3285e3fb50b", "value": "853312A6D203B2BD7143C4898ECC1E6B523B813055689DB1C52DEDE3D23C31E0B53A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874403, "uuid": "e89510ba-988d-4948-b43f-c77ec0b53f1d", "value": "1536:j/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeI0M:DXKAXh3TCdOi+KSZ4Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874403, "uuid": "28d85edc-4f5e-4951-8c1e-e953fab77087", "value": 51598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874403, "uuid": "0caf8b94-2188-45e3-9726-e64ea08ecfb9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874403, "uuid": "e65deb7d-e8f8-4dc4-808c-6ed66f4b6f65", "value": "statistic-85151631.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3551e445-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910406, "uuid": "9942a384-f08d-4859-8cdc-b9e5198b211f", "comment": "Malware payload", "value": "f967b1515795ab3155e930917933618c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910406, "uuid": "92b72889-e100-4edd-87f6-5a3e0e15de95", "comment": "Malware payload", "value": "19f9386be36c5a6d83741c5eda9ad8c731c035f000ba19bf26317af7467655d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910406, "uuid": "e2b82feb-9699-4a08-befb-c52c41ed8ee7", "comment": "Malware payload", "value": "a8395e78e5f094dbf527698499f5b1c1781c37a8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910406, "uuid": "cc16ef2d-08fe-4593-857d-1434284b791f", "comment": "Malware payload", "value": "0ece2cd1a9af7c7073b83c8fd0f7dcc199ef8998b0a56b1613425e93d0ae6d42f30faa09f0ed6fd3f0aafd1ab3ba46fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910406, "uuid": "70430ed8-d455-4a5a-b989-6f2b50a87825", "value": "0A3302DFA014FAA3C19B67015FA9D7A206FC791DE270D158835AC6F5F5C35C2813A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910406, "uuid": "baa138c1-d064-4788-9c2a-e445f1da013c", "value": "768:Lqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7lL+:OxTuDqsF1Cnc3P57oj2+nC6uxkL7lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910406, "uuid": "f7b3d81b-336b-4949-b460-a04280cd76b8", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910406, "uuid": "6205966e-fbf0-4c7e-a964-c8e3b6ba2878", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910406, "uuid": "9a9ff7f5-e36e-48ad-843a-eddc2c87d9d2", "value": "catalog-1977979364.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57dae8d-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872825, "uuid": "1d7754ab-a61a-4fda-96d4-8ad2b7485c00", "comment": "Malware payload", "value": "2d0ecb00b05f00fabfad20c7757c5058", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872825, "uuid": "52a805cc-6704-4694-851c-f0d59f1abd41", "comment": "Malware payload", "value": "19fe5ae1801b1cbeafec593fa67570daa697ab5b9ae4407089a4dfdba2a5e6e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872825, "uuid": "e346c069-ad35-46ec-ad47-dc59d34f3e73", "comment": "Malware payload", "value": "c952b074724d44f06cc34e0ec3d79efaf1581d94", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872825, "uuid": "8c34178f-2e36-4bcd-a78e-5e6a7a24f2d7", "comment": "Malware payload", "value": "aeb65e70868ae8b1057cb6531176845f9a7139a5bc169796e235777ff16b75061401e194e59d7c5cd4733d4b2ea307e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872825, "uuid": "3e494eb6-fcc3-4f77-991a-8550e7a38cb6", "value": "BE3302F2E682B5BCF542C1894ACC5A1B523F83706A2D4DB1819CEDD3933D71E0B5169B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872825, "uuid": "fba305ce-1213-44d3-90c5-af72bf133266", "value": "1536:oV/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeiC:IXKAXh3TCdOi+KSZ4WzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872825, "uuid": "8d3b3c62-2f80-49a1-a83e-6b042a7a60e9", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872825, "uuid": "6e16009d-ddda-4bbb-b490-e224d7a84036", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872825, "uuid": "001ad263-716c-4474-bc3a-f88944c5ee8e", "value": "statistic-1728339631.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f80b46-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867003, "uuid": "fa1dc8c2-2801-4be5-a393-b3d6edd0a577", "comment": "Malware payload", "value": "b2a780bb504aaeb6206a2bef6301e721", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867003, "uuid": "dd4e09ef-83f9-4168-a153-f363d2cffe89", "comment": "Malware payload", "value": "1a011802ee5435e6f0e692a41f0ff6a5708cfdf4aa34f9935ef02a1c935e5112", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867003, "uuid": "f0cfc8a0-e682-4aa6-8cb9-dd9e67fee89c", "comment": "Malware payload", "value": "54deee681a90ac3c742192d3e01e5fb985f44e32", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867003, "uuid": "ac6c7728-9c4e-42b1-bf9f-fe1fbb126484", "comment": "Malware payload", "value": "65b00e59faf8af7eded94376900939e5f77153c487a8ef8e636543ce6378e2d0a79f81f0f7212ca8773aff145bc108a0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867003, "uuid": "74bad1b3-cede-416d-86af-f94835832a73", "value": "7533F1C4AF57F814CA93B3ABBC842F976EA70224758DD1955BC3319C0296D3316143AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867003, "uuid": "a524b576-a7de-4cc9-806f-2c5129c4e228", "value": "1536:2AKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiaP:NpoAnd9gucKC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867003, "uuid": "f59ae86b-785c-4a3b-bd26-0801358e5f5c", "value": 51572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867003, "uuid": "50d1bdc8-10a0-44d6-98fc-bf39c3842842", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867003, "uuid": "5c506b1b-c4b7-43d8-9167-536d7c986331", "value": "catalog-124477644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4e6ba4-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909555, "uuid": "5d3cf69d-1155-4d9d-b5df-5e92d27f0d53", "comment": "Malware payload", "value": "a172dd98cd05d9e2b1e5ab45e2bcf074", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909555, "uuid": "4649d216-812f-4914-8366-b9c501e234e9", "comment": "Malware payload", "value": "1a030abeb48e4d4160b04cfbd8a04aebb5590ac2de517b36748e5b483894efef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909555, "uuid": "020ae364-435f-4b15-bea9-15168eff1f65", "comment": "Malware payload", "value": "2da167a8ab145d6afb4f284c2fb486857a48f8a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909555, "uuid": "5f8962da-df6b-43cc-850d-397d692cbde6", "comment": "Malware payload", "value": "993397efda77119ce9366563f3ad52fe53687390078c433ec5980bc9df7780640a85cdbddf0f250f778e8241e51d333c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909555, "uuid": "dcc89e76-3220-4146-a4f9-ea99ffa64524", "value": "1B3302DFA014FE67C29B53015FA58BA206FD7949D070E658C72AC1F5F9835C280399EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909555, "uuid": "67e32100-c745-44e5-8765-5cd36caf2612", "value": "768:5qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LpDvN5u:ExTuDqsF1Cnc3P57oj2+nC6uxkLFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909555, "uuid": "bac07333-de57-4811-89b6-dfe9b2333241", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909555, "uuid": "c1b00091-e89b-4c74-b3a2-af3a31ec49fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909555, "uuid": "844c510a-b672-4494-8dc4-6505785e1c15", "value": "catalog-1318949225.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659dfed6-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873550, "uuid": "1c78477c-cd87-4be1-b101-c7f87a22ec79", "comment": "Malware payload", "value": "d3a2e7a029cebf5182e68d2cf8c9afa1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873550, "uuid": "69c38a1c-2583-49e1-91bd-a95926d6c03b", "comment": "Malware payload", "value": "1a13fc0a7bfb4dd9bc5155782c96d679ff767acf5fe389ed720c9e49d6f9e3d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873550, "uuid": "0096a12f-9f48-4fed-b765-60b4d33ab03d", "comment": "Malware payload", "value": "9b12e3beee040682181a049d6dda91473a7e52e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873550, "uuid": "b979b1be-1600-4e0f-8e3c-7648ded0b190", "comment": "Malware payload", "value": "6b1adffecc3c7d99b111e48bebd8556de6a04220691461215c80c307c5df6538b69cd5501e1372100f438c877e776150", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873550, "uuid": "1fdf8cb6-3d00-435f-8244-b70af402218b", "value": "6F3302F7EA41B6BCB543C0C58ACC6E56127B8170556C4D71C11DEDD1633E30A0B61E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873550, "uuid": "756e9254-3691-4a72-a120-dbc2bc27e552", "value": "1536:9C/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeUu4i:IXKAXh3TCdOi+KSZ4W/7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620873550, "uuid": "79273262-e338-4372-b9f3-ce772aad45d4", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620873550, "uuid": "b94969e7-e55d-49eb-86ae-d581910dd117", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620873550, "uuid": "14eb09ba-c399-49a7-bcbc-5ec3de9b16dd", "value": "statistic-2109743521.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7741dbc-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912020, "uuid": "cc1bbc7b-99da-4af4-8975-25074d1f7673", "comment": "Malware payload", "value": "feab171b8a5a0c3b69b918ada40580b7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912020, "uuid": "14f06010-cbca-4803-92cc-8276b7ed5b4a", "comment": "Malware payload", "value": "1a16e6c6d69be4d1d6a14f3f98cbf1be29ceb973aaf3c711e05a63b546dd0808", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912020, "uuid": "740e13a1-8a61-44e2-a5dc-8346a3230d16", "comment": "Malware payload", "value": "de594aaaaa8b3014aa37fab47b7658d38f22e350", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912020, "uuid": "e4b10f40-58d4-4fca-9f63-eeaa124c8bcb", "comment": "Malware payload", "value": "3be20444cfe22628a5fa94e6f96650ba5e1e4fa91348b6cb47f51a93aa1c5c65c09c10eed1ffee4b55a08c52f1473cc8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912020, "uuid": "9bd853a2-c047-40c9-8a68-b137446dd522", "value": "4833F1D232E6D23AC4D504F6F51B5EC552BB8E8CE430E0D11E5FCA0122E21B6ADE264F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912020, "uuid": "15a84906-6d42-403e-8831-5b0019f96d36", "value": "1536:1EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwRKsN:qnBrX5Eg5Enjq3axWIfkNwRKsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912020, "uuid": "636a6f25-4fb8-43f3-816c-13c542b9088c", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912020, "uuid": "d098cc2e-28db-481d-8365-5d8a35d2b6b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912020, "uuid": "bfb161fa-842c-4b9e-9cf2-c1dfe3478c7a", "value": "diagram-1252619939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e0250a-b3eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911046, "uuid": "91ee30e1-43e8-4f4e-a344-c3da977f6150", "comment": "Malware payload", "value": "028ee8b02d7053dedf2fbcc4f922c299", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911046, "uuid": "329dd51f-285a-4dfb-ae19-65b618aaa716", "comment": "Malware payload", "value": "1a2b23479290a2b2876ff21413afd0f0630d7585e425a0efb929c6039c6bc026", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911046, "uuid": "980d6205-2155-4d40-9431-d3f13e2e18c1", "comment": "Malware payload", "value": "6663b67c556e15b96c9081e6ee3af3f24afecc67", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911046, "uuid": "abaae8a4-f24a-4fd7-8929-254166bff562", "comment": "Malware payload", "value": "5c63ab0edcb255e9312b6f0e0b0d6e74b709e89259423b05266d398f5483fe644d86c52e733d3561831dd0f385e15d27", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911046, "uuid": "b6f3d5d0-a5ff-464c-a121-ae23065813ee", "value": "7E3301EFA014BEB7C1DF93004FA65B6116FE7A18D070A158836AC6F5E9C36D3803A4D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911046, "uuid": "9e2d8a9a-5bd3-49ba-a56c-4b60a6d8dd5a", "value": "768:Zqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LdoW4O/:kxTuDqsF1Cnc3P57oj2+nC6uxkLdoW3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911046, "uuid": "3fec887f-047c-42c2-95e1-4eedb979daf4", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911046, "uuid": "4f75cf57-4a4d-491c-9917-b2772c9d7dc6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911046, "uuid": "b3c07bab-3efa-4e43-ae86-264e98e58b85", "value": "catalog-536453236.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a743164-b3ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620910334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910334, "uuid": "496ed77b-a3a1-410d-8ba9-8da0352e25e6", "comment": "Malware payload", "value": "9523e0bfc6c3c0ca38f188bf6db1e557", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910334, "uuid": "81694ef5-a7b5-4092-878b-8b11a8116b7e", "comment": "Malware payload", "value": "1a407f15a0dd4bda8a3ad19dab538daae57568594f7bfdfc0988057267e8c624", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910334, "uuid": "403c016c-ac7c-40cf-affb-5a58786adc7c", "comment": "Malware payload", "value": "63bff810f2aca0e87f70927f82cf36c533638cd6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620910334, "uuid": "c441db77-96ad-4e8f-924a-eb46bdeef9fa", "comment": "Malware payload", "value": "49b426858c368ec0dd7451ae31b3e47e36631c9405e3309c61f1b92c348ecaa7594a6291463bac83307b339bbf73c3db", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910334, "uuid": "c11c092f-82f3-408b-9f74-8f1207c2e2cc", "value": "DD3302DFA014FAA3C19B67015FB997A202FC7A1DE230D059C35AC6F5E5C35C2C12A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910334, "uuid": "9ddd754e-3069-4d9d-84f7-5d9386bb2ba4", "value": "768:Pqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L7cLR:CxTuDqsF1Cnc3P57oj2+nC6uxkL7cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620910334, "uuid": "10cf371d-380b-43ce-aef8-0370f618f452", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620910334, "uuid": "04f8a01f-0b89-4c64-b701-519cc7946c43", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620910334, "uuid": "79480052-8a35-4548-8c69-531f87e492b3", "value": "catalog-1930252486.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d5a28a-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911615, "uuid": "c0543b60-61c3-4b56-8ea4-dc27d7397f05", "comment": "Malware payload", "value": "13353d57344cd5a37598bdf4c6ac9ace", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911615, "uuid": "9c2de82b-1cc2-49af-9ce0-9a2c50ad62f4", "comment": "Malware payload", "value": "1a51e700b64737ea03bc125afa0f0554dcf4a044154f2c5ee4c2b7b9b0974554", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911615, "uuid": "1caaaf3e-a35f-4738-92b6-b92c580440be", "comment": "Malware payload", "value": "a6079420c0944c424bc2a59a602c0855059bee6a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911615, "uuid": "07b46aa2-c54e-4ac0-8f04-d8b6e29022c3", "comment": "Malware payload", "value": "dfdd6221c947e3e266e8c4b6726106a01777cb053c21554539fbcd76691ff6fcadcacba854c61ff77fb89dc04ba8de76", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911615, "uuid": "6bf7eca5-c696-4931-be68-f96691d8e397", "value": "963301DFE415AAB7C1EB56014FA59AA306FDB64CE0308628C754C3F8EA835C6853E5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911615, "uuid": "28dbae3b-9a30-4612-8769-093d2f04c467", "value": "1536:UxTuDqsF1Cnc3P57oj2+nC6uxkLiO9YrV:UxTqqsF41j2PxmiHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911615, "uuid": "94d8bc9d-c5da-47ce-9d4a-7b0a1ee99c5d", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911615, "uuid": "c2e9eedc-198c-4a7c-8138-1052c893e496", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911615, "uuid": "476c305a-8b57-4471-bac5-bc4b40edf3d3", "value": "catalog-955964121.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aca9ca0-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913583, "uuid": "56e00d14-98e3-491e-b73b-db4498f6c171", "comment": "Malware payload", "value": "1318c1a578bbd08d31861641b39d97de", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913583, "uuid": "5e17fd89-d6c9-42c3-9c19-ad4416bb52c4", "comment": "Malware payload", "value": "1a5e0ccc562fe9e73d124a0e78907399619ffe8f09f9054f108d1f62583bdb41", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913583, "uuid": "51e5ce48-e69e-483c-920b-30a4907bdb50", "comment": "Malware payload", "value": "2da0d1592c527cb6a0505f083e679f6643c413be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913583, "uuid": "a072e4af-b1eb-4a42-a69b-ba7043fdd59d", "comment": "Malware payload", "value": "802f7fac447abbcd5dc37360f417ea474268bb7885f23d98353a15f6ba33689c083c9c36157f24bd87cc9cc64eeaea0b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913583, "uuid": "a3349ee6-53a8-4491-9fd1-273660e316a7", "value": "0133F2D233E3D13AC0C505F6F5175EDE65AB4E99F820D4D05D8EEA4022D30AAEDA274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913583, "uuid": "c430fb71-f369-4f2b-bcd0-d22c38b94b20", "value": "1536:IEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciMb:9nBrX5Eg5Enjq3axWIfkNwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913583, "uuid": "a347e3a5-5b1d-477e-82b6-f2aa78cc18e0", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913583, "uuid": "767c5de9-e765-4ca5-a0f1-8931e68d085a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913583, "uuid": "d3210c2a-5d81-4f24-a8b4-1c539e71a864", "value": "diagram-420475362.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65d59a8-b392-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872800, "uuid": "6727ec47-0b6c-47c9-bbb4-f1f54ad8046e", "comment": "Malware payload", "value": "6de3a2824a0b66f0fd855d1dfee8c869", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872800, "uuid": "84d8005a-5c72-4fe4-8b48-ad2c659a265a", "comment": "Malware payload", "value": "1a5f26e1f0f1cd6a141339a5693488ef37f0a072c2430c81913945bc1bfb8c4f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872800, "uuid": "118a8f91-ee88-41a3-bc9e-6825f627d842", "comment": "Malware payload", "value": "aed3ab72abe183abe6cbcd30faa7bf19a05dc9e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872800, "uuid": "d2cb9c6c-48d3-469f-8c74-59551d559039", "comment": "Malware payload", "value": "77ef56b798b16fc536c26962381b25ef2ae115606c8e8084ea6164b2238ae7beade9129c67facd704b2d8a0587465cae", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872800, "uuid": "627880db-f24b-41aa-967b-bb131c86898b", "value": "0E3302A2D312A2BCB643C045C9DC1A979377427026658EF2C56EFED1A33D7120B61B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872800, "uuid": "0148f485-2c8d-43b5-b477-a864b500b59e", "value": "1536:v2/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4Wez6m8LiWe:WXKAXh3TCdOi+KSZ4WpRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872800, "uuid": "a9d464d6-6363-4832-91cf-4887d8774f07", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872800, "uuid": "50c68577-8ac6-4319-be24-7218c91978fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872800, "uuid": "e4eea126-b5aa-40a2-aef5-eea1f4c46782", "value": "statistic-1709452341.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2211ea36-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874296, "uuid": "c9a775f3-52d7-484a-99ba-91276eeb95d6", "comment": "Malware payload", "value": "82514e3181b1a3c7730f7fe14830df34", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874296, "uuid": "2b1bbcc6-cd29-44e5-862a-97acff1eeddf", "comment": "Malware payload", "value": "1a61c36cffd96bce09e13f200bf96c015531024cbed0db353577dd58c79bbb43", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874296, "uuid": "9f39c695-d4ea-4a1e-b5c6-6eb1afaf7ddf", "comment": "Malware payload", "value": "56953a571b6600ce67df18b4a9cfb813b9f0b5e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874296, "uuid": "fbde5aa7-da03-4b15-8d0e-675c6fb48593", "comment": "Malware payload", "value": "ab40134db106c706a880acabf50eb173a909b7be2980a209ad913c576c737b603c745532f67ee7e5532bfb05023e60e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874296, "uuid": "a77a88a3-4156-4ee4-b0b7-a9ee48e3e235", "value": "B73312E3D583B5BC7503808986EC1D6E822B836057494D71C65DEEE1D33DB1B0B51BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874296, "uuid": "59b9d5d1-8ba3-4689-af2b-3c2361c67f8d", "value": "1536:F/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeZy:tXKAXh3TCdOi+KSZ4WQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874296, "uuid": "f1b16912-203b-4197-b995-8286d056f8b3", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874296, "uuid": "98efb14e-a668-4bff-ae41-38140649ba79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874296, "uuid": "08d6502a-380f-4a5f-aee5-10df3abc76bd", "value": "statistic-766371001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e0476c-b386-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867625, "uuid": "ad59a1a3-a918-4d79-825d-54acb161b29a", "comment": "Malware payload", "value": "b4b9452ce13c4a1a3baba95e97670340", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867625, "uuid": "b9c8e464-1112-46d9-aaf0-2fcd7c56341d", "comment": "Malware payload", "value": "1a813a146088e2d4fb36469d882faff0b2ecbeb8b93a87f42918e7333fb3ed12", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867625, "uuid": "af578e7a-6942-4ba4-973a-51f41d4ed908", "comment": "Malware payload", "value": "2e1572971ce3ce121c7bff14cf798b348230a785", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867625, "uuid": "a2d5c66b-382a-41b7-bef5-5ee3dedf8ca9", "comment": "Malware payload", "value": "166b9b96f8ff5a3fcea1ed81dd5242136eac707bbb93975c27d945b6e836d524f482fb596e28bf3fa6370bf737e89ccd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867625, "uuid": "45c9d5d1-292f-46b0-a83b-bc6ae4803232", "value": "3D33F1C4EF5BF858CB8373B7BC482FD66EAB025464CEE09597C6319D0296E32621427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867625, "uuid": "c920efa3-3e59-4c39-92cc-d0197290d300", "value": "1536:bAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiHb34C:8poAnd9gucKC7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867625, "uuid": "9ded129a-0f16-4301-99b3-b5ca0b19bc93", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867625, "uuid": "18428a48-ae9c-4981-936e-c63fabeca1c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867625, "uuid": "2d6130e7-4ed3-4988-8e56-bbae1661c0fc", "value": "catalog-1750661717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1e94d1-b388-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620868384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868384, "uuid": "f8081936-8434-464d-a4f3-6eca448daee7", "comment": "Malware payload", "value": "32b2327e3fd87770ecf047d4a4f1e878", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868384, "uuid": "6a1ed562-85c2-4901-85dc-6efd82a6e860", "comment": "Malware payload", "value": "1a899cc3a06a9833d7c521cd02246a98a125ef52b08b95200e0be88baaa1cffa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868384, "uuid": "edfcd0c9-1744-4940-bc60-5e8e19a3cbd9", "comment": "Malware payload", "value": "b289598d62eb57599ef15ecf77e1b6b6bbc31378", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620868384, "uuid": "3169dd06-9c06-4cdf-a39c-94aad301643a", "comment": "Malware payload", "value": "ce53fabea181aaf7c0ba23f145caf6a6d182f7c306b49af606cb481a73b0727e5d32f1d822f3488053117d732bae1f39", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868384, "uuid": "77e9cb4b-fd51-4df5-9d69-dcb6cb17d7ef", "value": "F433E184AF9AF418C78373BB7C882F977FBB116514CEE49466C7318D0297E23561026E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868384, "uuid": "f17bb2ed-d179-4e6f-ba44-cd808a8f8cce", "value": "1536:NAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHijk82YUr:qpoAnd9gucKCg8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620868384, "uuid": "6b4c2178-b86d-4fde-b7d6-902a5bc6d129", "value": 51570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620868384, "uuid": "d08e935f-cf0f-4fa0-a65a-e284062e484a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620868384, "uuid": "3450cf50-5d3d-461a-9333-bfc90c58a2ef", "value": "catalog-37399078.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93449be8-b3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916576, "uuid": "f97457d4-b0dc-4942-a2a3-466f7fd82b78", "comment": "Malware payload", "value": "cedbaf3ae48ae3e302404a4150a2577c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916576, "uuid": "49aeb0e9-37ce-46f4-8785-a5804428f646", "comment": "Malware payload", "value": "1a905301e6870051d25bb9d7f670349b0e5587491c48ef7770012ec108314b5d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916576, "uuid": "c689b3c5-d072-4eda-bd2d-31f996cdabd5", "comment": "Malware payload", "value": "3411409b12b71ffe774761ac41f1117270cba637", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916576, "uuid": "d614374e-ad2b-4c25-9b83-4074a76b8eb4", "comment": "Malware payload", "value": "ca8afa3d7714c515a9ed2f57798ff87d0684e57f14ea2013255705d57157fc7176facbe363b4b44b450cab219f69766a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916576, "uuid": "b4b7f00c-8b42-4dc7-8ccc-ea51b4f9ae59", "value": "DD3302D69B23E9C28AFADB770C5612D4936FD89C31143C59192A699380FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916576, "uuid": "ec207084-81f8-41fe-aab8-ef902c2fbf93", "value": "768:So4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SEjA6FjX:KeKCVQbp4LTaI7ZaiNQMIXAFUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916576, "uuid": "ef445ae7-ca03-4483-bbf5-9e30a4026406", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916576, "uuid": "24f31599-9f91-4ac5-80d6-30bd1d675328", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916576, "uuid": "42fa233f-6f89-416f-94af-a747a8485c8f", "value": "statistic-615075539.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501630c8-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913887, "uuid": "fe078d4f-fee1-4ca5-8198-2b2c35825d93", "comment": "Malware payload", "value": "553eec1ab4fc993d500886d1fcce9021", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913887, "uuid": "29dc6d52-148b-4197-a2ba-6902033e989e", "comment": "Malware payload", "value": "1aa3b4ce3c34bcbe6613bf819ffe7805216e3c597c05c2d58442c4a2bdefdc4f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913887, "uuid": "1e1fb4f0-3d3d-4578-9501-36b24ec8b5b8", "comment": "Malware payload", "value": "df26fff2de46a90afa80962b253eba56faa88e17", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913887, "uuid": "56eeff1a-47e5-48a0-b7c2-2ba8ae92fbd1", "comment": "Malware payload", "value": "e83d41b3407bc129fbc6c6ce04049e31b26523e3eab115668d66f982f8e7417eac4ba155c139d2bbfabb4ec1cf66b74b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913887, "uuid": "1ba9142a-ada6-46ad-9877-b8672dd5f7c9", "value": "543301E233E39239C0C405F6E52F9AD666B7CEC8E530A0D05D8BDA4122D35B99D9170F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913887, "uuid": "f20b4a69-a678-4df5-9913-b48a9a8d4386", "value": "1536:6EnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwb6JBk:vnBrX5Eg5Enjq3axWIfkNwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913887, "uuid": "2bd3cf88-56d5-46ac-84bd-99db7aa30f72", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913887, "uuid": "9780a23b-5378-4081-9b9f-d48df809f7e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913887, "uuid": "92f0aac5-6ca3-43df-9422-0116c4acff94", "value": "diagram-627835203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d71d486-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911762, "uuid": "b01e9a95-2662-491a-b084-229508a22a6b", "comment": "Malware payload", "value": "8d0e19ae5ca2ac831d20020e8f3d40b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911762, "uuid": "5c2c4b2f-f15f-4a1c-a5a9-6abc3924665d", "comment": "Malware payload", "value": "1aa40f22cf1238faa73568098a561905fc3b314430444e3374ac6ace3748dbe8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911762, "uuid": "cb0143a5-8abc-4074-9fcb-2d749daad30e", "comment": "Malware payload", "value": "c5a6da7f399f20399d2a4f73a53bcf0653b9cc28", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911762, "uuid": "acaf1409-f18c-45d3-b5d2-fad93aac9e46", "comment": "Malware payload", "value": "7b53a202e74ab791fad23db4faf6a94e088f0ffd075caf19f506b401a1fbb13f58d4f8b722d467a7af928bfdecdf8e2f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911762, "uuid": "7eec03ef-6756-4443-ae2a-28ba6cbb06a9", "value": "5D3302A232D7C23BC0C505F1F42B5ADA66B78EC9E930E0D01D8FDD1112D3165ADB2A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911762, "uuid": "d3e1719e-0f53-44ac-bacb-de6a22b90f68", "value": "1536:pEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwu24H7:GnBrX5Eg5Enjq3axWIfkNwu24H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911762, "uuid": "0d0a2d8b-2e11-421e-b0c9-1193940fbaaa", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911762, "uuid": "83b674b6-1ec2-41df-bb1e-145f2a2283b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911762, "uuid": "5ca1cc15-6a71-4d94-b9b8-3794d3bdf99a", "value": "diagram-1047571708.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226c4e53-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871290, "uuid": "3a7ce9a2-d166-4276-9bcc-065e8c1b87f7", "comment": "Malware payload", "value": "30b821247c95f3cb9ebae206c7453a4a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871290, "uuid": "6cf75182-bb61-429f-9af7-58fefc849d5b", "comment": "Malware payload", "value": "1aa4dbaa72822bc18040ff894e82567fec84e7fc53ffde2e07328bc2983d266b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871290, "uuid": "ca52d281-5d24-4b65-a33f-39786493dabb", "comment": "Malware payload", "value": "2188a22dea47fd8bfb0ccff29cc8c05b96509790", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871290, "uuid": "7c05f3b5-9a04-4ae4-b19f-f33240b4789b", "comment": "Malware payload", "value": "8ec8f3f7d265be3217be5e28209924999bedc1787ed76c2a286588ab2eafb38bcf5125bce89dfb15afb5eda1a7010bd6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871290, "uuid": "a1656b92-4b6e-46bc-b13f-158397494310", "value": "1433F19137F9A900C6F2C2F060E27699374B3D518D795DEA0C94A5B93F931B4CBE52C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871290, "uuid": "61c3df5e-8135-495e-9504-8571b6b7a935", "value": "768:05G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJWt:0/czJJSI7r3Pwh8R8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871290, "uuid": "75881424-1ac7-4f81-9c80-99c712deaddd", "value": 51593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871290, "uuid": "9c93c810-63cd-4ac3-a865-5e17781d2b92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871290, "uuid": "4a191a54-ff38-48fa-bdba-ab8a1460d6a3", "value": "diagram-562231340.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c72bdc-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911848, "uuid": "8e4171cd-fedc-43c9-9245-d840ae026b48", "comment": "Malware payload", "value": "116827b7c30d1f3adf486a8aed05a527", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911848, "uuid": "37c2e76f-aa54-48ba-a0a0-57bb7375a033", "comment": "Malware payload", "value": "1aaf5edb2511e81ff0e78df80d88100e17c861ca0d076a3c8214765d51d073a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911848, "uuid": "be261263-cd4a-4153-bc8d-c0a3b6bcd016", "comment": "Malware payload", "value": "46ac2301d50731ae50eb02cf6547f932cb8e6623", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911848, "uuid": "283eeb5a-7aa3-444c-9054-32d89da604a2", "comment": "Malware payload", "value": "a141dea1b7b35b5144045482c199dd190c9e7236cfe88665fd76d3b21910caf8e8be6472f940f0386513d47c5c7f0eb7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911848, "uuid": "06296227-58c0-4bdb-a791-cd4dec875064", "value": "8E33F1D132D7D23AC4C548F5F92769DAA6A78ECCE530E0D02D9FDE0122E3165AE9160F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911848, "uuid": "0d9d51df-1b10-4030-b97a-4d0b7e4b1249", "value": "1536:iEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwsnMa:nnBrX5Eg5Enjq3axWIfkNwsMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911848, "uuid": "8141ffe5-3251-4431-a9dc-f5ccbd272ef4", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911848, "uuid": "ae2adeae-4c90-44d9-b0f8-3ac84312570d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911848, "uuid": "cecbc007-a3fe-4b14-86a0-f0a40359733f", "value": "diagram-1116499355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a2a24a-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871908, "uuid": "cd993841-c84c-4503-b3f5-ccc295817bcf", "comment": "Malware payload", "value": "4c7d043bedc197760c257a8ffae9fcc9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871908, "uuid": "55a139eb-1fbc-4dce-85b1-828e14dd3183", "comment": "Malware payload", "value": "1ab470fa186c35b7ca5a06a3ec8111338e9d121a96dd0f8a8ca52d14c22afaed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871908, "uuid": "9ac78864-5aac-43d4-a524-8f317a04d75b", "comment": "Malware payload", "value": "e447ea4b0a81fd7fa84ccebecf84f3a7de982cdb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871908, "uuid": "00352332-d45a-45f3-b48c-af84b2432235", "comment": "Malware payload", "value": "126a5ea88f569e1d1c5860718fa02593d09790e317aec2a4a6b389d64beefea6f5b2990e109fcdd961a1229b90f8efdc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871908, "uuid": "eaf046fe-a695-475a-8b31-3f9bff0fddec", "value": "B63312F2D242B5BCB643844A4ECC6E2F423B817056284EB1815EEFD2923D71B1791BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871908, "uuid": "b057942b-f736-492f-97f0-e6c91f7b1563", "value": "1536:1/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeVu05:dXKAXh3TCdOi+KSZ4Wau05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871908, "uuid": "8b9ccebe-99b7-46d2-baa8-815233343f99", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871908, "uuid": "36c7c482-ffcb-46c3-9508-5fed73b4baf6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871908, "uuid": "e112ce1f-caf3-4e7a-8509-f96b78af4b24", "value": "statistic-103228049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305d43f9-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620871743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871743, "uuid": "f2a94615-b1b9-40d6-9839-9736b7364308", "comment": "Malware payload", "value": "02ac72767bf0b3945dd063a55cf9e6de", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871743, "uuid": "e2a23376-e899-4be8-aba9-003f31420084", "comment": "Malware payload", "value": "1ac383ffae97f909dd7a005e900f2da5347621814445bec323eb0826dcd0264e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871743, "uuid": "f443c61c-5a4a-4091-9b67-2b1e5720220d", "comment": "Malware payload", "value": "e9eb61bb3e9da63085d72fb68c86deeb23a89474", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871743, "uuid": "fd1eedd9-4d75-49b8-b473-026339672419", "comment": "Malware payload", "value": "73e5261313e2fa2a810444991edf9d38d71fafef34d701ea251875f7bb1143ab4708a4722f1980448b4a427be2d43746", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871743, "uuid": "40040d79-7b00-4b5f-8c8a-5d79fd18ea82", "value": "6333F19537FAF60086F182B0A4E1B689274F3D618A695DFA08C476793F931B0CFE56C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871743, "uuid": "42db4700-d08b-4b27-b61f-6e43d9690dc7", "value": "768:f5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJOJE2/:f/czJJSI7r3Pwh8Ri2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871743, "uuid": "ab6de907-8df1-4ad8-b341-15b27bfb3c37", "value": 51592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871743, "uuid": "4390026d-3f2c-42c1-b46b-3dcecfed9d7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871743, "uuid": "d4c1732c-b7bb-4d92-a222-335ab49496a5", "value": "diagram-936160776.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1e6291-b395-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874098, "uuid": "9dd7505e-0d0e-467d-859c-6abb46b3cf8f", "comment": "Malware payload", "value": "50646ef69ad6cb71eca5eba5f142ae8b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874098, "uuid": "c6bd4d1c-6201-4ac8-b183-447e8cae1d3d", "comment": "Malware payload", "value": "1ac5a72fdf35f78bd684d767d66d8804c2d03fa03f26ac104ca8e65e5fca89ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874098, "uuid": "43e2c79c-acb7-47fb-b651-9f1952157270", "comment": "Malware payload", "value": "336d407361ce6fa376fd3baacc7d8598ae289e0d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874098, "uuid": "51565886-2b4f-4a44-9c18-c914e602e6f1", "comment": "Malware payload", "value": "d7df126c43e25c3ff5bc579b2b911b9b6ddd5aa38908506a9ae70abfa5da2d785a80d087592e2d6a905cddcea3ab55fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874098, "uuid": "9e255dd2-83d2-4e4e-a790-0811f40aef25", "value": "D53312E3D583B5FC7503808986EC192E822B826017494D71C65CFEE1933DB1A0B52BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874098, "uuid": "9bb7ad33-377e-494d-a09b-2195aee55038", "value": "1536:T/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeZJ:zXKAXh3TCdOi+KSZ4WQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874098, "uuid": "d78e4a8a-3bae-41f8-ab88-e7ebf711ab9d", "value": 51601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874098, "uuid": "40df2a16-0b59-47aa-95c5-a91f3e0609c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874098, "uuid": "598579c4-d030-46e4-808f-6c62fb48fa95", "value": "statistic-59396011.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2ec1dd-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913939, "uuid": "bfcb1c7d-0ba9-431e-991c-7464709b1957", "comment": "Malware payload", "value": "6747cf32b9262e739eeaced098cb0cd6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913939, "uuid": "17e81f68-7fe9-4874-9e01-06f1986ce913", "comment": "Malware payload", "value": "1ace48ea99ecd006a2b8d8960713b6befd010d6fd884b1fc03b459e69069ac17", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913939, "uuid": "e15e14cf-e747-4c7c-bcd6-f0e0605f6e7f", "comment": "Malware payload", "value": "25699aab94e98105f5f654c61d8c1ccd02b2b54f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913939, "uuid": "7c045301-8141-4af3-933f-ee4f6770c2a3", "comment": "Malware payload", "value": "17177256b0fb2bd57298a69e06dd970b16c885bab4cf0e99db411838a13fdd162b0447b34602221431d21d1340a579f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913939, "uuid": "f4bbbac1-4f91-4a0d-b8ae-4a65e51b920c", "value": "A533F1D132DBC53A80C245F6F82B69DA66A78FCDE530D0D02D9FDE4122D2165AE9224F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913939, "uuid": "561ae752-f40d-4bc1-8c34-c6daaa2afd0b", "value": "1536:7EnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnm:QnBrX5Eg5Enjq3axWIfkNwYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913939, "uuid": "840f84e7-9910-4527-8a59-20d1d22958f6", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913939, "uuid": "9d40b30a-6613-4797-9a76-6b857d298f4b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913939, "uuid": "473d5580-2a62-43b9-828a-4e67a3bdd8f8", "value": "diagram-666802111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6b9d07-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911896, "uuid": "366a3b20-8a69-4528-9731-c366d625419e", "comment": "Malware payload", "value": "84c32fe30d81f85aa3b83750b098958a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911896, "uuid": "2998bf37-e236-487e-8664-1cc37ce9c09d", "comment": "Malware payload", "value": "1adafb8fb6f7d19381c9e9d3161596a9df412f35ba9fb8385d1d0fa64aa570a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911896, "uuid": "80971af1-db07-49b1-97d0-6cf03adab534", "comment": "Malware payload", "value": "4307ceec9ab440d3aaf137c6acf4fa9111d37149", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911896, "uuid": "9130a6d6-cee8-40a6-98f3-7a3d6c41f189", "comment": "Malware payload", "value": "02cde57a786eae8c29e6decbc9f527796870d126774e221c372bbc1700b2cbd7e745c5107fcfe35660e7843b661b51ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911896, "uuid": "24d28787-9de6-4086-bfe8-78a4281e7d68", "value": "3C3301E232E3E17AC0C609F6F43759DD56B78D88F93090D02E8EDA5122D31B96D9274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911896, "uuid": "f42511af-008a-4c0e-a0f2-0b7d289da34b", "value": "1536:fEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweHYR1:snBrX5Eg5Enjq3axWIfkNwe4R1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911896, "uuid": "90a28109-66b4-4889-8fda-d033cad3bcc7", "value": 51759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911896, "uuid": "6da37316-e6bd-462f-bead-f7d12f90db8e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911896, "uuid": "fe84666e-e304-4dc5-8008-6539297a8d73", "value": "diagram-1164309155.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01db2bca-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916762, "uuid": "f33cc342-c0d4-4382-a343-e6860f86b07a", "comment": "Malware payload", "value": "b1f1f19335ee97da60f8c8a03ce684b5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916762, "uuid": "f3ada4ef-591a-4b59-852f-0be72b9cf797", "comment": "Malware payload", "value": "1ae2190c622beea6bb31078fd9c9de2da3fc325efec720afaf86462672ac934a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916762, "uuid": "3097e22f-86c9-483d-8f13-66e09ece92b8", "comment": "Malware payload", "value": "1e32b5a808d740eb68775709e6f9da5d0a8d7aec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916762, "uuid": "fed35ec4-11c5-428c-ae28-c0e0fef0fbec", "comment": "Malware payload", "value": "be74aacc6393bc32aa63bba84ec56c60f4ef42347acd3aa7bb5be2819f828d2b6123562d6fefc09d976b3170e5e7b486", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916762, "uuid": "bedc69dd-8874-4bf8-9b44-cc305ded6d3a", "value": "2A3302D69B23E9C28AFADAB70C5523D4936FD89C31143C59092A299384FF158C0E77CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916762, "uuid": "98f11737-8d38-4b2c-8641-7957a4b913f1", "value": "768:ao4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7ScjA6FTs:CeKCVQbp4LTaI7ZaiNQMIX4Fk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916762, "uuid": "2842cad4-82a5-4c65-9160-adab44d5e2a0", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916762, "uuid": "15068be7-c18a-4e88-bf91-8081e740c77b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916762, "uuid": "76fea640-1e02-4f46-8d5b-e9f55fe4c8bc", "value": "statistic-773877401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fb9177-b3f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913410, "uuid": "e518607c-6a4e-4031-b6b7-b4cc832683ca", "comment": "Malware payload", "value": "1c484b25181613e2293f805533199082", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913410, "uuid": "1aa6f311-689f-495d-937d-86c9af165772", "comment": "Malware payload", "value": "1ae84775ac9c14f90e57de553b3da21f8fe2c2d2d6f23035a11f2647e3dfd36d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913410, "uuid": "c8f73365-c0c3-46d6-843d-4e73b61245a8", "comment": "Malware payload", "value": "237c5fbb6fe757bedfec1f72fd09dc2524dd319c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913410, "uuid": "1229b314-133e-4e89-922a-6db27a5b184c", "comment": "Malware payload", "value": "759f6ec14c5516995acb50338c1419bf91148db060f986826723ef7a3bec3cff31da63350b8572b939779d9e4e72b746", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913410, "uuid": "5af2e87d-ae4b-4a94-8a7c-74ca1182bbb0", "value": "A53302E232E3D17AC4C609F6F43799DD56A78D88F93080D02E8EDA5122E31B56D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913410, "uuid": "365d3007-67e9-4b1d-9641-77da49909017", "value": "1536:GEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NweH2R0:TnBrX5Eg5Enjq3axWIfkNweWR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913410, "uuid": "463a0b23-1fa3-40d2-ba43-bb6e73d02ce5", "value": 51755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913410, "uuid": "571e523a-fb4a-4679-8b21-d6113ee8c29c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913410, "uuid": "61c607c0-1c37-4767-9eef-70e2ddfc3237", "value": "diagram-31125560.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8e4cae-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911891, "uuid": "dbd7ea58-8f1c-4aaa-9729-485c51885fd4", "comment": "Malware payload", "value": "db12d81a8e709adbacb01e27dceacb18", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911891, "uuid": "72d27bf5-e5f4-409f-8f1a-82e9be848d63", "comment": "Malware payload", "value": "1aea8d6b765a1cef79c6d2afe012a380a96492959cf2b09958f4649d6e7d4ff1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911891, "uuid": "41fae140-ba4b-4028-84aa-e94d4bd0be2f", "comment": "Malware payload", "value": "187bc8f979f136785c377f5b4fb85d311eafdc6f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911891, "uuid": "f07170f3-86da-4575-b6da-89aecfcc32d8", "comment": "Malware payload", "value": "1a701ceb438f43707cdb56b3495fa2ac9ce20a37776ced2d0b39be1451c8ae07fd6dd7471cce16f2c2bf1e70fe4159eb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911891, "uuid": "ca9e233d-d0f0-4af8-8f21-1ddcf05ac25f", "value": "D733F1A132D7D53AC0C505F1F42B5ADA1AA38ED9E930E0D1598FEE1112E3135BDB2A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911891, "uuid": "7f0809c9-1f11-473d-ad06-23ad0bd5c3ea", "value": "1536:CEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwa2DAZ:HnBrX5Eg5Enjq3axWIfkNwa2DAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911891, "uuid": "efb60349-d81f-455c-bc60-fcad73f11629", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911891, "uuid": "644c7759-629a-4e0b-b324-f53201310932", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911891, "uuid": "41d74c81-2bfe-4d07-8882-a7ac7fc23498", "value": "diagram-1158970596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573c4258-b3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620915187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915187, "uuid": "bcc388dc-dbde-4749-9067-a66851cf51b7", "comment": "Malware payload", "value": "8852b3e3a00040365d19f4e2e4fe9df6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915187, "uuid": "48628d06-c274-4f22-aee6-063f05345c7a", "comment": "Malware payload", "value": "1afea303cab87b36f2f976b08e4a5e64a597c7a17a1417ea8dfd6be7bd61182d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915187, "uuid": "895b63dc-7b52-4fac-abbe-2bd6a1b41319", "comment": "Malware payload", "value": "8ee531d516e7032bc1f9a72063a6f0e87f6a1862", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620915187, "uuid": "0249126f-4961-458b-aef5-dd30137ce6cd", "comment": "Malware payload", "value": "e0a5e4ad23ddffe09cb1263f87daa9d6ed12b89f061d512f2bd1668276250f5a9864dafd5600127bbfc57845f5ff3d98", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915187, "uuid": "c25df2a8-0a94-4dd5-9ab1-f58a7e2290b0", "value": "033302D5AA13F8D7CAF9EEA3089523D4636FD49D36143C995C3B298244B71A4C0D37C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915187, "uuid": "01b018a1-02e2-4c6c-9e67-8bc04533f4ee", "value": "768:Po4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SXAjMxyf:1eKCVQbp4LTaI7ZaiNQMIXAo8QCTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620915187, "uuid": "c2c80dc2-88e3-49fa-bae7-5787aa543f07", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620915187, "uuid": "d41db2dd-c389-4c9b-b182-86fe21df19cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620915187, "uuid": "821941c1-02ca-4b9f-8056-d0a667413ad8", "value": "statistic-1572771931.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051658ad-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912043, "uuid": "7fed3c73-2646-415a-b2fe-2e39b107953f", "comment": "Malware payload", "value": "176c4afde57092fc0a10d2cfe6b1921b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912043, "uuid": "b1cd4726-a5c4-4194-93e0-2a963f767521", "comment": "Malware payload", "value": "1aff25c5db12a80770ffb25a5cf8a9d39d863d32022d4cc4b695fe9de7dadad6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912043, "uuid": "3c8171aa-8591-4d6e-bcc0-7c3f224cc0df", "comment": "Malware payload", "value": "3227b03ac70322fc398e62ced5b3810d4a45aec4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912043, "uuid": "32387854-31df-41c1-846d-657310b08296", "comment": "Malware payload", "value": "6f8a5afdf611f899d2e5c3da1504990cb8f0e5e3def15b5d18db7e5ae01123e038cf912596991df8bb34a872aca33cb7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912043, "uuid": "1b39da04-144f-425f-8046-81fe240b5e2d", "value": "0F3302D232D7E23F80C205F7F51B5ADA16B78A98E83090C12E9ECD5213E31656DA134E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912043, "uuid": "8cd01a12-41c1-498a-a3d7-db0977e9c8a2", "value": "1536:kEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwnc:hnBrX5Eg5Enjq3axWIfkNwnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912043, "uuid": "4188e069-81da-429d-9822-8f745412efcb", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912043, "uuid": "98818a0e-da5c-4695-ae5d-862f0c88c8c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912043, "uuid": "4738bc32-fd89-4fe6-9169-355be98391d9", "value": "diagram-1285163252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ec70ee-b391-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872401, "uuid": "5745b623-8cd4-416e-8132-12a79c2e4677", "comment": "Malware payload", "value": "5dff1c50cc9c05132ffe30a03b89e530", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872401, "uuid": "c2796497-eff7-4f77-a457-fab50d8acb01", "comment": "Malware payload", "value": "1b0d804adb9d40707fdbbd803bd8b453d1b0f988204d5dab8d381fab10e5c15c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872401, "uuid": "ca3489b6-3073-434c-8c39-595c00dd2608", "comment": "Malware payload", "value": "4c0bda2e2589d1168d7324c2f1c92e137a652a8d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872401, "uuid": "91ca62c1-f155-4039-b64a-d55bc6295caf", "comment": "Malware payload", "value": "1988b7ef65fa1659583ebadbb71ac72a6ec4df3379e56fd3ca90662823268b203505d4bbbf9ffd9dd8336835635bc6e0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872401, "uuid": "6f8799f6-77ed-4cbc-9274-fba987b0ba08", "value": "A53302E2D312A2BCB643C049C9CC1E979377427026658EB2C56DFED1A33D7160B61B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872401, "uuid": "3c5b3cca-e97f-4cbd-8c5b-af525f0ad8ca", "value": "1536:x5/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeL6m8L++h:XXKAXh3TCdOi+KSZ4WBRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872401, "uuid": "1f9c8f37-3211-4736-a288-05b06f45aa18", "value": 51605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872401, "uuid": "e8f38223-d6c0-4df1-9f01-95ade049a9a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872401, "uuid": "0156fd5f-6620-4f16-bae6-225376be639e", "value": "statistic-1426832308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c18ef81-b3e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909129, "uuid": "e95fa9a7-acb4-4d87-8e97-8fa428bc9415", "comment": "Malware payload", "value": "48dbcd5fa85500a97fe74fa561989545", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909129, "uuid": "946f4722-f11b-4b18-a8a5-cce3804e12b1", "comment": "Malware payload", "value": "1b0e12a895cdb616075d5e01b61aadf11f23716ae3c76283f55fe3961f1a0028", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909129, "uuid": "b8965e1b-d3c2-4146-9332-58e6cb1970e9", "comment": "Malware payload", "value": "575b795861ab144cecbb3e509bba6933960ce4de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909129, "uuid": "e6cb4367-ebeb-4ac7-b65c-f6f462ebb852", "comment": "Malware payload", "value": "2744481657f8f26f0d1c5e1ff2b79efdb56cdb05d53020277ca80222d0179bfa0dc063806b1f9092bd58caca0c9aac84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909129, "uuid": "f0c0ef63-247d-4052-9ce4-9e10335c9ac3", "value": "9E3302EFA800FAE3C59B57026FB19A6106FD7A4DD130D1288359C6F0EAC36C2C43A9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909129, "uuid": "ac4843d1-607a-484d-8191-f920842b97df", "value": "768:+qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMlBW:vxTuDqsF1Cnc3P57oj2+nC6uxkLus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909129, "uuid": "1cf14212-e353-41d0-9791-d02c40b0b207", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909129, "uuid": "323c2cf2-6468-4938-baba-b1dc0da42f63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909129, "uuid": "649d8ef1-50e6-4f66-a971-aed52a63cfac", "value": "catalog-1142402402.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16c05c6-b38f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620871610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871610, "uuid": "9b03a348-4518-48de-aecb-a36921514539", "comment": "Malware payload (Dridex)", "value": "f4e3325c72849bb89974cbfa18c11ba3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871610, "uuid": "21ee4ec5-adea-48fe-9f06-c3a140ce42fd", "comment": "Malware payload (Dridex)", "value": "1b1a1f320363366c35d3945c1c25161a821db629284319308937e0c96036c965", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871610, "uuid": "ab3063a3-22f0-422f-bba1-c0ce85de5187", "comment": "Malware payload (Dridex)", "value": "e2a333272bf213f751a91890453fa2c6c24cfc81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620871610, "uuid": "f90a6661-ec3b-411f-aba2-24647ef7fcdf", "comment": "Malware payload (Dridex)", "value": "6216c44af1e53500364cd1ff240def2ce699f325cf13161fe67428504901d559ef307284cad4a687b1ac5bb50dce02f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871610, "uuid": "5e8b8837-6039-45c6-a6c4-1597c987ec78", "value": "E5F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871610, "uuid": "7924098f-3241-4ade-ada3-43ebeba76e5e", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871610, "uuid": "86c0abcd-93a3-4b64-ad89-56a39919da86", "value": "3072:59F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:59F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620871610, "uuid": "9e1f8694-0a1d-468f-8adc-7f378654c02f", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620871610, "uuid": "699b0fff-4009-4e54-a3cc-f45a540da60f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620871610, "uuid": "8f3e3124-04ea-470e-aaf0-b78ece9cc229", "value": "f4e3325c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda43539-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911547, "uuid": "38321918-b021-47c7-8fbd-397da4c68de8", "comment": "Malware payload", "value": "8c00448fdacd84be405b25f04957cfa9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911547, "uuid": "7b639c31-8fdb-45ac-bee9-891b04866e42", "comment": "Malware payload", "value": "1b224f82d6eba862ee14a370c187be88c3fb6dd5060238d987ab62f8f2c02e08", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911547, "uuid": "a0e83bb5-f0df-4437-8a2e-283033ccbfb9", "comment": "Malware payload", "value": "4b706b779aa2ea355bde4f0f814f738a798a8791", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911547, "uuid": "c5906a99-e1af-42e7-9fd6-7142cf8883db", "comment": "Malware payload", "value": "135e766c627f07bf27e8ad679aa0b1860d6f580b11313b879cf310a7aa578d4f81521b628b654e68b18b668c7c704d32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911547, "uuid": "3159be84-c72a-4294-b948-eaa9e4d3ec3f", "value": "AD3302DFE004FBA3C26B93005FE98B9215FD7958E1708168979985F9EA833C2C53D9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911547, "uuid": "6ccde891-db79-4b3f-bc1c-238807451eaa", "value": "768:Bqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LHf3gahfvR:8xTuDqsF1Cnc3P57oj2+nC6uxkLYgXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911547, "uuid": "83df83c7-a765-4e69-80dd-fc49e87a9143", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911547, "uuid": "33fcddea-a7a7-47d5-86c5-95d49167d878", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911547, "uuid": "c59473fa-a933-4384-924b-e7cd6f7b01b6", "value": "catalog-914618613.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d492ef1c-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914109, "uuid": "117a156b-60c5-4238-aa5f-530b7aef4d1d", "comment": "Malware payload", "value": "3c1ad987e142ef5026072860812a05a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914109, "uuid": "77e2ed09-cbc5-44a2-b218-0968f0d55429", "comment": "Malware payload", "value": "1b40e47af531cb5589d0af5091c606d53645e0d40a091cb795a38d9daa5ab184", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914109, "uuid": "ae9781f6-88c0-4012-bdfe-64bf2e7f90a0", "comment": "Malware payload", "value": "866666c66d783c90e08d9938a70b46bc25796f55", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914109, "uuid": "472380dd-0a83-46e8-b0e3-eabc456a1cf9", "comment": "Malware payload", "value": "25fa96a12381956e1ec580aafe537524f149341f2e34dbd3f5137f1343d12edf31a28b88fed3e4412812d41bba6fb00e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914109, "uuid": "dbc67bfb-53ed-401c-b369-9af62d14c7ab", "value": "3B33F1D232D7E23B80C506F6F52B59D626779EC8E83094D16D8FCA1213E3176ADA170E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914109, "uuid": "9a624827-c517-48b0-9638-c844bcaf5538", "value": "1536:6EnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwn10:vnBrX5Eg5Enjq3axWIfkNwnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914109, "uuid": "aa0618f2-f65c-4739-9c11-2e09f7ce9a2e", "value": 51757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914109, "uuid": "f4a0fd96-ebc6-45ad-b04c-a0f4626a21da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914109, "uuid": "2a69a772-24d7-45a4-b516-b1979af7bf8a", "value": "diagram-791061108.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c7e6ea-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911339, "uuid": "984e15c5-97fb-42f0-8a15-3a49b7108845", "comment": "Malware payload", "value": "4769465266634bcafb7242bed42b9c6c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911339, "uuid": "340a09e9-bde9-4b4b-ab4d-b4bc466494f8", "comment": "Malware payload", "value": "1b561750d8b65c4e0933fa40879f29db4a9970b7cb869c0aed13d1464dae5cea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911339, "uuid": "1e3b1efe-ff9c-4593-8c36-8f509a434df3", "comment": "Malware payload", "value": "4a242a6c3849509c736788884d34aa15c991a946", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911339, "uuid": "69a718e3-af59-430b-8a75-ed39e9d9ed3f", "comment": "Malware payload", "value": "e3aeab5e36cf33aa830435bd38c4d0b092ec82b2faeeb0ba3a0fd1fb0d3bb09af0a73aa5770be4f7a2cd3f697742e232", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911339, "uuid": "efea588c-9b02-4a81-b26b-f63056a925b6", "value": "3B33029FA008BAB7C19F57026FB6DE620AFC765CE03091548369C6F6DAC36C280795D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911339, "uuid": "5fceb89f-513e-4cc9-8164-76d86594e0f2", "value": "768:mqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LOJva:nxTuDqsF1Cnc3P57oj2+nC6uxkLOJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911339, "uuid": "171c4e50-1817-41a3-8815-dc8335920d6e", "value": 51711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911339, "uuid": "c7a9aa82-3462-496c-bffb-0a313648982a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911339, "uuid": "2adce11a-ac50-4bf8-baae-c1ea383caca2", "value": "catalog-750075425.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c347d79-b3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620913773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913773, "uuid": "fe5f1d54-b033-4917-9c06-405031f30a70", "comment": "Malware payload", "value": "a06549f96a80eefb751099a6c6ac3d9e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913773, "uuid": "a2662c66-8ba6-4327-86ec-5e89f2130a24", "comment": "Malware payload", "value": "1b5e33cc13fd7f6f737de3248606be6b67abd8c974aec7a3cb3d59353f2e9e42", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913773, "uuid": "dc81fc0d-3456-461f-bc88-351fb51538df", "comment": "Malware payload", "value": "d07d15a5b6aa2c8e30ccba5959bda7cf95bfb742", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620913773, "uuid": "8cdcf9dc-5a01-4b1f-b816-f8f6adcecfb7", "comment": "Malware payload", "value": "dfffa4fdaa2049e08e7591cb2baae3d40db747bb4fba7b036d571460564279962c7d0b2bb6d93e25a752bd61430e8983", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913773, "uuid": "15478aad-55fc-4254-8d94-f213340889e3", "value": "1E33F1D233E3D13AC0C115F2F5275DD959978E85E530D4D02D9EEA4023E31AAEDA164E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913773, "uuid": "2f437fc9-d009-4045-8991-faaf038eaa86", "value": "1536:vEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwhciM9:cnBrX5Eg5Enjq3axWIfkNwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620913773, "uuid": "e565552f-6661-49a1-8a9e-8228abe362e6", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620913773, "uuid": "0cdb9fa7-7273-45af-8711-4887fd3ab7f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620913773, "uuid": "e3e7593b-2b2e-429c-9aa4-c49d1680352d", "value": "diagram-540164713.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5016e559-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620914746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914746, "uuid": "91aaf273-c14b-41f0-a2cb-38e822adf9fa", "comment": "Malware payload (Dridex)", "value": "8cd2db7444a337eb5d50c1580ecec96a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914746, "uuid": "f050ab1e-82ba-4268-a43f-247367260d5a", "comment": "Malware payload (Dridex)", "value": "1b7663d61abbed6c3f5385977fce9119eff1de4d104d5054efa94c45735e51f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914746, "uuid": "b6f62b1c-ecd2-455c-b1ef-35d6e011ed40", "comment": "Malware payload (Dridex)", "value": "4b000050d50e2bf6cdfb18fcfad832d2e315ff7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914746, "uuid": "fb29253e-627e-4b9b-82b1-33474e97a6fa", "comment": "Malware payload (Dridex)", "value": "ebf14c753706a59ccaf6e5cbcb5ce0c9085779205487dfe89d3c5e18ca0e597cfff9e0d897d7437868f519d2c1631cea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914746, "uuid": "11491c61-5b74-43ca-be67-04966a7d271e", "value": "11F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE2576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914746, "uuid": "fdf17f45-5d32-4bd8-a4dd-d23d9729cc7c", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914746, "uuid": "405d62a6-6d34-423d-9327-e56b0755c5d1", "value": "3072:War6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Qs4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914746, "uuid": "c68fbf65-354d-4957-ba1a-283b040ad097", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914746, "uuid": "5176467f-0714-49c9-b224-4f1f88658cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914746, "uuid": "e8d9d701-9a16-46bb-9b05-1a97850216d7", "value": "8cd2db74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e89680-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914698, "uuid": "1d5e87f4-11bd-460c-b2e1-32da4eb6b7ca", "comment": "Malware payload", "value": "7d0cc3dce696b87cf0709ef0cc38fdfa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914698, "uuid": "7daf5775-0ed9-4036-8e43-34c4d9da20e4", "comment": "Malware payload", "value": "1b782b37bccaf9887416fb9ce630604df7718a0d3cffc3dc59b471c8ff687a15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914698, "uuid": "babeeb94-6066-4b97-9278-ae54524ecc9b", "comment": "Malware payload", "value": "3da47d4a891474c484a1d5871868d0a6af6be950", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914698, "uuid": "07618689-96fc-4f64-aa33-1a980f7dba3f", "comment": "Malware payload", "value": "e46c5693362c685ff1713e319a8c0f548bfbb1ae8c39696c9ff720f61da9c0d3ce8d0f3df8a06a59101049e3cc029346", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914698, "uuid": "303bd96d-da10-44b0-a7ed-0ca194a43da1", "value": "C4F3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576A08879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914698, "uuid": "8a3777a0-e882-45d4-85c8-857acf8e9c99", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914698, "uuid": "1c2c1b5f-e333-4e80-a667-672384b12765", "value": "3072:rar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:ds4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914698, "uuid": "50054443-08ef-4e34-9093-0c6c93930d74", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914698, "uuid": "2d71affd-50ad-425e-9c0c-9bc6bee0d27f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914698, "uuid": "64b00d45-302b-4877-bf75-967dceb24949", "value": "7d0cc3dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a84e3ab-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914871, "uuid": "5fcc0c40-39d6-4dc4-ad65-6f0d5d25368e", "comment": "Malware payload", "value": "a3ed6a6b9acf5bbaeb4ca1b89ff3394f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914871, "uuid": "e3e02bd4-54e9-457b-93ea-13e7c1250bf9", "comment": "Malware payload", "value": "1b824975aee1b0df9ef1b0a6f882c3c8905b0055c7149cd4e49258b3ff8d5ac9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914871, "uuid": "7896061f-347c-4c47-b9c0-f5da67c50220", "comment": "Malware payload", "value": "d1422f47797bc3d6eb9860f8f852b5fc4b36124e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914871, "uuid": "439035e4-4926-4639-ac87-f6b0403f0700", "comment": "Malware payload", "value": "a0dfc5bf20b65475f19ce0964f751b07708b8858929d138248a83cb00491ed3af9e3dc35128fc49952727a6f94de4421", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914871, "uuid": "cbb8c7b9-aa6d-4fdc-8822-01bfa9f2b6c4", "value": "D33301D6AB13F4D286FADA93046923E4536FC54D34187C985C2F248345BB668C0EBBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914871, "uuid": "c9a52f33-3279-4a7a-af1b-f724ccda9f55", "value": "768:uo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SaTa:2eKCVQbp4LTaI7ZaiNQMIXKTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914871, "uuid": "8420aa33-7d6f-49a8-aba4-b222f8cdd91b", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914871, "uuid": "3dd88528-d814-4193-924a-ece89d7125e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914871, "uuid": "4339caa2-5dfd-4e7c-a616-96168cfa7266", "value": "statistic-1364730814.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b07e8a-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914814, "uuid": "1d45c4f2-4423-41b9-a8ea-0234dc026d04", "comment": "Malware payload", "value": "e61e97edcb391e843a617b9a0c304dfb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914814, "uuid": "6d363d8d-800d-465d-958d-ae05e5cbdfdd", "comment": "Malware payload", "value": "1b83d2e0b93e1ce2a0bce129af4239b81e5a58b90dc13ab0e52d96f09af2b8d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914814, "uuid": "87115db5-71df-4dcf-abab-bd209fe7d3fa", "comment": "Malware payload", "value": "991706467eb579afd83a76faed11ec5ed2c0a685", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914814, "uuid": "27b322cf-13f4-4fae-a6e3-3075cf9b642b", "comment": "Malware payload", "value": "f62e4644c410c222ac56cede45979f82475eb0fd1a9b0d50483ece1f62d58ba04c1782a1e79efca18d50d384f18aa4b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914814, "uuid": "59e0f7ce-bbf2-4d28-aa87-21e6b30f535c", "value": "B43302C66623F5C686FEDA67048723E4A39FC9DC31147C685D3E298281AB158C4E77CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914814, "uuid": "d6960eb9-e6de-4eeb-960c-d18f3fdbb94e", "value": "768:To4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7SqEseL4b:ZeKCVQbp4LTaI7ZaiNQMIXaE7LRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914814, "uuid": "db974254-4498-4c1a-bbce-fbad20e1be75", "value": 51773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914814, "uuid": "a020b50c-ab80-496a-a8ff-9f59f005c453", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914814, "uuid": "f9d99b17-c16a-4166-af47-cda02886f92b", "value": "statistic-1306083472.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6391545c-b37e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620864098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864098, "uuid": "fd96c11c-8131-4cd8-837e-73f88b914709", "comment": "Malware payload (Dridex)", "value": "1064148425c650db47c7f9dc7813ca6f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864098, "uuid": "e2b64926-2daa-493d-8184-b0b5e5867810", "comment": "Malware payload (Dridex)", "value": "1b8528c60c1cac1a744b83cff23a2223c30fee1cc05779fecf01b4a85068e59e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864098, "uuid": "bc283704-2b5a-4a5e-9907-5d25d2e5c7c0", "comment": "Malware payload (Dridex)", "value": "45153838ee1b5ad6524a086c756cd8961f450678", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620864098, "uuid": "1ed0b620-28e9-4212-a9a8-af840ad70e7f", "comment": "Malware payload (Dridex)", "value": "e7569bae432d912e4138184a78d387e878000a2d91066240eb8a76c71b7b50174399dab5f2f0ef759ee80354690563c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864098, "uuid": "161f70ae-56b7-4773-9999-04fb4ebf376a", "value": "51F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864098, "uuid": "3ec63e39-0a40-45ad-8f9a-189bac7a4f88", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864098, "uuid": "dc96aea0-2b6f-4877-a0cf-445b3b5a3b76", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620864098, "uuid": "bfdf1105-bf89-4101-abcd-7d63fb7af54f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620864098, "uuid": "4040e030-769f-4e4b-ac7d-72d4ca4c475d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620864098, "uuid": "5c3d18f6-1f0d-4658-9da8-11b352fdd9b5", "value": "10641484_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4873b1b5-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914303, "uuid": "e999cb56-6778-4b9c-b2ac-a8242d6be205", "comment": "Malware payload", "value": "f8a6cbbab36cb6aba15e675350cf6e3d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914303, "uuid": "560e30d1-cbae-4cd9-a9f6-bc10dbdc2b0e", "comment": "Malware payload", "value": "1b8b6b602acfe24a01f7437206cfa6c914242b310c68f13ddd504a7c8eee7d5e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914303, "uuid": "46982215-4249-4143-b014-f00fd7410b3e", "comment": "Malware payload", "value": "5c70afde2fa92c0b6adc740f1c558accab24f8aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914303, "uuid": "e8a431b9-0923-4d3b-bbd6-813e42561fca", "comment": "Malware payload", "value": "3b5c867285e7c6efd15b12815d0737c328e05f2b6a29a369a6a54acdfb5ed019251bf764ea8b8424add59f3f12e3a3fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914303, "uuid": "af77c078-bd4e-4069-9936-4fc59f9cac0e", "value": "AA33F1D132D7C53A80C245F6F82B69DA66AB8BCDE930D0D02D9FDE4112D2165AE9230F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914303, "uuid": "640fc94e-1a3f-48c4-8f46-c697304868ff", "value": "1536:uEnBrU/c5EkvD5ZCnjq3axD8vuNfr4NwYnn:LnBrX5Eg5Enjq3axWIfkNwYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914303, "uuid": "3d39d895-314b-47ad-8107-cefbb206669d", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914303, "uuid": "d60f0e01-3829-438c-8643-5f65b5595ee0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914303, "uuid": "c5244cca-593f-4e4a-8ff6-1ee61648945c", "value": "diagram-951873740.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e046f9-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909877, "uuid": "50d4fb54-fb23-45d0-9ea1-a2281b944841", "comment": "Malware payload", "value": "6b50058c159015c0818274bcdfe1bdcb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909877, "uuid": "6bb70d52-e991-41d3-af99-da50e8a33817", "comment": "Malware payload", "value": "1ba1758869b393e8c1be1d0d9dc212c3c8e11a9c82826f24340dd922543845a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909877, "uuid": "b2c9632b-b104-4731-98a1-95521e804823", "comment": "Malware payload", "value": "c7f64101e9ed2acf1f93005b284a159ca6bfc922", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909877, "uuid": "928fb715-58d4-478e-8fab-0b65a5ba2223", "comment": "Malware payload", "value": "725c49ee8feebd3ec1cdd696ced3e9183910f0c1d21b4db4e5a3f82608f09536843b4adfbab40233800df7c030c0d27c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909877, "uuid": "fff0e572-4308-4274-92af-9ee8f4ac0d57", "value": "483302CFE045AA63C29F97015FA5DAA306FC796CE170C14C8369C6F9E9836C1C43A9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909877, "uuid": "da0aa913-88c6-4eea-a15d-c2d99d8bdea4", "value": "768:Jqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L0CxfO:UxTuDqsF1Cnc3P57oj2+nC6uxkLlfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909877, "uuid": "65a37cbe-0bc1-4e4d-bafa-e1713f41db91", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909877, "uuid": "4bfcb3bd-ee19-4465-9bc8-9c354ee82d3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909877, "uuid": "594795f6-64db-4bcf-9a84-fae76030e656", "value": "catalog-1573025853.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bc3488-b387-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867866, "uuid": "63e0ad52-fc61-44f0-8a4a-91318ddd4cec", "comment": "Malware payload", "value": "dae2ce2411ce01f627948da0daf623a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867866, "uuid": "d7e93b63-47da-4c83-b54d-41f0ec90c90c", "comment": "Malware payload", "value": "1ba6429f20f19698b412bef18ae5be68337803f7becee22df0a20ec47414f24f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867866, "uuid": "0618ab96-85ee-44e4-921c-ba3b6e7baaff", "comment": "Malware payload", "value": "0e1e1bfeb2268d6e5778971dbc7dbcfca4d99fde", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867866, "uuid": "fb10c6c7-bfc4-4720-8088-14f18d9d0a43", "comment": "Malware payload", "value": "66aed40c24a012486a30e8263917c2861993baf2f5c6b6d1da102caf47fa6516dcae4b475ad13f45d3be2a8490df149c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867866, "uuid": "13f79e4e-72b6-474d-af41-7cd29478b965", "value": "3C33F1859F57F418CA97637B7C482FD77EAB122464CDE09457C331DD0296D232A242BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867866, "uuid": "dc5ec8a7-d864-4728-aaa2-fbc80386567e", "value": "1536:CAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHi4P:xpoAnd9gucKC4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867866, "uuid": "da89b5a0-bfe6-4874-a1dd-48631a066366", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867866, "uuid": "75a0d13e-820a-43a7-aba4-b7c316851bb9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867866, "uuid": "96b7bc6c-b270-448f-83db-ce80bfcc9441", "value": "catalog-1940244599.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50983f2-b38c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620870247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870247, "uuid": "13d8e05a-f884-4269-89b6-b48227f761c9", "comment": "Malware payload", "value": "9d4152e4bca4170a4e2b111efdf7c7c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870247, "uuid": "79944290-daec-49f1-947d-c171540d9471", "comment": "Malware payload", "value": "1babf480cf94f20ca2d3538f9c3e683b9641344307e83f5c33b9f8d3cf69c688", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870247, "uuid": "ad4144ca-8137-4e70-b0c6-efd0278949cc", "comment": "Malware payload", "value": "23572b90be331e0d03648b7d84484eb932bb8ea4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620870247, "uuid": "fe7c2c1f-cf10-4d4b-9501-580d35b7532d", "comment": "Malware payload", "value": "a3cc5a80e4ec83c37a925951cc9ff1791c0a4290289fd14facdf8784db760d12a7bdfe5032b8a7ab0771befb03c4410a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870247, "uuid": "40053e9c-1a9c-497c-9686-d634b51492b6", "value": "DA33029673FAA910C5F1C2B0A4E271C8374F3D918EBD5EEE4D8894793B921A0CEE15C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870247, "uuid": "7871d001-51d5-4641-83f6-aa5ae5b7fc96", "value": "768:a5G8cU65ujUrds3NDUzKn6h2w3zyNT2eYFTUsuspHuJoN:a/czJJSI7r3Pwh8rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620870247, "uuid": "91db4cbc-9769-45ef-a91a-1eba44ac6954", "value": 51596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620870247, "uuid": "9680d038-8f93-409f-b01a-524daefe7960", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620870247, "uuid": "bc713263-8a8c-45dd-b574-79e34938a2cb", "value": "diagram-1775935689.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855a766e-b3d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1620901521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901521, "uuid": "2516822f-cde4-45a6-a09d-c7c44419f685", "comment": "Malware payload (Vjw0rm)", "value": "c762ecb478e0c810f43d96ed1613193d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901521, "uuid": "55ab43fe-a01b-4bad-8903-fd797b9cba6a", "comment": "Malware payload (Vjw0rm)", "value": "1bb4b91c7bff835cd9ad0c1f59555cbdf1e2f1cde9c361eba79e1d720983760b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901521, "uuid": "61475501-6e30-4595-b1fb-0ac12dba9bf7", "comment": "Malware payload (Vjw0rm)", "value": "15790279c1b8d576fbcf1c0ab76d09b9d82d3a50", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620901521, "uuid": "898e75fc-4128-44f4-8c89-a96336fbab59", "comment": "Malware payload (Vjw0rm)", "value": "d8f9f2a7d6d23622c13c061a6a934ccd2004fcae138bca917ca8669c483e39b5c432b23c0a3353188653c1f75fffd063", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620901521, "uuid": "dd31361d-6c01-46cd-bb23-52eeea88624c", "value": "3A22BFDC67898336A11B6BBC483F8878AB56FF7941525A0C71C2E766E4BCB1CC344878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620901521, "uuid": "670dae35-1869-4161-8741-619dae92a869", "value": "192:QXFjUg3AVEbLqhvecgLi3EJFfZBRHhm6dmhSAQIrUpzTra1qb06Shl8mcTz2:QXSgxbekvtJrHu9nUVa/62l1cTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620901521, "uuid": "555bd0a3-046b-4045-8a81-12b111538022", "value": 10057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620901521, "uuid": "9d4ec984-80a5-410b-a4fa-cdae5aa5309b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620901521, "uuid": "a0517b1c-e2dc-4549-baa5-919cc3d36988", "value": "Z0MAWQNP.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca114cba-b3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620914521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914521, "uuid": "9529cf63-814b-445b-9a9f-bfd054deb0c7", "comment": "Malware payload", "value": "1780157ad71aa4b6478cd5fdecb5837d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914521, "uuid": "0a0985a4-a288-4e7c-8d4b-5de41bfac122", "comment": "Malware payload", "value": "1bb9fce541f3447161ccf39dd57b6a3beb8c846b2795a5237e2a4b84057312d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914521, "uuid": "74ffee92-8bff-4732-a04c-9f663fa7b6ef", "comment": "Malware payload", "value": "c9c6b95925942bc0a56ac020bbe105403d875234", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914521, "uuid": "0f7a8fb7-0a1d-4a51-83eb-ea6667722aaa", "comment": "Malware payload", "value": "1e99ae0e098bc6a7cd69b19a693edf74787669563923d771133e488379453cf2e7a02bba6bc1dd4cf828d52615eb6046", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914521, "uuid": "df034e5e-e7e0-43f3-851f-fb1eb4daff17", "value": "723301C65B23F9C786EDDA97049963D8A76FC98C30143C59692B748280BF168D0F7BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914521, "uuid": "37896e2b-d6c1-4be7-bf89-027a33fcd40c", "value": "768:Qo4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S8CIoUuw:0eKCVQbp4LTaI7ZaiNQMIX77Uu9aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914521, "uuid": "e4aa028c-13b4-4d3d-9737-75cd9d903d1d", "value": 51772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914521, "uuid": "2bf87876-e2f3-4673-9037-75c28f2b6b96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914521, "uuid": "86a0c161-c6fa-4ec0-b7c3-1119ef41410f", "value": "statistic-1105420964.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096bdfa0-b393-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872966, "uuid": "e486dab3-d4d5-4c54-b785-8a08d1324d0f", "comment": "Malware payload", "value": "be934bcae5e8b346c5115e3046cba433", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872966, "uuid": "5be2cc0c-589a-4776-b252-35f3a676d3ec", "comment": "Malware payload", "value": "1bc9667006312ec5bb47f98bc9c94085c37f6671cc604a51da09b2705d31a2fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872966, "uuid": "859b4386-e63a-433d-9e7a-ea929714321f", "comment": "Malware payload", "value": "646986ff7bf52f23995e7fd1fbcb54b6175ad6b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872966, "uuid": "3586b524-0e16-4e7c-804d-502db60b1c17", "comment": "Malware payload", "value": "e534c5dccef45c61d299fe55798866296775a3cf3b4fb174c5cd6bf78d645b0a0a9ad617110cc0b3477ef51113d161d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872966, "uuid": "8fb74563-5c70-49fe-82e4-175383f3919d", "value": "373302F2D243B6FC7643844E4ACC6F76523B42B046691EF0C15DFEE2923921E0741A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872966, "uuid": "ca22e1ec-e406-4c53-933b-1832d2bdb88b", "value": "1536:JK/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFi:YXKAXh3TCdOi+KSZ4W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872966, "uuid": "d275648f-f7fe-42bd-89b6-bdd6e490ebe0", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872966, "uuid": "77e955bd-d3ba-42e5-adcf-38c28455bcb9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872966, "uuid": "6adff9ce-56a3-4513-a455-8910dc66dc0f", "value": "statistic-1816762469.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41ec278-b390-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620872018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872018, "uuid": "17ada8bc-38c7-4f32-9eb1-855a9c3817a1", "comment": "Malware payload", "value": "58f4687b570a2bdb47824dd38fcce9e9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872018, "uuid": "720ff6b3-2615-4029-a0a3-9c96b639083e", "comment": "Malware payload", "value": "1be82b4621dc4bfe51ecdd9ad768972d6ddbabf797b3de89e59cf5c95ec76239", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872018, "uuid": "ef6ca0dc-d23d-4e1f-ab7f-1dc3e4a4d8e3", "comment": "Malware payload", "value": "40b4e147a511f5191d2670e5c0b58a86977ec6c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620872018, "uuid": "3380f4ab-5e9b-471b-a8e7-7cf055218fe4", "comment": "Malware payload", "value": "f1d7340a596d6f53369847ac7b7c3b8d644accf70e8ea19419ece156886bbab2cd324c269c5e605118fd097f8388057c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872018, "uuid": "4b103a8b-3e5a-4e80-80dd-6ca8bec3c233", "value": "173312F3D202B2ACB64381494E8C5F479237817067595EF18219EFA1D33D7170B51EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872018, "uuid": "30c4ea01-d685-49e6-81f2-b2e1a10f4ffe", "value": "1536:m/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeBb3:uXKAXh3TCdOi+KSZ4Wcb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620872018, "uuid": "027a93bb-b45f-447d-a48c-ea645b3990c3", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620872018, "uuid": "17c77788-e3d7-4827-9dd1-65998f3ebb33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620872018, "uuid": "947b762b-49f0-4fbf-b8a6-4be115322ea3", "value": "statistic-115127135.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff550d5-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867259, "uuid": "3bf1f00a-5e76-47b5-ad00-958946c05762", "comment": "Malware payload", "value": "d02c5e67445dd588e380aaf68c5ccfb4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867259, "uuid": "b3805e51-3189-4b6d-8be6-170ea2955810", "comment": "Malware payload", "value": "1c045cb396d8cfb217fb9063a85a57f41a144a7fa29d892a0bbd2454e3fa3ff0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867259, "uuid": "96adc0c3-a2e6-4796-a626-1688f57613ed", "comment": "Malware payload", "value": "cddb6b2b9c83797cebea5552853cf6cc1c938bea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867259, "uuid": "544ca575-ba3b-47c2-9e1b-c88a73fc28c9", "comment": "Malware payload", "value": "fa6770f77c311a5536009dcb147dfbb668d991c51dcc85f310378f35b7cb1347cc60c5a49e767f5e151bba061a092bfa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867259, "uuid": "6c0340ac-e996-43eb-a163-24bc55c373bb", "value": "C533F1C8EF5BF418D793737B7C882F976EBB0224658ED19857C3309C0292E66661027D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867259, "uuid": "c19472c2-3495-4167-b7c4-a7aeb1e5e066", "value": "1536:XAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79YrMPD:QpoAnd9gucKCfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867259, "uuid": "624f31cc-510e-477c-ac73-b725b00b4c34", "value": 51571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867259, "uuid": "5226d659-d91d-4edc-ae93-ae6eeb20cdc6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867259, "uuid": "661dd606-8c6e-44e1-a6b7-9c2a9bc2812d", "value": "catalog-145773820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c42f19e-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620914820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914820, "uuid": "b963939c-1a68-4372-9015-cfa354f4ae32", "comment": "Malware payload (Dridex)", "value": "1eed099ef258629baf252bdbc7e1d07f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914820, "uuid": "51b9b28d-8480-471d-908c-f358951b2171", "comment": "Malware payload (Dridex)", "value": "1c0d13a6888258e9060991005dd413153f3712cbb101cc60ec6136e5abffc4ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914820, "uuid": "253ff0c5-4316-43c4-a8d0-ce74a7a275ed", "comment": "Malware payload (Dridex)", "value": "4849cfabb64403bb18a7340447d5ab6e425b83e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914820, "uuid": "a4660c92-0fab-47ce-ba55-44476f11b131", "comment": "Malware payload (Dridex)", "value": "61c2c5aa65eaa81b9c018e926d7bb46559c9de1f8d653b1be2049b992762bd458c212817f268ba6b34eebd6c588de9cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914820, "uuid": "37f69fd2-3ea2-42bc-a899-2b6474a5070c", "value": "5FF3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576608879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914820, "uuid": "badaf861-2af7-4b47-af68-526e94359ce4", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914820, "uuid": "b67c4ce7-6adf-4d3f-8305-06434aae49f1", "value": "3072:/ar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Zs4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914820, "uuid": "5a009d6d-e401-4dcf-8db7-696dc2e0f15c", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914820, "uuid": "33f2d916-c585-43eb-ba0e-bbccf22f1fc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914820, "uuid": "ad758b9b-a791-4148-b94c-a202136f37a0", "value": "1eed099e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29925653-b3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911245, "uuid": "e7b3633d-78ba-4e69-97ba-1742d36bd922", "comment": "Malware payload", "value": "56731e6372be4bba17edda7413286d52", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911245, "uuid": "07e050c9-816a-41e7-8045-bf7e7ac63f4b", "comment": "Malware payload", "value": "1c140fdcb360746031e5766163625371ee6218d02b8c82783a41a4c56485caec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911245, "uuid": "4395a619-041e-405c-9679-939a37fd095a", "comment": "Malware payload", "value": "ce97e34ee1ff4a20105ec628a586f22d451f3474", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911245, "uuid": "b94af781-8d23-4a22-bd12-2980700cc83a", "comment": "Malware payload", "value": "ef9b1a3249e1ef1214aa012e5e8ca1254166c5798f1b4c26ab4fb92dcd07fa4bfe658cc4eea660e891c07eee4a9599b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911245, "uuid": "3ad9ae16-b7e5-4f98-8893-14d39e6c5467", "value": "A23302AFE804E6B7C19B62015F71DB9106FDBA5DE130D118975AC2F5E9831C2C0399D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911245, "uuid": "52edd4d1-ecce-4b35-bac9-811a81881fad", "value": "768:Vqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/L9gYMDba5:AxTuDqsF1Cnc3P57oj2+nC6uxkLuhO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911245, "uuid": "c20b8d6d-bcd7-4193-945f-eeb090f1e3c0", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911245, "uuid": "fd8a0c2d-4b36-47b1-a691-e8b2df4a9631", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911245, "uuid": "3f1ffd1c-207c-4d6b-b824-9a8342c39ad6", "value": "catalog-692383414.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f21a475-b3ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620896678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896678, "uuid": "f866c367-a5bc-45fe-884b-0803c228e405", "comment": "Malware payload (Dridex)", "value": "37bea3b2d9ccb7942b9ef9fae0a37423", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896678, "uuid": "3815956e-95a7-47c4-92aa-bf2f640df95a", "comment": "Malware payload (Dridex)", "value": "1c248756ec98367ad40b4f83caac832e56b5139ecc78303aa54200046d0a7e16", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896678, "uuid": "accc9a7f-43e4-4b92-82e3-4119d09af99c", "comment": "Malware payload (Dridex)", "value": "8c0ed24b76b63064a2c26c48ecee491c134143e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620896678, "uuid": "c72851c7-bebe-40fe-89c8-e4167e97efdb", "comment": "Malware payload (Dridex)", "value": "b4448ff41019f0f047a35c6300815a1542f7ef0e40e140c31b233d90f7af87b961585fa646f07fbb34aa548178ac636b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896678, "uuid": "3b5f9dca-d7b0-4a22-90d7-cb11fd24b6ff", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896678, "uuid": "a0230995-e31a-4f4c-949f-87b928d8459f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896678, "uuid": "ebfff857-f33f-4221-953d-7d0fc9d4515d", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620896678, "uuid": "6990c24c-148e-48b3-b6a7-59701acf8821", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620896678, "uuid": "fa78f59b-7ce5-4f27-9640-3d3cfe131dd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620896678, "uuid": "d06838e4-e69a-454c-bee7-5d0f509c26ca", "value": "37bea3b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0de5f36-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909861, "uuid": "d236053c-e160-43b4-822b-d9b862e13d0d", "comment": "Malware payload", "value": "bd3ad7ba8fbd61c140444385fddc7fd4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909861, "uuid": "c5d1f299-677c-4fde-b216-96cdcd78ba72", "comment": "Malware payload", "value": "1c24b8533f566d9c4bfd7fc9cf0ece34ff901e1d2a1f094ee98a396455945189", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909861, "uuid": "9b99193a-f252-465e-8737-a9361810eabc", "comment": "Malware payload", "value": "a662b68cb5d67f2ed0683ca49d98fea464944f69", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909861, "uuid": "47d698d0-9d52-445a-8e07-59ca8914fa51", "comment": "Malware payload", "value": "89321fbe3c5d27b153d73b9ec34973aa71a1e453b26794f8d3cce4d7d488015c0c952187839b4f83b2b1a96df3a43523", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909861, "uuid": "19fff852-43d7-4322-a463-a795b42d2083", "value": "6F3301EF9004BE73C28B17015FB59BA216FD7A19D130C564C72AC6F9EA836D3802E9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909861, "uuid": "7bb07e97-7ba3-4e9d-9c92-ecb43e078b86", "value": "768:Kqxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/Lz4DVB:LxTuDqsF1Cnc3P57oj2+nC6uxkLQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909861, "uuid": "9a8d7fdd-2e91-4d09-8ee1-04a1819a6602", "value": 51714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909861, "uuid": "c385a03a-9fa8-4b32-a83a-e56acf6f23f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909861, "uuid": "1bf164d6-2883-40de-bbd1-ca2a049cc7c1", "value": "catalog-1567207342.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537f1fa5-b3e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620909597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909597, "uuid": "3d523fad-8ef2-4454-882b-3251ffc4359c", "comment": "Malware payload", "value": "55840ce79470c0e8972c8ea578652662", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909597, "uuid": "ed0ad9ef-8f80-4e1e-a10d-861870c623fa", "comment": "Malware payload", "value": "1c2f2427b026f5b5001283e4dbc01b38780587dc1234dd10653daff7c84f10fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909597, "uuid": "c8be1430-4e65-44d5-81c5-50d98207e392", "comment": "Malware payload", "value": "a270e4f411395e9517a18cbffd7961963052761a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620909597, "uuid": "ec9d9d0d-b7fb-4dd2-b817-3b6577b29aff", "comment": "Malware payload", "value": "572df5f557196bcac242cbb60764dfec14e186dc3582f47b5b653eccd79b50fc10f2f7156e69796e98792062ea497704", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909597, "uuid": "f85f1c5c-12a4-4bf2-b768-437e91af6817", "value": "1B3302DFA044F9B3C29F86016FB59B6306FD7A0DD2309158D35AC6F5EA836C1806E8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909597, "uuid": "2d77b2f4-a352-44ba-93b9-498e26a983b3", "value": "768:5qxefrwc+IDqfdeF9LbpD65nckW0s51VOc9aI2Tnise+nC0dux4/LTNM0:ExTuDqsF1Cnc3P57oj2+nC6uxkLTNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620909597, "uuid": "ffa4ac75-f46d-4bce-924b-d667038d27e1", "value": 51715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620909597, "uuid": "634cdacd-691c-4a8d-a2bc-7e8349a4bf44", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620909597, "uuid": "f21056ab-8ba3-41ea-a46f-38c1a30ba146", "value": "catalog-1353705087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513b4af6-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867073, "uuid": "e6e319ef-c531-4725-9ad9-eba9f2160d72", "comment": "Malware payload", "value": "2a693dc3b58590a51031d9ec52c415db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867073, "uuid": "dd872058-a82f-4939-8abb-4d9f7cb417f8", "comment": "Malware payload", "value": "1c4fdb3cd25f751bb1660261af56cb003f8cb089be9bf5c2fc9ae7f114f4ce51", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867073, "uuid": "c1f05f60-72e5-40ed-8b0d-8f7b44e2ec9c", "comment": "Malware payload", "value": "8b65c7932d079cf8d40655bc133bd30f769acf97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867073, "uuid": "f1b05545-b982-40ce-8473-6a2c08cdb379", "comment": "Malware payload", "value": "688eec04f0fffe2e2f0fa1c164139053389dad221f743ca7106590b2b1bbbaa821b3db134660090138f18344ec35ed84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867073, "uuid": "41de2a8d-e7b7-48e8-b11c-7c649946a775", "value": "D933F1C8EF57F418C79373BB7C881F576EAB0254648EE19917C3319C0297E6266202BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867073, "uuid": "724df6f2-9af5-42ee-9132-6ab25a0db319", "value": "1536:CAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiz79Yrx2:xpoAnd9gucKCft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867073, "uuid": "2eab6529-e3bf-42d9-9458-5938ecd884e2", "value": 51574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867073, "uuid": "a79c56fd-a84c-406a-999c-952412c598c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867073, "uuid": "9074a435-ef3f-4665-b002-eaa3ae0bb055", "value": "catalog-1301519717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee93e0fa-b3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916300, "uuid": "1afb1984-6dd5-4b8d-af25-0ed10c5b6b7d", "comment": "Malware payload", "value": "84d78de2eff088cecc93ded2532aff64", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916300, "uuid": "ad148073-7dbc-4cc1-abff-16cdf540854c", "comment": "Malware payload", "value": "1c5f0ba2d0644995a5b8c4495f55ea2deb1fd0b20a4adbbf5346989eacbdf66f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916300, "uuid": "f698f07a-7a9c-44c9-b56b-6cfae2d185a7", "comment": "Malware payload", "value": "68976bb155ba1f903beb2f4b8a0eea71f8290201", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916300, "uuid": "bb47f6cd-eb8d-4510-a6f9-8e8a7895903a", "comment": "Malware payload", "value": "daf8043e084b55da0b4f96d273bd9faa8e41fdabe3412daaab899705489eb855e37b40c848d45ec4a005b761b6eb7ed0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916300, "uuid": "a622e2df-e778-468a-9d3b-d8995688ffb1", "value": "5D3302D2AB13E4D38AFBEEA7085252D4936FDDDC32147C59192A298345FB164C0E37CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916300, "uuid": "8c41c2da-5bae-4a7f-8780-debe72134edd", "value": "768:7o4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7S0jA6Fkq:ReKCVQbp4LTaI7ZaiNQMIXwFZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916300, "uuid": "fe0a3cfd-b8a6-4dbf-9261-da2384b76e49", "value": 51771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916300, "uuid": "7e4133ee-a917-4955-83c1-eec8d4c04bf4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916300, "uuid": "da6be3a7-55d9-4bb6-8517-0dc64fa9fb8d", "value": "statistic-522372058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57afa458-b3ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620912181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912181, "uuid": "bb09a4cb-7c46-4cc9-9933-11eff39b362c", "comment": "Malware payload", "value": "f8ac5a0b3b35ccc1ce87f2e6e675bfb9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912181, "uuid": "fbecf113-6ace-43e2-a06c-5496324ede65", "comment": "Malware payload", "value": "1c6b980150a1a0664a22ca7cdace494a2c1fbcfb246e98bce6071dedfbe2ee34", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912181, "uuid": "03b2a8d3-2b6d-4cd1-95b5-a85b919c2e3f", "comment": "Malware payload", "value": "2453b670992a6c0ad7cccfeab37f968d07f040cd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620912181, "uuid": "ef3d8c5f-60e9-4469-abb8-abd147f54b53", "comment": "Malware payload", "value": "c05041f3ee92d6dce319c437f6ca1b4841dea1f0af27a3ffb93b66131d6077a53512878b334b317e8d603e7719af4465", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912181, "uuid": "4aca67bd-2cf2-4faf-85a2-2185dbf46d3d", "value": "1033F1E232E79239C4C40AF1F52B9AC956678EC9E530B4D01D5FDA0123D317A9D9274F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912181, "uuid": "849c299b-1a11-4498-a707-e984378bcf6a", "value": "1536:ZEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwb6m:WnBrX5Eg5Enjq3axWIfkNwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620912181, "uuid": "e6e99da0-0186-4758-8e61-d75184e16e40", "value": 51758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620912181, "uuid": "a15e1b98-a379-4692-88ed-6a155fa74aa3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620912181, "uuid": "4c34a99e-2b29-4156-81f1-a38ff34b1f3b", "value": "diagram-143886437.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c358224-b3f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620916967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916967, "uuid": "3d0dc8f4-f94f-48be-9d86-545ab74b08e6", "comment": "Malware payload", "value": "2c4021ca26060255847fa1bb218de789", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916967, "uuid": "c39fe27d-b631-40c3-8f29-59fa4f70d719", "comment": "Malware payload", "value": "1c7882b2d3f608f37ca71c4197d776358372a9debac871da978c086bb662cacb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916967, "uuid": "91cdec6e-257e-4ab3-961b-ac04ac27f070", "comment": "Malware payload", "value": "1857b7de92d3f6c8c369a555d2f9770f5a86394f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620916967, "uuid": "3a19b746-21c0-47b0-b590-f8b7eb3560d2", "comment": "Malware payload", "value": "d08587b785474e7e0930081dd6ed6768f57a6af0a0523c0bc234da28b2c5c49d2dc59e22510d3f75fa907e4d9dd75de6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916967, "uuid": "00050882-1f22-40d7-b4e3-7f022529a38b", "value": "C73301866917F5C2CAFAEE57004623D493AFD99C31247CA8593F288240FB658D4E3BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916967, "uuid": "d9aad1c3-7e80-4000-a822-d56e26bad8b4", "value": "768:No4qHMfJ1TCVJ+Nb0k/4NCBPHRMpTavQ7ZNwCHgKOwQuFxDiAb2PffG7Sd4a89Di:XeKCVQbp4LTaI7ZaiNQMIXC9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620916967, "uuid": "6dc7fe0b-ea31-484b-8889-af9cdbfba8f5", "value": 51770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620916967, "uuid": "fc483baa-91ed-432a-a08f-18256999162c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620916967, "uuid": "8956c699-478f-413f-aec9-59a7b5ce53a7", "value": "statistic-915067858.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a104a00-b3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620914816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "15f8bbb4-9f28-4ea2-a735-4a0842eb2c36", "comment": "Malware payload (Dridex)", "value": "9c1e00a8f63cb84456c5806dba044fe3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "41b17096-2caf-47d9-8eb7-e279dca075e4", "comment": "Malware payload (Dridex)", "value": "1c7dc7bdf4955879e1a2056dff48bb8149a5236db87b99a44242b59caea20ae6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "3abeb4b2-c31d-4efd-bd8c-0f59654b821e", "comment": "Malware payload (Dridex)", "value": "601e1774fa94bf584b94c505d2ccbbfc60638fd7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620914816, "uuid": "522a692b-5f79-4135-8b24-734853ee1238", "comment": "Malware payload (Dridex)", "value": "bcb8f2ef1d1d92220390dd3e2645dbf0ea86e6cbc12e57e2ff4aeff8c304d209f15b9d55c333a88de69d70df77177292", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914816, "uuid": "3cf0078c-74f7-4a08-b125-c957017aa243", "value": "3BF3D023E717C19AE80E98717273D95372E3EE721240EF79DD09C23EE1576A08879AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914816, "uuid": "567dde81-ed07-47b1-8996-1a923f531530", "value": "a5d8d3bddce161fe65c4f476bd18c6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914816, "uuid": "30a3ba9e-7593-4273-952d-5971ac29ebae", "value": "3072:nar6Ys6p54kfdo+APr0aYSbeO6aal8jeytFQTOpp2J:Rs4p+ADxnSO6D2cOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620914816, "uuid": "cb022895-6f3e-447c-9928-6ae7305ee4da", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620914816, "uuid": "3f44903a-e2e4-48b8-86de-a873b3e2a31f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620914816, "uuid": "5a3fa53d-aefb-4f27-84fb-423ed12ec41e", "value": "9c1e00a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7289be4d-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874431, "uuid": "25cba20c-c712-4e37-9236-28674734a41c", "comment": "Malware payload", "value": "d9d14362d31750c97eeba46e18bd72cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874431, "uuid": "977b7b8a-17b6-4f65-90e7-a30bac5e6a42", "comment": "Malware payload", "value": "1c90681edc86594f761b9d33129318cdb728e34b55c8c8a86c78edb7acc8bd47", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874431, "uuid": "ed9c176c-b108-4f90-93b8-88f6370ff554", "comment": "Malware payload", "value": "f03d8defd27d89e3ce14db240d40bff44de0c262", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874431, "uuid": "466c8d49-f9a7-40f3-a36f-3806b910644a", "comment": "Malware payload", "value": "4d522e2a1a6e76c06e4cabbea1222939cedaf18f0b80147fba798b81e17d9157886f14947b8b26fbb9e4bc4a2f9898c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874431, "uuid": "32f5d2ee-eec8-4c25-8324-13c00986420b", "value": "073302F2D243B6FC7643844E4ACC6F66527B42B046691EF1C15DFEE2923921E0741AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874431, "uuid": "354ea7a6-ae49-4e9d-9ba0-03935a540576", "value": "1536:s/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WexjFuI:0XKAXh3TCdOi+KSZ4WRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874431, "uuid": "6d16b951-66d7-42e0-869b-9081e0e1ab71", "value": 51601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874431, "uuid": "c8b0169f-5d29-421b-b0ab-c53072cd9d04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874431, "uuid": "d4e25544-09bb-4a4e-b4cb-ea4218a4f6b9", "value": "statistic-874424375.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7680fa3-b396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620874546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874546, "uuid": "4e259a81-3769-4a5d-8a46-12293fe7bb38", "comment": "Malware payload", "value": "804cd604ed2f05dedce0c3006a306b23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874546, "uuid": "f03b5eea-0235-4847-beab-d18c8c0f01ce", "comment": "Malware payload", "value": "1c938adee9e8fd624ed1f9504e012e8368740ad907947a77de648a9d0f50d895", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874546, "uuid": "fa2cae24-9ecf-47a2-a5c9-a3e5aacfc3d3", "comment": "Malware payload", "value": "4700f17d7bf3767cf9871bd26fcb1f1c1576dae8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620874546, "uuid": "69eb061c-5c92-4cd7-8cef-abe53aa116db", "comment": "Malware payload", "value": "20698c9995b7767a58b14afb50d49cfc733d53078f36bc5ab297672d6d89dc639dbedd2f0812ce147114633c00dedc8e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874546, "uuid": "2dfbcc6a-1fe3-4397-a30f-a40940003c33", "value": "273312F3D202B2ACB64381494E8C5F47923B817067585EF18219EFA1D33E7170B51EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874546, "uuid": "53f370c2-7c4e-4662-adf4-b86cf8439ecb", "value": "1536:j/2NoLXSqLFDwAXXki3JSOuxtHOi+KuuoZ4WeeTe:DXKAXh3TCdOi+KSZ4W7Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620874546, "uuid": "e649ff40-2b76-4240-bf6f-5d19d1bb0f23", "value": 51603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620874546, "uuid": "5ed0da77-3d52-4f7e-8796-4fcab2356e3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620874546, "uuid": "173418c7-a163-4486-8c57-affe1decee60", "value": "statistic-947677987.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3587367a-b385-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620867027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867027, "uuid": "350a4419-1800-4fb4-aa35-5ac9eeed925d", "comment": "Malware payload", "value": "f87f23627174cb7569d11389acaff115", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867027, "uuid": "1c6e37ea-5ce7-4820-924c-af3478ef162d", "comment": "Malware payload", "value": "1ca367c14b6bd8db1a09c969df8b0f486c9f73b3c451f5ac26e2a0b1defcba30", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867027, "uuid": "fafce013-7e03-4375-9acb-d2516d1cfe95", "comment": "Malware payload", "value": "a645efbb502e7e8759c2e6882bad7c7a70028179", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620867027, "uuid": "19f16fec-3829-4923-a9c6-4e2d842d4248", "comment": "Malware payload", "value": "f85429c47816b6631e19a6f57607966ac9b42443af0a97bd33b95e1422192b119ba8feac51bbe17fc678836040b09593", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867027, "uuid": "4af90b82-d40e-48e5-a37b-231411fbe1e8", "value": "0433E1C4EF1BF858CA837377BC882FD66EAB125464CED09597C6319D0296E32621427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867027, "uuid": "b4f27212-63db-4236-9348-1e57178b2e7e", "value": "1536:MAKgPoXL6N5Y8o4yfDMgJkLf1SzHxaVHiQEb3vE:fpoAnd9gucKCQac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620867027, "uuid": "668e6d79-d7ef-401d-89eb-9a8c941e4f82", "value": 51576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620867027, "uuid": "2bb981da-ff71-44b1-8e9b-0b786409e95d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620867027, "uuid": "779133fb-d9e1-44da-a98b-17da6b0f43e0", "value": "catalog-1260600959.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447dde7e-b3ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620911720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911720, "uuid": "59aa034c-e568-4a2a-90f3-64e264658325", "comment": "Malware payload", "value": "7e1173822ad5a4febd76a670338156ef", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911720, "uuid": "f74112d1-ba26-43b4-ac52-d02d1b2f8c18", "comment": "Malware payload", "value": "1cb141b4e225b1d7c77d0493198b4c7eaad0aefe41ba7eadd1e429d61a831c13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911720, "uuid": "859358e0-f4d4-443e-9abd-95724f2766b3", "comment": "Malware payload", "value": "66f3e2a5867a38c2d6cb99f5733deb3ba0549ebb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620911720, "uuid": "2d28ecef-44c7-4af5-874a-58bf212963a5", "comment": "Malware payload", "value": "42488bfc95117260d02273f779e40f22ecad56c1035986a76ddd1d08a22572b6783a4d9fa1d768daa57874162a48dcc1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911720, "uuid": "7796be0e-106f-48ee-a5e8-fd05689a308d", "value": "A833F1A232D7C13BC0C505F5F42B5ADA66B78EC9E920E0D11D8FDE1113D3165ADB2A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911720, "uuid": "0ae87e6d-30a1-45df-b6f5-93bf9d5145e9", "value": "1536:QEnBrU/c5EkvD5ZCnjq3axD8vuNfr4Nwu2ZH3:VnBrX5Eg5Enjq3axWIfkNwu2ZH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620911720, "uuid": "2c12b30c-a26d-4218-801e-07d64cdcebf8", "value": 51763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620911720, "uuid": "cb32e495-7fd7-48c2-8028-f8fff8e6ff37", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620911720, "uuid": "46c4a646-ff8c-414d-84f4-ba79b9d258fe", "value": "diagram-1024312928.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caedbd3-b394-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620873535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873535, "uuid": "9ea3c98f-b0af-43e1-9d4c-ab490f70ba9c", "comment": "Malware payload", "value": "400e6a750f0136f66b837db6bfc811db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873535, "uuid": "9d920199-681a-433f-af19-5606c647bb26", "comment": "Malware payload", "value": "1cb86dfc2e07f4cabeab290e3ee258e918e545017df2071482f01f6accd1251e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620873535, "uuid": "724f68e1-24b1-4cef-89dc-410693b6e948", "comment": "Malware payload", "value": "e2507f107d685072700b1d2002e8dced72bdf8cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha